最近那个IE7 0day shellcode解密

作者：lcx

一、用freshow工具来解密

原始链接

http://bbs.kafan.cn/viewthread.php?tid=383769&page=1&extra=page%3D1#pid5736829
需要提取shellcode解密

1 将dadong替换为％u 进行一次esc解密－－up

2 esc 旁填入 21 decode 应该就出现了

二、自己动手吧，写个解密代码

‘解密代码
code=”%u5549%u5155%u0E1B%u560E%u5656%u520F%u494E%u0F54%u4E42%u0E4C%u0F10%u5944%u0044″

function replaceregex(str)
Sstr=Replace(str,”%u”,””)
set regex=new regExp
regex.pattern=”(..)(..)”
regex.IgnoreCase=true
regex.global=true
matches=regex.replace(Sstr,”$2$1″)
replaceregex=matches
end Function

Function Hex2Str(hexStr)
Dim sstr,hextmp
For i = 1 To Len(hexStr) step 2
hexTmp = Mid(hexStr,i,2)
If hexTmp <> “00” Then
sstr = sstr & Chr(CLng(“&h” & hexTmp) Xor &H21)
End If
Next
Hex2Str = sstr
End Function

set fso=CreateObject(“scripting.filesystemobject”)
set fileS=fso.opentextfile(“a.txt”,8,true)
fileS.writeline Hex2Str(replaceregex(code))
files.close
set fso=Nothing

鬼仔's Blog