EditServer.exeһг˵ĺų.

1.EditServer.exeͬһѹڵInjectT.exeѹ
 ͬһĿ¼.
2.ִeditserver.exe InjectT.exe,Ȼͻῴ
  õϢҪһ÷ȡ

  óϢֻǼӹܵģʲôӵ㷨ܵģĻ
  úѹ治еĻѹá

һʹѹڵEditServer.exeã汾EditServer.exe
һá

ʹǰһҪ:
1.ʾԼܳ64ַ.
2.벻ܳ32ַ
3.ûĻôĬwineggdropshell
4.÷ĻôĬϷWindows Internet Services
5.ûö˿ڵĻôĬϵĶ˿Ϊ12345
6.ûýŵDLL嵽ǸȥĻĬǲ嵽Explorer.exeȥ
7.ûInjectT.exeĸDLL뵽ȥĻInjectT.exeĬϽTBack.Dll
  ̡
8.㽫TBack.DllˣôһҪеĵ8(ҪעDLL),
  㽫TBack.DllˣInjectT.exeʱûõ8ôInjectT.exeͻ
  ŵDLLļȥ嵽̡
9.еĵ8(ҪעDLL)ʱ㽫TBack.DllΪAbc.DLL,ô
  ҪAbc.DLL
10.õ9(ҪעDLLĽ)뽫DLLע뵽Svchostȥ
  ôӦsvchost.exe
11.ԽInjectT.exeϴġ
12.㽫DLL嵽һЩϵͳҪḶ̌winlogon,lsassȵĻ벻ʹstopbackdoor
  ,Ϊϵͳ
13.޸õĻ˿ڣȣһInjectT.exe,Ȼе
   InjectT.exeɾȻõģͻЧ
14.汾ӶһЩܵŵDLLȥͻ鷳һЩǿ
  .ҪһµInjectT.exe,עĽΪһڵḶ̌abc.exe
  ,ȻµInJectT.exe滻ɵģȻǸDLLͲᱻأȻͿ
  °DllԼµInJectT.exeȥУͿˣֻ̫鷳,
  ʵֵġ
15.ȷDLLҪǸϵͳǴڵģ㽫ĽΪnotepad.exe,ô
   ϵͳû򿪼±(Notepad.exe),޷صġ

ɺ󣬽InjectT.exeTBack.DLLصwinnt\system32£ȻInjectT.exe -run
,ͻᰲװΪеˡ

ɾ:
1.ɾ
2.ΪֶȻͲأȻٽɾ


