网站劫持

 

最近网站部分域名被劫持,刚开始以为DNS原因,经过曲折故障排查,最终确定被劫持的部分域名未使用https导致网站劫持,下为测试脚本

@echo off

Echo *******************************************************************************

Echo          Collect Machine Information…………

Echo *******************************************************************************
ipconfig /all >> "%userprofile%"\desktop\Information.txt
echo. >> "%userprofile%"\desktop\Information.txt
echo. >> "%userprofile%"\desktop\Information.txt
nslookup -qt=ns hs.51cjml.com >> "%userprofile%"\desktop\Information.txt
echo. >> "%userprofile%"\desktop\Information.txt
echo. >> "%userprofile%"\desktop\Information.txt
nslookup -qt=a hs.51cjml.com >> "%userprofile%"\desktop\Information.txt
Echo *******************************************************************************

Echo *******************************************************************************

Echo          Changing DNS Server…………

Echo *******************************************************************************

::cmd /c netsh interface ip set address name="本地连接" source=static addr=192.168.1.136 mask=255.255.255.0 gateway=192.168.0.1 gwmetric=1

chcp 65001

cmd /c netsh interface ip set dns name="以太网" source=static addr=8.8.8.8

cmd /c netsh interface ip add dns name="以太网" addr=127.0.0.1 index=2

cmd /c netsh interface ip set dns name="本地连接" source=static addr=8.8.8.8

cmd /c netsh interface ip add dns name="本地连接" addr=127.0.0.1 index=2

cmd /c netsh interface ip set dns name="WLAN" source=static addr=8.8.8.8

cmd /c netsh interface ip add dns name="WLAN" addr=127.0.0.1 index=2

cmd /c netsh interface ip set dns name="无线网络连接" source=static addr=8.8.8.8

cmd /c netsh interface ip add dns name="无线网络连接" addr=127.0.0.1 index=2

ipconfig /all

ipconfig /flushdns

Echo *******************************************************************************

Echo          OK！！Success…………

Echo          All done

Echo *******************************************************************************

cls

color 0A

chcp 65001

Echo *******************************************************************************

Echo          Collect Machine Information…………

Echo *******************************************************************************
ipconfig /all >> "%userprofile%"\desktop\Information.txt
echo. >> "%userprofile%"\desktop\Information.txt
echo. >> "%userprofile%"\desktop\Information.txt
nslookup -qt=ns hs.51cjml.com >> "%userprofile%"\desktop\Information.txt
echo. >> "%userprofile%"\desktop\Information.txt
echo. >> "%userprofile%"\desktop\Information.txt
nslookup -qt=a hs.51cjml.com >> "%userprofile%"\desktop\Information.txt
Echo *******************************************************************************

Pause

 

部分截图

 

 

 

 

 

 

 

 

 

 

 

 

 

下面的502为安全联盟的

 

 

 

下面为被篡改的连接

http://jump.anquan.org:8080/warning/index.html?q=320501X1376122809PHDGBITAVPASST+http://aximo.51cjml.com/

http://jump.anquan.org:8080/warning/index.html?q=320501X1376122809PHDGBITAVPASST+http://aximo.51cjml.com/

http://jump.anquan.org:8080/complain/report/?ac=320501&url=http%3A%2F%2Faximo.51cjml.com%2F&unet=0&pa=warning&sc=320501X1376122809PHDGBITAVPASST&et=39&ar=consult&id=3205011774320200831181112805773