Newsgroup: it.news.net-abuse
Titolo: Come decodificare?

Come si fa a capire dove punta questo JavaScript? Ecco il codice della
pagina dello spammer (
http://utenti.tripod.it/zy7fang9n0/
)
HTTP/1.1 200 OK
Date: Sat, 23 Feb 2002 09:33:42 GMT
Server: Apache/1.2.7-dev
Set-Cookie: CookieStatus=COOKIE_OK; path=/; domain=.
tripod.com
;
expires=Sun, 23-Feb-2003 09:33:42 MET
Set-Cookie: MEMBER_PAGE=zy7fang9n0/index.htm; path=/;
domain=
utenti.tripod.it
Connection: close
Transfer-Encoding: chunked
Content-Type: text/html
eab
<SCRIPT LANGUAGE="Javascript"><!--
//0019910288283-004994838-00292992-
function process(pe)
{
document.write(unescape(pe))
return ""
}
function start()
{
var pe=new Array()
pe[0]=new
Array("%3C%53%43%52%49%50%54%20%4C%41%4E%47%55%41%47%45%3D%22%4A%61%76%61%73%63%72%69%70%74%22%3E%0A%64%6F%63%75%6D%65%6E%74%2E%6F%6E%63%6F%6E%74%65%78%74%6D%65%6E%75%20%3D%20%64%69%73%61%62%6C%65%52%69%67%68%74%43%6C%69%63%6B%3B%0A%66%75%6E%63%74%69%6F%6E%20%64%69%73%61%62%6C%65%52%69%67%68%74%43%6C%69%63%6B%28%29%0A%7B%0A%20%72%65%74%75%72%6E%20%66%61%6C%73%65%3B%0A%7D%0A%76%61%72%20%6D%65%73%73%61%67%65%3D%22%22%0A%66%75%6E%63%74%69%6F%6E%20%63%6C%69%63%6B%28%65%29%0A%7B%0A%69%66%20%28%6E%61%76%69%67%61%74%6F%72%2E%61%70%70%4E%61%6D%65%20%3D%3D%20%22%4E%65%74%73%63%61%70%65%22%20%26%26%0A%28%65%2E%77%68%69%63%68%20%3D%3D%20%33%20%7C%7C%20%65%2E%77%68%69%63%68%20%3D%3D%20%32%29%29%0A%72%65%74%75%72%6E%20%66%61%6C%73%65%3B%69%66%20%28%64%6F%63%75%6D%65%6E%74%2E%61%6C%6C%29%0A%7B%0A%69%66%20%28%65%76%65%6E%74%2E%62%75%74%74%6F%6E%20%3D%3D%20%33%29%0A%7B%0A%72%65%74%75%72%6E%20%66%61%6C%73%65%3B%0A%7D%0A%69%66%20%28%65%76%65%6E%74%2E%62%75%74%74%6F%6E%20%3D%3D%20%32%29%0A%7B%0A%72%65%
74%75%72%6E%20%66%61%6C%73%65%3B%0A%7D%0A%7D%69%66%20%28%64%6F%63%75%6D%65%6E%74%2E%6C%61%79%65%72%73%29%0A%7B%0A%69%66%20%28%65%2E%77%68%69%63%68%20%3D%3D%20%33%29%0A%7B%0A%72%65%74%75%72%6E%20%66%61%6C%73%65%3B%0A%7D%0A%7D%0A%7D%0A%69%66%20%28%64%6F%63%75%6D%65%6E%74%2E%6C%61%79%65%72%73%29%0A%7B%0A%64%6F%63%75%6D%65%6E%74%2E%63%61%70%74%75%72%65%45%76%65%6E%74%73%28%45%76%65%6E%74%2E%4D%4F%55%53%45%44%4F%57%4E%29%3B%0A%64%6F%63%75%6D%65%6E%74%2E%63%61%70%74%75%72%65%45%76%65%6E%74%73%28%45%76%65%6E%74%2E%4D%4F%55%53%45%55%50%29%3B%0A%7D%0A%64%6F%63%75%6D%65%6E%74%2E%6F%6E%6D%6F%75%73%65%64%6F%77%6E%3D%63%6C%69%63