|
来源:lam's blog 4 x# c4 m3 L+ S4 ?* c
最近好象又开始流行播放器里插木马了,我于是在网上转了转,看有没有什么好东西能预防的.
% O) x$ X1 r, C# s+ j. M7 Q结果在安天CERT小组 看到了这个:
9 o! J6 o/ q& d- b& a软件名称:exe2swf
; I4 Q7 K9 m( M# I6 n6 V v适用系统:WIN 9x/ME/2000/NT# W. O8 _* N; _9 E/ A2 M
文件大小:11K- j: s2 S3 F3 j# e V$ U
文件说明:FLASH格式文件转换器为了防止有人在可执行的FLASH格式文件(.exe)中夹插木马,或者用flash图标的木马冒充flash文件,编写了一个简单的工具。
' ]$ F2 u8 b/ W下载:http://soft.hackbase.com/37/20050319/6389.html - `5 p6 B* W9 G1 p: [
哈,但是还有还想不到的呢,我找到了一段可以实验这个功能的代码 4 \/ G7 V9 K- l; V9 G
作者:海娃
' V- m6 T% r1 H5 F$ Z用法:
, O8 K3 ]' q" q. A+ k
+ u/ U+ C* O K( s' ?/ q& L- 将下面代码存为 exe2swf.vbs
2 i3 X7 c$ E; O( K) W
- 将exe格式的flash拖放在此文件上,即可生成swf文件,
, b0 L$ X+ }: S3 Y, d9 `
. v; b# V8 g; G7 Z2 V7 I1 r
'haiwa@http://www.51windows.Net
, v# g4 }" e7 Q" p8 S6 {+ |'感谢jimbob提供帮助.
1 M6 V* D: X0 {dim AsoR,FlashFileName
/ W, |0 X6 r# _; ]9 @Set ArgObj = WScript.Arguments
' c* Y' C* O) c& F* Z: f( Ddim PositionStart,OKed,Tag,EndSize
0 T" b6 t7 S; |& W. Y* {) c. T4 {PositionStart = 920000'flash 4的播放器的大致字节数! X& {+ I. `) o/ d$ r& F- k" l+ t
EndSize = 8 'exe文件结尾字节数,其它版本可以设置为0 P% m2 `: V7 U! {
FlashFileName = ArgObj(0)'传递路径
% c2 z7 L+ s7 j$ P. B9 M; qset AsoR=CreateObject("Adodb.Stream")/ K$ J- L9 i0 V" D* ?2 `7 p
AsoR.Mode=3
& X7 ]4 h* e7 S+ V$ E2 f7 h7 dAsoR.Type=1
* E9 [4 e, \2 b' s0 |AsoR.Open / C" p; t; |& w
set AsoW=CreateObject("Adodb.Stream")
2 b% z5 ?, r$ W8 w, o' WAsoW.Mode=3 ~0 y' l3 ^4 @/ P. g! e
AsoW.Type=1 + c2 F; C! `( ]
AsoW.Open3 M/ b; v; s! S, I+ _9 r5 D
AsoR.LoadFromFile(FlashFileName) 8 }' L, l7 d* N, o9 g
OKed = true
4 }+ |; K) q, m: Rdim filesize
$ f6 H- ~/ Q. _; T* J& N- @filesize = AsoR.size
/ W6 H, n, [- f2 I$ Qif filesize> ositionStart then8 w2 N, |0 W1 L& @& g7 \
while OKed* C+ K0 p9 u# W2 p
AsoR.Position = PositionStart" r" k) Y& D( F$ l
Tag = Bin2Str(AsoR.read(20))
- O2 x) f9 J2 G. x3 G8 D if instr(Tag,"0000000") >0 then
v4 K: B* p8 [4 j$ L/ q PositionStart = PositionStart + 1
! m0 ^8 @! j& y9 ` else/ Z3 L# e: I& F: W' {! L2 Q% P
PositionStart = PositionStart + 20
) m1 m. Y: L8 l end if: \, H: M( u, l/ v$ _
if Tag = "00000000000000000708783" or Tag = "00000000000000000678783" then
