入侵步步高网站实例_ASP教程_编程技术--HTML5中文学习网

我这样入侵了步步高网站
2004-10-09 13:05
其实也不是什么新的漏洞了我早就入侵了步步高的网站只是最近学习比较紧张一直没有发布

大家去http://www.cnbbk.com/hacked.htm 看看也许页面还在

主要思路就是先用注入法得到admin的帐号和密码然后就登陆了管理页面上传了asp木马然后就得到了webshell

现在我教大家大规模入侵这类系统的方法希望大家不要破坏！否则和我无关！！！

准备：条件冷静的头脑不要做不道德是事情

ok 开始我们在google上搜索 productShow.asp?id=331331是什么数都可以会看见一大堆的网站基本都能入侵都是网上商城整站程序系统的

然后就注入得到帐号和密码后登陆我们用注入工具会扫到登陆地址是login.asp这个是假的真正的是admin/login.asp 这样就ok了进入后点上传文件上传你的asp木马
上传后文件名就是你木马的文件名在file/下就这样的简单。

---------------------------另付：该系统上传的asp文件大家看看有没有办法不用注入就可以上传――---------------

---------addfile.asp---------


<html>
<head>
<title>上传图片</title>
<meta http-equiv="Content-Type" content="text/html; charset=gb2312">
<link rel="stylesheet" href="../main.css" type="text/css">
</head>

<body bgcolor="#9CC7EF" text="#000000" leftmargin="0" topmargin="3">
<br>
<br>
<br>
<br>
<br>
<form method="post" action="saveFile.asp" name="form1" enctype="multipart/form-data">
<table width="80%" border="1" bordercolordark=#9CC7EF bordercolorlight=#145AA0 cellspacing="0" cellpadding="4" align="center">
<tr>
<td height="26" bgcolor="#74B0ED">
<div align="center"><font color="#FFFFFF">上传文件</font></div>
</td>
</tr>
<tr>
<td>
<div align="center">
<input type="file" name="file1" size="40">
<input type="submit" name="Submit" value="上传">
</div>
</td>
</tr>
<tr>
<td height="26" bgcolor="#74B0ED">
<div align="center"> </div>
</td>
</tr>
</table>
</form>
<table width="80%" border="1" bordercolordark=#9CC7EF bordercolorlight=#145AA0 cellspacing="0" cellpadding="4" align="center">
<tr>
<td height="26" bgcolor="#74B0ED">
<div align="center"><font color="#FFFFFF">使用说明</font></div>
</td>
</tr>
<tr>
<td> 1、该页面是为了方便您上传一些文件（例如新闻发布里面链接的图片）；<br>
2、该页面上传的文件将被保存在/file/目录下，并且同名文件将被无条件覆盖，所以，请使用一些有意义的文件名，避免文件被同名文件覆盖，如两个文件(图片)，上传日期为2001年11月20日，是在新闻里使用，新闻名称为“江泽民对我公司亲切访问”，则图片取名为img_news_20011020_jiangzemin_1.jpg和img_news_20011020_jiangzemin_2.jpg，然后再上传；<br>
3、如有其他的上传操作，请使用服务商提供的FTP。</td>
</tr>
<tr>
<td height="26" bgcolor="#74B0ED">
<div align="center"> </div>
</td>
</tr>
</table>
</body>
</html>

------------------checkuser.asp----------------
<%
if not session("userClass")>=1 then%>
<script language=Javascript>

</script>
<%
response.End
end if
%>

-----------savefile.asp---------



<%
set upload=new upload_5xSoft
formPath=formPath
set file=upload.file("file1")
formPath="../file/"
if file.FileSize>0 then '如果 FileSize > 0 说明有文件数据
fileName=file.FileName
file.SaveAs Server.mappath(formPath&filename) ''保存文件
end if

set file=nothing
%>
<script language=Javascript>

</script>

---------------------upload.asp---------------
<SCRIPT RUNAT=SERVER LANGUAGE=VBSCRIPT>

'''''''''''''''''''''''''''''''''''''''''''''''''
'
'请保留此信息: 贝壳龙修改 http://www.5dgame.com
'
'''''''''''''''''''''''''''''''''''''''''''''''''

dim upfile_5xSoft_Stream

Class upload_5xSoft

dim Form,File,Version

Private Sub Class_Initialize
dim iStart,iFileNameStart,iFileNameEnd,iEnd,vbEnter,iFormStart,iFormEnd,theFile
dim strDiv,mFormName,mFormValue,mFileName,mFileSize,mFilePath,iDivLen,mStr
Version=""
if Request.TotalBytes<1 then Exit Sub
set Form=CreateObject("Scripting.Dictionary")
set File=CreateObject("Scripting.Dictionary")
set upfile_5xSoft_Stream=CreateObject("Adodb.Stream")
upfile_5xSoft_Stream.mode=3
upfile_5xSoft_Stream.type=1
upfile_5xSoft_Stream.open
upfile_5xSoft_Stream.write Request.BinaryRead(Request.TotalBytes)