%6B%0A%64%6F%63%75%6D%65%6E%74%2E%6F%6E%6D%6F%75%73%65%75%70%3D%63%6C%69%63%6B%0A%3C%2F%73%63%72%69%70%74%3E%3C%68%74%6D%6C%3E%0D%0A%3C%68%65%61%64%3E%0A%3C%4D%45%54%41%20%48%54%54%50%2D%45%51%55%49%56%3D%22%50%72%61%67%6D%61%22%20%43%4F%4E%54%45%4E%54%3D%22%6E%6F%2D%63%61%63%68%65%22%3E%0A%3C%4D%45%54%41%20%48%54%54%50%2D%45%51%55%49%56%3D%22%69%6D%61%67%65%74%6F%6F%6C%62
%61%72%22%20%43%4F%4E%54%45%4E%54%3D%22%6E%6F%22%3E%0A%3C%6D%65%74%61%20%6E%61%6D%65%3D%22%4D%53%53%6D%61%72%74%54%61%67%73%50%72%65%76%65%6E%74%50%61%72%73%69%6E%67%22%20%63%6F%6E%74%65%6E%74%3D%22%54%52%55%45%22%3E%0A%3C%4D%45%54%41%20%48%54%54%50%2D%45%51%55%49%56%3D%22%45%78%70%69%72%65%73%22%20%43%4F%4E%54%45%4E%54%3D%22%2D%31%22%3E%0A%0D%0A%3C%74%69%74%6C%65%3E%55%6E%74%69%74%6C%65%64%20%44%6F%63%75%6D%65%6E%74%3C%2F%74%69%74%6C%65%3E%0D%0A%3C%4D%45%54%41%20%48%54%54%50%2D%45%51%55%49%56%3D%22%52%65%66%72%65%73%68%22%20%43%4F%4E%54%45%4E%54%3D%22%30%3B%20%75%72%6C%3D%68%74%74%70%3A%2F%2F%77%77%77%2E%79%61%68%6F%6F%2E%63%6F%6D%22%3E%0D%0A%3C%2F%68%65%61%64%3E%0D%0A%0D%0A%3C%62%6F%64%79%20%6F%6E%64%72%61%67%73%74%61%72%74%3D%22%72%65%74%75%72%6E%20%66%61%6C%73%65%22%20%6F%6E%73%65%6C%65%63%74%73%74%61%72%74%3D%22%72%65%74%75%72%6E%20%66%61%6C%73%65%22%20%20%6F%6E%6C%6F%61%64%3D%22%66%75%6C%6C%77%69%6E%28%29%3B%22%3E%0D%0A%0D%0A%3C%73%63%72%69%70%74%3E%0D%0A%3C%21%2D%2D%0D%0A%0D%0
A%66%75%6E%63%74%69%6F%6E%20%66%75%6C%6C%77%69%6E%28%29%7B%0D%0A%77%69%6E%64%6F%77%2E%6F%70%65%6E%28%22%68%65%6C%6C%6F%2E%68%74%6D%22%2C%22%22%2C%22%66%75%6C%6C%73%63%72%65%65%6E%2C%73%63%72%6F%6C%6C%62%61%72%73%22%29%0D%0A%7D%0D%0A%2F%2F%2D%2D%3E%0D%0A%3C%2F%73%63%72%69%70%74%3E%0D%0A%0D%0A%0D%0A%3C%70%20%61%6C%69%67%6E%3D%22%43%45%4E%54%45%52%22%3E%26%6E%62%73%70%3B%3C%2F%70%3E%0D%0A%3C%70%20%61%6C%69%67%6E%3D%22%63%65%6E%74%65%72%22%3E%26%6E%62%73%70%3B%3C%2F%70%3E%0D%0A%3C%2F%62%6F%64%79%3E%0D%0A%0D%0A%0D%0A%0D%0A%0D%0A%0D%0A%0D%0A%0D%0A%0D%0A%3C%2F%68%74%
3f 
6D%6C%3E%0D%0A")
process(pe);
}
start();
//-->
</script>
0

 pagina dello spammer (
http://utenti.tripod.it/zy7fang9n0/
)
ti apre una pagina nuova a 
http://utenti.tripod.it/zy7fang9n0/hello.htm
e ti ti fa un refresh della attuale su 
www.yahoo.com
HTTP/1.1 200 OK
Date: Sat, 23 Feb 2002 09:47:28 GMT
Server: Apache/1.2.7-dev
Set-Cookie: CookieStatus=COOKIE_OK; path=/; domain=.
