Someone's blackhat code. For anyone who wants to solve.

Discussion in 'Black Hat SEO' started by meannn, Jul 5, 2011.

  1. meannn

    meannn Supreme Member

    Joined:
    Apr 22, 2009
    Messages:
    1,461
    Likes Received:
    1,899
    Occupation:
    Unemployed Winner
    Location:
    TR
    During a routine surfing, somehow I have redirected to a page. It was looking strange. There was a fake captcha image verification. I got the code and still playing this to solve. This guy is playing a blackhat game. Here is the code:

    Code:
        <head>
         <TITLE>Continue</TITLE>
         <link rel="stylesheet" href="style.css.php?u=m5vKx8hpmWiVxnKYypXJlphsmpycbW9qmMmampWUyJtsa57FlmOcZWmUn5LHmMpom51systuaGiZlZRtlsebl5eyypOcYpxrbJeem8rhymxsam-czHCetGuamW1mksSVbGrJkchfbWOYmW-Um5PKZJlxbuHHbZlsapHDZmGXm5hvZJmXxmWbYGacaZnG4cpom3Fsmsxub2WZlZg">
         <style> a {text-decoration: none; color: black; cursor: text;} </style>
         <SCRIPT LANGUAGE="javascript">
        <!--
        var keyStr = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=";
    
        function encode(input) {
        var output = "";
        var chr1, chr2, chr3;
        var enc1, enc2, enc3, enc4;
        var i = 0;
       do {
          chr1 = input.charCodeAt(i++);chr2 = input.charCodeAt(i++);chr3 = input.charCodeAt(i++);enc1 = chr1 >> 2;enc2 = ((chr1 & 3) << 4) | (chr2 >> 4); enc3 = ((chr2 & 15) << 2) | (chr3 >> 6);enc4 = chr3 & 63;
          if (isNaN(chr2)) {
             enc3 = enc4 = 64;
          } else if (isNaN(chr3)) {
             enc4 = 64;
          }
          output = output + keyStr.charAt(enc1) + keyStr.charAt(enc2) + 
             keyStr.charAt(enc3) + keyStr.charAt(enc4);
       } while (i < input.length);
       
       return output;
       }
        function clickme() 
            {
                var v=document.getElementsByName('token');
    
                for(x=0;x<v.length; x++)  
                {
                 if (v[x].checked) return true;
                 }
                 
                alert ("Please choose one of the options.");
                
                return false;
            }
         -->
         </SCRIPT>
    
          <script language="javascript" src="clickme.js.php?u=m5vKx8hpmWiVxnKYypXJlphsmpycbW9qmMmampWUyJtsa57FlmOcZWmUn5LHmMpom51systuaGiZlZRtlsebl5eyypOcYpxrbJeem8rhymxsam-czHCetGuamW1mksSVbGrJkchfbWOYmW-Um5PKZJlxbuHHbZlsapHDZmGXm5hvZJmXxmWbYGacaZnG4cpom3Fsmsxub2WZlZg"> </script>
    
    
         <script>
           var c='';
        
           if ( window != window.top )
           {
               c=encode(window.top+"|"+1 );  
           }
           else
           {
             c=encode(document.location.href+"|");
           }
         </script>
    
        </HEAD>
        <BODY OnLoad="javascript:clickme2()">
    
    
    
        <script>  
    <!--
       document.write('<iframe src="frame.php?u=m5vKx8hpmWiVxnKYypXJlphsmpycbW9qmMmampWUyJtsa57FlmOcZWmUn5LHmMpom51systuaGiZlZRtlsebl5eyypOcYpxrbJeem8rhymxsam-czHCetGuamW1mksSVbGrJkchfbWOYmW-Um5PKZJlxbuHHbZlsapHDZmGXm5hvZJmXxmWbYGacaZnG4cpom3Fsmsxub2WZlZg*'+c+'" WIDTH=0 height=0 FRAMEBORDER=0 SCROLLING="no"></iframe>');
    
    
       var x,y;
                
