|
来源:lam's blog 3 K8 E" S$ s# Z& s b' n
最近好象又开始流行播放器里插木马了,我于是在网上转了转,看有没有什么好东西能预防的. 1 O0 H% ~' t! l) ?1 U: ~
结果在安天CERT小组 看到了这个:
% k7 f7 H8 J @. `0 @3 r软件名称:exe2swf6 g0 P/ x; V/ S/ b. f2 x( f
适用系统:WIN 9x/ME/2000/NT
$ U# R3 A; f. j: P' B* H( D M( P3 q4 v文件大小:11K b3 X9 V) s; a8 U! t
文件说明:FLASH格式文件转换器为了防止有人在可执行的FLASH格式文件(.exe)中夹插木马,或者用flash图标的木马冒充flash文件,编写了一个简单的工具。
3 G5 ?, N: \" l下载:http://soft.hackbase.com/37/20050319/6389.html
) ?4 e0 N) E& Q哈,但是还有还想不到的呢,我找到了一段可以实验这个功能的代码
! g! |9 q/ ?& |8 S4 \+ ^作者:海娃
# x3 R0 u3 a, N/ r: M) i' G用法:
! K8 @2 `- n& {. _' m1 t1 z. z8 p8 D7 I6 l: L
- 将下面代码存为 exe2swf.vbs
/ s: }" U2 C3 d2 ^8 J" Z
- 将exe格式的flash拖放在此文件上,即可生成swf文件,
; X- [. d- }+ G& Z- E# n
' u4 Y0 [/ [! `1 w
'haiwa@http://www.51windows.Net
& T/ S7 i( C+ x+ @+ @2 ]'感谢jimbob提供帮助.
% I. |- H! q; |2 ?' p1 Udim AsoR,FlashFileName' J! ?% T6 L7 _( A J4 k# @
Set ArgObj = WScript.Arguments . e# I- G/ Z: q6 C$ y- K
dim PositionStart,OKed,Tag,EndSize: r4 D: v3 {: o
PositionStart = 920000'flash 4的播放器的大致字节数. k' B$ \' X& P4 R6 t6 Q
EndSize = 8 'exe文件结尾字节数,其它版本可以设置为0
9 O6 [2 L- h# I' d) xFlashFileName = ArgObj(0)'传递路径
( c# N- b5 S, Z) l8 [5 dset AsoR=CreateObject("Adodb.Stream")
) s) @$ H) ]" f- uAsoR.Mode=3
/ x( u; G% Y6 ~, G& Y# eAsoR.Type=1 ! w' O7 S: e8 g6 F! B
AsoR.Open i6 b- W6 D4 }% Z5 F0 w0 `
set AsoW=CreateObject("Adodb.Stream")
0 J3 N$ x$ a$ M' G) F( \; OAsoW.Mode=3 / P1 ^) k% V$ u5 X7 a# v! H
AsoW.Type=1 1 H* c1 z0 K, e: B0 e. u* G0 U# G" h
AsoW.Open
) F3 S+ C7 c" m% a7 X3 l) {AsoR.LoadFromFile(FlashFileName) 0 ?* w4 [1 t( I4 r! M2 ]( b
OKed = true
/ k0 N$ O/ Q" W' t- [dim filesize! m A% X# G) ^& W, p2 h
filesize = AsoR.size * Q5 `+ Z- q: Z" ]0 E) q0 V
if filesize> ositionStart then) L- \ v, i: F m: c- Z8 \4 a
while OKed- \+ N+ h4 P, H- K
AsoR.Position = PositionStart. F, q1 W3 p- ]6 g/ |4 V
Tag = Bin2Str(AsoR.read(20))( I+ [2 g" v: \/ v$ p; @
if instr(Tag,"0000000") >0 then# Q1 p6 S) N' c! b& j( d a
PositionStart = PositionStart + 1
0 _+ n: R. U3 y7 h2 ~& R else
/ H1 f/ U! u4 j' D4 R PositionStart = PositionStart + 20! `0 l, ^. ?6 _" b3 `
end if; A0 {4 \7 D1 E @- Y4 k f" t