vbEnter=Chr(13)&Chr(10)
iDivLen=inString(1,vbEnter)+1
strDiv=subString(1,iDivLen)
iFormStart=iDivLen
iFormEnd=inString(iformStart,strDiv)-1
while iFormStart < iFormEnd
iStart=inString(iFormStart,"name=""")
iEnd=inString(iStart+6,"""")
mFormName=subString(iStart+6,iEnd-iStart-6)
iFileNameStart=inString(iEnd+1,"filename=""")
if iFileNameStart>0 and iFileNameStart<iFormEnd then
iFileNameEnd=inString(iFileNameStart+10,"""")
mFileName=subString(iFileNameStart+10,iFileNameEnd-iFileNameStart-10)
iStart=inString(iFileNameEnd+1,vbEnter&vbEnter)
iEnd=inString(iStart+4,vbEnter&strDiv)
if iEnd>iStart then
mFileSize=iEnd-iStart-4
else
mFileSize=0
end if
set theFile=new FileInfo
theFile.FileName=getFileName(mFileName)
theFile.FilePath=getFilePath(mFileName)
theFile.FileSize=mFileSize
theFile.FileStart=iStart+4
theFile.FormName=FormName
file.add mFormName,theFile
else
iStart=inString(iEnd+1,vbEnter&vbEnter)
iEnd=inString(iStart+4,vbEnter&strDiv)

if iEnd>iStart then
mFormValue=subString(iStart+4,iEnd-iStart-4)
else
mFormValue=""
end if
form.Add mFormName,mFormValue
end if

iFormStart=iformEnd+iDivLen
iFormEnd=inString(iformStart,strDiv)-1
wend
End Sub

Private Function subString(theStart,theLen)
dim i,c,stemp
upfile_5xSoft_Stream.Position=theStart-1
stemp=""
for i=1 to theLen
if upfile_5xSoft_Stream.EOS then Exit for
c=ascB(upfile_5xSoft_Stream.Read(1))
If c > 127 Then
if upfile_5xSoft_Stream.EOS then Exit for
stemp=stemp&Chr(AscW(ChrB(AscB(upfile_5xSoft_Stream.Read(1)))&ChrB(c)))
i=i+1
else
stemp=stemp&Chr(c)
End If
Next
subString=stemp
End function

Private Function inString(theStart,varStr)
dim i,j,bt,theLen,str
InString=0
Str=toByte(varStr)
theLen=LenB(Str)
for i=theStart to upfile_5xSoft_Stream.Size-theLen
if i>upfile_5xSoft_Stream.size then exit Function
upfile_5xSoft_Stream.Position=i-1
if AscB(upfile_5xSoft_Stream.Read(1))=AscB(midB(Str,1)) then
InString=i
for j=2 to theLen
if upfile_5xSoft_Stream.EOS then
inString=0
Exit for
end if
if AscB(upfile_5xSoft_Stream.Read(1))<>AscB(MidB(Str,j,1)) then
InString=0
Exit For
end if
next
if InString<>0 then Exit Function
end if
next
End Function

Private Sub Class_Terminate
form.RemoveAll
file.RemoveAll
set form=nothing
set file=nothing
upfile_5xSoft_Stream.close
set upfile_5xSoft_Stream=nothing
End Sub

Private function GetFilePath(FullPath)
If FullPath <> "" Then
GetFilePath = left(FullPath,InStrRev(FullPath, "/"))
Else
GetFilePath = ""
End If
Endfunction

Private function GetFileName(FullPath)
If FullPath <> "" Then
GetFileName = mid(FullPath,InStrRev(FullPath, "/")+1)
Else
GetFileName = ""
End If
Endfunction

Private function toByte(Str)
dim i,iCode,c,iLow,iHigh
toByte=""
For i=1 To Len(Str)
c=mid(Str,i,1)
iCode =Asc(c)
If iCode<0 Then iCode = iCode + 65535
If iCode>255 Then
iLow = Left(Hex(Asc(c)),2)
iHigh =Right(Hex(Asc(c)),2)
toByte = toByte & chrB("&H"&iLow) & chrB("&H"&iHigh)
Else
toByte = toByte & chrB(AscB(c))
End If
Next
End function
End Class

Class FileInfo
dim FormName,FileName,FilePath,FileSize,FileStart
Private Sub Class_Initialize
FileName = ""
FilePath = ""
FileSize = 0
FileStart= 0
FormName = ""
End Sub

Public function SaveAs(FullPath)
dim dr,ErrorChar,i
SaveAs=1
if trim(fullpath)="" or FileSize=0 or FileStart=0 or FileName="" then exit function
if FileStart=0 or right(fullpath,1)="/" then exit function
set dr=CreateObject("Adodb.Stream")
dr.Mode=3
dr.Type=1
dr.Open
upfile_5xSoft_Stream.position=FileStart-1
upfile_5xSoft_Stream.copyto dr,FileSize
dr.SaveToFile FullPath,2
dr.Close
set dr=nothing
SaveAs=0
end function
End Class
</SCRIPT>

--------------以上就是该系统的上传文件大家去看看有没有别的漏洞了------

------------by 小河来自尖端联盟