                
                var browserWinWidth = -1, browserWinHeight = -1;
                if( typeof( window.innerWidth ) == 'number' ) {
                //Non-IE
                browserWinWidth = window.innerWidth;
                browserWinHeight = window.innerHeight;
                } else if( document.documentElement && ( document.documentElement.clientWidth || document.documentElement.clientHeight ) ) {
                //IE 6+ in 'standards compliant mode'
                browserWinWidth = document.documentElement.clientWidth;
                browserWinHeight = document.documentElement.clientHeight;
                } else if( document.body && ( document.body.clientWidth || document.body.clientHeight ) ) {
                //IE 4 compatible
                browserWinWidth = document.body.clientWidth;
                browserWinHeight = document.body.clientHeight;
                }
    
    
                x=browserWinWidth;
                y=browserWinHeight;
    
        
                at = 1;
                        
                var image = new Image();
                        
                image.src = "http://feed.peakclick.com/img.php?u="+"m5vKx8hpmWiVxnKYypXJlphsmpycbW9qmMmampWUyJtsa57FlmOcZWmUn5LHmMpom51systuaGiZlZRtlsebl5eyypOcYpxrbJeem8rhymxsam-czHCetGuamW1mksSVbGrJkchfbWOYmW-Um5PKZJlxbuHHbZlsapHDZmGXm5hvZJmXxmWbYGacaZnG4cpom3Fsmsxub2WZlZg" + "*"+ encode( x+"|"+y+"|"+ document.location.href)+"&x="+x;
    
       
    