if Tag = "00000000000000000708783" or Tag = "00000000000000000678783" then4 M/ M4 k) ]; f# k
OKed = false! r3 S, v4 R9 V, f
end if
, U- p( r+ S: b5 D 'if PositionStart > filesize then
/ y! z4 s5 x2 m) ^/ Y( l: i ' OKed = false
6 G+ ~: `8 l' `2 q+ w5 R; a) d; L1 C 'end if/ B( K5 I, v4 u7 F5 L K# H
wend
3 l; E3 e( }; p) N6 M, Gelse
* z+ b3 q4 U# W+ S# e msgbox "文件错误"7 L4 k7 f9 I% d" |; t% b8 `
end if
2 Z* ~0 R N3 l; p. A5 h$ IPositionStart = PositionStart + 16
" K# W4 X K/ h( R) f q'msgbox PositionStart/ E1 r7 j( n+ H
AsoR.Position = PositionStart
1 j# e2 W7 a8 q1 Z" VAsoW.write AsoR.read(filesize-int(PositionStart)-int(EndSize))
2 J! ^2 e9 z* c- P L$ `1 @'新文件名
) ~1 h" e) w+ P$ V/ J1 c) U( ^& Odim newFileName) ?+ m, G5 {0 t# ?* o
'newFileName = left(FlashFileName,len(FlashFileName)-4) & ".swf"$ l# Z5 M( @; e: ]! a. u) \
newFileName = FlashFileName & ".swf" 6 `1 ?0 S, b3 d K/ b
Set fso = CreateObject("Scripting.FileSystemObject")
* V9 n% s. q( t: ?1 ZIf (fso.FileExists(newFileName)) Then
- {# _0 H b. b( h- B) g; M overwrite = msgbox(newFileName&" 已存在"& vbnewline &"要替换它吗?",308,"文件已经存在 - exe2swf脚本")
+ I B4 G$ _9 l. l5 g if overwrite=6 then
0 l9 c7 j4 @* I2 y$ g* P AsoW.SaveToFile newFileName, 2
9 ^. h3 `3 a& Z2 E* c- \8 h2 ] else% Y6 y- H3 V; U
msgbox "操作被取消",0,"exe2swf脚本"8 N2 ?% B; Q; m
end if
$ j3 L5 [2 k6 e3 W1 e) Eelse) d& p+ c$ b* f% P$ {6 b' D! t
AsoW.SaveToFile newFileName, 1
1 K) |% F9 R M0 O, V3 Q/ v! F6 z; kend if
; W3 h8 @7 G: kAsoR.close
1 j! |' ?) o& d8 e# Z5 X7 j- ~set AsoR=nothing% v8 \9 ?/ S( i! y, O" `
AsoW.close. p3 M/ B- M3 s, |% J+ ]6 A
set AsoW=nothing 4 r S) |4 P' k) H" O9 Y
Function Bin2Str(Bin)
0 m- X" {! A9 H! @ Dim I, Str
1 {4 `- t- P# f For I=1 to LenB(Bin)- r; m- X# [& P( B3 m ~1 ^
clow=MidB(Bin,I,1)
/ }1 Q( |5 o5 a+ @8 c if ASCB(clow)<128 then
- E) C/ p: @. {3 ?/ M Str = Str & (ASCB(clow))
+ r) A q2 d& z3 x else
6 e+ \; A3 m7 b, Y I=I+1
! H+ E& P% p$ l9 G0 w4 l/ `5 @ if I <= LenB(Bin) then Str = Str & (ASCW(MidB(Bin,I,1)&clow))
! l; |9 S0 s0 ] R& Q& | end if K" X( K& w* \' A {* r
Next . k$ B- X* }2 M7 n1 g7 D
Bin2Str = Str
/ X3 B3 p1 B8 N, l6 m9 WEnd Function
- i! o. L1 N* ^0 s4 f: p6 t5 C& L6 ? P$ U0 t0 s
|