1 D7 b# v# M3 g% G; w* a OKed = false( @+ K1 d: m. U' X) n0 O
end if5 h7 X- _; \5 a# g
'if PositionStart > filesize then
; {' k' X1 R0 K9 Y ' OKed = false, ?* c7 H$ e" D9 f4 \
'end if4 }% t! e, n. E0 y
wend# z" l" \/ A2 X$ a0 E! V
else, r H& ~! e: `; [1 m' J1 K3 h
msgbox "文件错误"
3 L. p8 x+ v; u0 V+ z( _: Oend if& M$ P% O" O8 r% J
PositionStart = PositionStart + 160 b) h5 h) Z E+ E, ]5 C
'msgbox PositionStart z: e. v4 Q# N' G" l5 }6 x# H
AsoR.Position = PositionStart
( o$ N, K2 ~0 Q+ w. u n7 HAsoW.write AsoR.read(filesize-int(PositionStart)-int(EndSize)) 2 e$ X+ W$ w( R$ c) p' k
'新文件名; ?' v( M/ d) N0 q
dim newFileName
" P \4 U9 r! w; v' L'newFileName = left(FlashFileName,len(FlashFileName)-4) & ".swf"! A+ c, `& I8 s6 h9 F
newFileName = FlashFileName & ".swf"
9 s7 r4 c: ^1 ~2 aSet fso = CreateObject("Scripting.FileSystemObject")8 Z+ n5 d, U% b+ H- F- N
If (fso.FileExists(newFileName)) Then
! l& F0 L( d0 C) f5 a overwrite = msgbox(newFileName&" 已存在"& vbnewline &"要替换它吗?",308,"文件已经存在 - exe2swf脚本")/ ~4 t/ `; S* A
if overwrite=6 then+ Q0 R+ F) W3 B; |, _ m+ k6 R
AsoW.SaveToFile newFileName, 2
7 g8 m4 I; y1 f0 W else/ A. x" h! `6 \5 X+ O) f
msgbox "操作被取消",0,"exe2swf脚本"' P6 C. _& v: K4 P1 D
end if+ ~/ O. M( e* {
else
* h& D+ a. N0 j7 o" v3 h AsoW.SaveToFile newFileName, 1
" }& Q& ~9 A! h2 |1 Y4 vend if
; T0 ^+ t/ l) F @+ q, sAsoR.close8 o' f* ]9 }9 x
set AsoR=nothing& B1 y& \5 V5 y+ c" [2 s
AsoW.close8 p$ A* R7 F' M$ `
set AsoW=nothing 9 U; r; o9 t6 \0 `: B9 Y! d' n
Function Bin2Str(Bin)
# q, g6 U/ T, x y7 c Dim I, Str
: w6 ?+ d' H. {9 X For I=1 to LenB(Bin)
! t! Z9 k4 ]3 K clow=MidB(Bin,I,1)
! l. ]: z& y: Y1 w) f4 j: V if ASCB(clow)<128 then1 C* E; I$ r# K; V8 u) }
Str = Str & (ASCB(clow))
" `: q) `' n8 {2 g9 G else
# p3 k2 y' \4 X. @ I=I+1
( G3 j5 ^7 o/ K$ b' R if I <= LenB(Bin) then Str = Str & (ASCW(MidB(Bin,I,1)&clow))) f8 ~: {( |$ ~& m; r9 n4 J3 S
end if9 M j' T. A3 z8 u4 C/ w
Next % p, }4 P8 C5 T1 P9 o. `
Bin2Str = Str) x! a/ E/ F3 l% H, D- ]9 ^
End Function
8 t F) w+ ?! i5 G4 {& x6 s/ |
4 q3 V( H3 T, l7 R" s4 T |