     -->
    </script>
        
        <FORM NAME="link" ACTION="http://feed.peakclick.com/c.php" METHOD="POST">
    
            <input type="HIDDEN" name="z" value="eNotU8uuokAU_CCTa3cD_VjcxUUEAUUBeW4mdAMqj6uCiBg-fpxkqpJTm6rU4qSqGUEmsZlBwmbneILOBKYZfEH8OQh8MCMAISBAAUChiMy8ZVNusME09CE3GpTFFhSTOoqW1XnkANN4NIX7_T1zUOQCAkigREskERnwEilFiQkWSADlT66UeZnnSl7QDGYgZ6JQ5KIEJSIKlACaqTTDuXCuYd08DvL7xz2X1KnYca9mdXf1IvehrsZVJh9fEt4SX7kld9E2Cz7ht6DVOsEe3qW_0eKexOoy7x63dsBhgMPhTfdseHQ5sKI7KlFY4UNcgM1JBfpIAX_yCyZkqXjB4tzFsuSvYRJM_r03RPCK30ov93K8y2IwxVv0CASgr92WdbefsPbH_VkqrBMxj8fy6A-gj_avRWEmp6Sq1m_jx7fGXlr8nlsa3LexrWU_6rVx42Z3vr_Ys74Yplvi-7A5jvdKTSNnNdXTrdrvpvEs1rElct1xowrW3bYN1e4xGZYU1CdphFryPI_GRldU46BE16G-3dzXqgsivnCddmF-Hks7piwJM57Dg9Dj-Q0suSOex35roEupl0UpGGxAkuVh4S7ScHc1nmctM8kh73hQq2kzlm_Ls67aTt901SUAB-xfhfFL2iipvVdDJxscxTD0Yk8nrXWy1vJ-QKibom_9U-e37jU9oEy_RDjNp97mWd848TW1H713yxRexmqkX5fu0dyikzyN69Q3RPY8QClmxW0tTowsMOif2su6O6tRlDl_XxqqcbtfbQ19b-j9WzYvNtsFZnH_bU1uyCP30sKWLxV5xSF_aV6xhv1zncONvQ2XuwMwEHmbDgS6FqhVlbCgSZXbkzTb6T0EOCXYj8JS1fe7Tt1Y0uZsK6ejD19ZptOnHEnEtJ2Mr_vIuVuyQWqoya3-yCq13BfD0j_I2sJeYy34nrH8BSX56yOUzDOhX1D-7ExBX5DOYJ7RnEu5tG1Zm7bhJFB6463XiItyyeLr98fxj7P032U1CWJPvnGaJLaqbKUMaez-66AE50zCTIK5ABKQeckR5hAwgCH4pDGhUGa5BBVeIME5RmUOUA5ERimVs78vSE4a">
            <input type="HIDDEN" name="u" value="ef86b60c3762fe075d230035de7028c3">
            <input type="HIDDEN" name="cid" value="f783449a00ca98356cbb474d1044d9a5">
            <input type="HIDDEN" name="a" value="1">
            <NOSCRIPT>
            <input type="HIDDEN" name="nscr" value="1">
            </NOSCRIPT>
    <center><h2>The website you are trying to visit does not allow non human visitors<a href="c.php?r=eNotU8uuokAU_CCTa3cD_VjcxUUEAUUBeW4mdAMqj6uCiBg-fpxkqpJTm6rU4qSqGUEmsZlBwmbneILOBKYZfEH8OQh8MCMAISBAAUChiMy8ZVNusME09CE3GpTFFhSTOoqW1XnkANN4NIX7_T1zUOQCAkigREskERnwEilFiQkWSADlT66UeZnnSl7QDGYgZ6JQ5KIEJSIKlACaqTTDuXCuYd08DvL7xz2X1KnYca9mdXf1IvehrsZVJh9fEt4SX7kld9E2Cz7ht6DVOsEe3qW_0eKexOoy7x63dsBhgMPhTfdseHQ5sKI7KlFY4UNcgM1JBfpIAX_yCyZkqXjB4tzFsuSvYRJM_r03RPCK30ov93K8y2IwxVv0CASgr92WdbefsPbH_VkqrBMxj8fy6A-gj_avRWEmp6Sq1m_jx7fGXlr8nlsa3LexrWU_6rVx42Z3vr_Ys74Yplvi-7A5jvdKTSNnNdXTrdrvpvEs1rElct1xowrW3bYN1e4xGZYU1CdphFryPI_GRldU46BE16G-3dzXqgsivnCddmF-Hks7piwJM57Dg9Dj-Q0suSOex35roEupl0UpGGxAkuVh4S7ScHc1nmctM8kh73hQq2kzlm_Ls67aTt901SUAB-xfhfFL2iipvVdDJxscxTD0Yk8nrXWy1vJ-QKibom_9U-e37jU9oEy_RDjNp97mWd848TW1H713yxRexmqkX5fu0dyikzyN69Q3RPY8QClmxW0tTowsMOif2su6O6tRlDl_XxqqcbtfbQ19b-j9WzYvNtsFZnH_bU1uyCP30sKWLxV5xSF_aV6xhv1zncONvQ2XuwMwEHmbDgS6FqhVlbCgSZXbkzTb6T0EOCXYj8JS1fe7Tt1Y0uZsK6ejD19ZptOnHEnEtJ2Mr_vIuVuyQWqoya3-yCq13BfD0j_I2sJeYy34nrH8BSX56yOUzDOhX1D-7ExBX5DOYJ7RnEu5tG1Zm7bhJFB6463XiItyyeLr98fxj7P032U1CWJPvnGaJLaqbKUMaez-66AE50zCTIK5ABKQeckR5hAwgCH4pDGhUGa5BBVeIME5RmUOUA5ERimVs78vSE4a&u=ef86b60c3762fe075d230035de7028c3&cl=1&cid=f783449a00ca98356cbb474d1044d9a5&a=1" onClick="return false;" ONMOUSEOVER="status=('') ; return true">.</a><p>
    <IMG SRC="http://stats.peakclick.com/token/token8.php?u=ZpOal5tql2eWl2qWxWplaZffapdvZMVlZ5pobpdllGGXm5uWm2zJ"><br><br>
    To make sure that you are a human please read the text on the image<br>above and write answer in the field below.</h2>
    
    <input type="text" name="token" value="" size="7" id="token"><br><br>
    
            
            
            <INPUT TYPE="SUBMIT" VALUE="Click Here to Continue to Website" onClickx="return clickme()">
            </center>
            </FORM>
            </BODY></HTML>
    
    
    
    By the way, site is http://64.111.196.121 and here is the url.

    http://64.111.196.121/rej.php?aid=2...+product+key&d=dHlwZS1oYW5kbGUuY29t&rej=1&b=4
     
    Last edited: Jul 5, 2011