tripod.com
; expires=Sun,
23-Feb-2003 09:47:28 MET
Set-Cookie: MEMBER_PAGE=zy7fang9n0/index.htm; path=/;
domain=
utenti.tripod.it
Connection: close
Content-Type: text/html
<SCRIPT LANGUAGE="Javascript"><!--
//0019910288283-004994838-00292992-
function process(pe)
{
document.write(unescape(pe))
return ""
}
function start()
{
var pe=new Array()
pe[0]=new Array("<SCRIPT LANGUAGE="Javascript">
document.oncontextmenu = disableRightClick;
function disableRightClick()
{
 return false;
}
var message=""
function click(e)
{
if (navigator.appName == "Netscape" &&
(e.which == 3 || e.which == 2))
return false;if (document.all)
{
if (event.button == 3)
{
return false;
}
if (event.button == 2)
{
return false;
}
}if (document.layers)
{
if (e.which == 3)
{
return false;
}
}
}
if (document.layers)
{
document.captureEvents(Event.MOUSEDOWN);
document.captureEvents(Event.MOUSEUP);
}
document.onmousedown=click
document.onmouseup=click
</script><html>
<head>
<META HTTP-EQUIV="Pragma" CONTENT="no-cache">
<META HTTP-EQUIV="imagetoolbar" CONTENT="no">
<meta name="MSSmartTagsPreventParsing" content="TRUE">
<META HTTP-EQUIV="Expires" CONTENT="-1">
<title>Untitled Document</title>
<META HTTP-EQUIV="Refresh" CONTENT="0; url=
http://www.yahoo.com
">
</head>
<body ondragstart="return false" onselectstart="return false"
onload="fullwin();">
<script>
<!--
function fullwin(){
window.open("hello.htm","","fullscreen,scrollbars")
}
//-->
</script>
<p align="CENTER">&nbsp;</p>
<p align="center">&nbsp;</p>
</body>

 ti apre una pagina nuova a 
http://utenti.tripod.it/zy7fang9n0/hello.htm
che decodificando di nuovo... andiamo su ..
http://utenti.tripod.it/zy7fang9n0/top.htm
http://utenti.tripod.it/zy7fang9n0/main.htm
[....]
<frameset rows="7%, 93%" cols="*" bordercolor="#FFFFFF" border="0">
  <frame src="top.htm" name="top" scrolling="NO" NORESIZE frameborder="NO"
bordercolor="#FFFFFF">
  <frame src="main.htm" name="main" bordercolor="#FFFFFF">
    <noframes>
<body ondragstart="return false" onselectstart="return false"
bgcolor="#FFFFFF">
    <p>&nbsp;</p>
</body></noframes>
</frameset>
</html>
")
process(pe);
}
[...]

 
http://utenti.tripod.it/zy7fang9n0/main.htm
oppala, questa e' facile, nemmeno encriptata ...
META HTTP-EQUIV="Refresh" CONTENT="0; url=
http://65.83.24.44/
"
e questo e' il vero sito dopo il giro di redirect.
ergo segnala :
abuse (at) 
tripod.it
 e a
it-webmaster-lycos (at) 
lycos-europe.com
pronto a scalarla a mediaways se tripod non risponde ad  abuse (at)
mediaways.net
e in questo modo di seghi il redirector su tripod.
Per quanto riguarda 
http://65.83.24.44
 troviamo traccia su SPEWS
http://spews.org/html/S679.html
   [
65.83.24.0/25
, 
letelecom.net
(
bellsouth.net
)]
e andiamo con il lart su abuse (at) 
bellsouth.net
per il form c'e' come action il richiamo ad uno script
(
http://65.83.24.44/csv.php
) che non so dirti cosa faccia, ma credo che
salvi la tua mail in un database dello spammer.
[ form action="csv.php" method="post" name="theform"  onsubmit="return
Form1_Validator(this)" ]
comunque con tripod seghi il redirector e con bellsouth la vera pagina dello
spammer.