运维开发网

VBScript之通过对比注册表查找隐藏的服务

运维开发网 https://www.qedev.com 2020-02-17 13:54 出处:网络 作者: 网络整理
系统服务有可能被 rootkit 隐藏,但有些时候我们仍可以从注册表中找到相关的信息。建议以管理员权限运行,否则有些服务列举不出来或出现错误的提示
效果图:

代码(checksvr.vbs):

复制代码 代码如下:

'On Error Resume Next

Const HKEY_LOCAL_MACHINE = &H80000002

Set oReg=GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\default:StdRegProv")

strKeyPath = "SYSTEM\CurrentControlSet\Services"

oReg.EnumKey HKEY_LOCAL_MACHINE, strKeyPath, arrSubKeys

Wscript.Echo "Checking, please wait ..."

Wscript.Echo ""

For Each subkey In arrSubKeys

 oReg.GetStringValue HKEY_LOCAL_MACHINE, strKeyPath & "\\" & subkey, "ObjectName", strValue

 If Not (strValue = "") Then

  '判断服务, 利用数组来比较不知道会不会快些?

  If Not (CheckSvr(subkey)) Then

   Wscript.Echo subkey & FormatOutTab(subkey) & strValue & FormatOutTab(strValue) & "[ Hidden ]"

  Else 

   Wscript.Echo subkey & FormatOutTab(subkey) & strValue & FormatOutTab(strValue) & "[   OK   ]"

  End If

 End If

Next

Wscript.Echo ""

Wscript.Echo "All done."

Wscript.Quit (0)

 

Function CheckSvr(strName)

 Set oWMI = GetObject("winmgmts:" & "{impersonationLevel=impersonate}!\\.\root\cimv2")

 Set cService = oWMI.ExecQuery("Select * from Win32_Service WHERE Name='" & strName & "'")

 If (cService.count <> 0) Then

  CheckSvr = True

 Else

  CheckSvr = False

 End If

End Function

Function FormatOutTab(strName)

 strLen = Len(strName)

 Select Case True

  Case strLen < 8

   FormatOutTab =  vbTab & vbTab & vbTab & vbTab & vbTab

  Case strLen < 16

   FormatOutTab =  vbTab & vbTab & vbTab & vbTab

  Case strLen < 24

   FormatOutTab =  vbTab & vbTab & vbTab

  Case strLen < 32

   FormatOutTab =  vbTab & vbTab

  Case strLen < 40

   FormatOutTab =  vbTab

  Case Else

   FormatOutTab =  vbTab

  End Select

End Function

利用字典,速度要快很多:

复制代码 代码如下:

Dim oDic, oReg, oWmi, arrServices

Const HKEY_LOCAL_MACHINE = &H80000002

Wscript.Echo "[*] Checking, please wait ..."

Wscript.Echo ""

Set oDic = CreateObject("Scripting.Dictionary")

Set oWmi = GetObject("winmgmts:" & "{impersonationLevel=impersonate}!\\.\root\cimv2")

Set arrServices = oWmi.ExecQuery("Select * from Win32_Service")

For Each strService In arrServices

 oDic.Add strService.Name, strService.Name

Next

Set oReg = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\default:StdRegProv")

strKeyPath = "SYSTEM\CurrentControlSet\Services"

oReg.EnumKey HKEY_LOCAL_MACHINE, strKeyPath, arrSubKeys

For Each subkey In arrSubKeys

 oReg.GetStringValue HKEY_LOCAL_MACHINE, strKeyPath & "\\" & subkey, "ObjectName", strValue

 If Not (strValue = "") Then

  If oDic.Exists(subkey) Then

   Wscript.Echo subkey & FormatOutTab(subkey) & strValue & FormatOutTab(strValue) & "[   OK   ]"

  Else 

   Wscript.Echo subkey & FormatOutTab(subkey) & strValue & FormatOutTab(strValue) & "[ Hidden ]"

  End If

 End If

Next

oDic.RemoveAll

Wscript.Echo ""

Wscript.Echo "[*] All done."

Wscript.Quit (0)

Function FormatOutTab(strName)

 strLen = Len(strName)

 Select Case True

  Case strLen < 8

   FormatOutTab =  vbTab & vbTab & vbTab & vbTab

  Case strLen < 16

   FormatOutTab =  vbTab & vbTab & vbTab

  Case strLen < 24

   FormatOutTab =  vbTab & vbTab

  Case strLen < 32

   FormatOutTab =  vbTab

  Case Else

   FormatOutTab =  vbTab

  End Select

End Function

来自: enun.net

0

精彩评论

暂无评论...
验证码 换一张
取 消