雷客图ASP站长安全助手的ASP木马查找功能
程序员文章站
2023-11-17 20:51:34
可以在线查找空间里的asp木马复制代码 代码如下:<%@language="vbscript" codepage="936"%> <% '设置密...
可以在线查找空间里的asp木马
<%@language="vbscript" codepage="936"%>
<%
'设置密码
password = "jb51net"
dim report
if request.querystring("act")="login" then
if request.form("pwd") = password then session("pig")=1
end if
%>
<!doctype html public "-//w3c//dtd html 4.01 transitional//en" "http://www.w3.org/tr/html4/loose.dtd">
<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=gb2312">
<title>aspsecurity for hacking</title>
</head>
<body>
<%if session("pig") <> 1 then%>
<form name="form1" method="post" action="?act=login">
<div align="center">password:
<input name="pwd" type="password" size="15">
<input type="submit" name="submit" value="提交">
</div>
</form>
<%
else
if request.querystring("act")<>"scan" then
%>
<form action="?act=scan" method="post">
<b>填入你要检查的路径：</b>
<input name="path" type="text" style="border:1px solid #999" value="." size="30" />
<br>
* 网站根目录的相对路径，填“\”即检查整个网站；“.”为程序所在目录
<br>
<br>
<input type="submit" value=" 开始扫描 " style="background:#fff;border:1px solid #999;padding:2px 2px 0px 2px;margin:4px;border-width:1px 3px 1px 3px" />
</form>
<%
else
server.scripttimeout = 600
dimfileext = "asp,cer,asa,cdx"
sun = 0
sumfiles = 0
sumfolders = 1
if request.form("path")="" then
response.write("no hack")
response.end()
end if
timer1 = timer
if request.form("path")="\" then
tmppath = server.mappath("\")
elseif request.form("path")="." then
tmppath = server.mappath(".")
else
tmppath = server.mappath("\")&"\"&request.form("path")
end if
call showallfile(tmppath)
%>
<table width="100%" border="0" cellpadding="0" cellspacing="0" class="ccontent">
<tr>
<th>aspsecurity for hacking
</tr>
<tr>
<td class="cpanel" style="padding:5px;line-height:170%;clear:both;font-size:12px">
<div id="updateinfo" style="background:ffffe1;border:1px solid #89441f;padding:4px;display:none"></div>
扫描完毕！一共检查文件夹<font color="#ff0000"><%=sumfolders%></font>个，文件<font color="#ff0000"><%=sumfiles%></font>个，发现可疑点<font color="#ff0000"><%=sun%></font>个
<table width="100%" border="0" cellpadding="0" cellspacing="0">
<tr>
<td valign="top">
<table width="100%" border="1" cellpadding="0" cellspacing="0" style="padding:5px;line-height:170%;clear:both;font-size:12px">
<tr>
<td width="20%">文件相对路径</td>
<td width="20%">特征码</td>
<td width="40%">描述</td>
<td width="20%">创建/修改时间</td>
</tr>
<p>
<%=report%>
<br/></p>
</table></td>
</tr>
</table>
</td></tr></table>
<%
timer2 = timer
thetime=cstr(int(((timer2-timer1)*10000 )+0.5)/10)
response.write "<br><font size=""2"">本页执行共用了"&thetime&"毫秒</font>"
end if
end if
%>
<hr>
<div align="center">本程序取自<a href="http://www.0x54.org" target="_blank">雷客图asp站长安全助手</a>的asp木马查找功能<br>
powered by <a href="http://lake2.0x54.org" target=_blank>lake2</a>
</div>
</body>
</html>
<%
'遍历处理path及其子目录所有文件
sub showallfile(path)
set fso = createobject("scripting.filesystemobject")
if not fso.folderexists(path) then exit sub
set f = fso.getfolder(path)
set fc2 = f.files
for each myfile in fc2
if checkext(fso.getextensionname(path&"\"&myfile.name)) then
call scanfile(path&temp&"\"&myfile.name, "")
sumfiles = sumfiles + 1
end if
next
set fc = f.subfolders
for each f1 in fc
showallfile path&"\"&f1.name
sumfolders = sumfolders + 1
next
set fso = nothing
end sub
'检测文件
sub scanfile(filepath, infile)
if infile <> "" then
infiles = "该文件被<a href=""http://"&request.servervariables("server_name")&"\"&infile&""" target=_blank>"& infile & "</a>文件包含执行"
end if
set fsos = createobject("scripting.filesystemobject")
on error resume next
set ofile = fsos.opentextfile(filepath)
filetxt = lcase(ofile.readall())
if err then exit sub end if
if len(filetxt)>0 then
'特征码检查
temp = "<a href=""http://"&request.servervariables("server_name")&"\"&replace(filepath,server.mappath("\")&"\","",1,1,1)&""" target=_blank>"&replace(filepath,server.mappath("\")&"\","",1,1,1)&"</a>"
'check "wscr"&domybest&"ipt.shell"
if instr( filetxt, lcase("wscr"&domybest&"ipt.shell") ) or instr( filetxt, lcase("clsid:72c24dd5-d70a"&domybest&"-438b-8a42-98424b88afb8") ) then
report = report&"<tr><td>"&temp&"</td><td>wscr"&domybest&"ipt.shell 或者 clsid:72c24dd5-d70a"&domybest&"-438b-8a42-98424b88afb8</td><td>危险组件，一般被asp木马利用。"&infiles&"</td><td>"&getdatecreate(filepath)&"<br>"&getdatemodify(filepath)&"</td></tr>"
sun = sun + 1
end if
'check "she"&domybest&"ll.application"
if instr( filetxt, lcase("she"&domybest&"ll.application") ) or instr( filetxt, lcase("clsid:13709620-c27"&domybest&"9-11ce-a49e-444553540000") ) then
report = report&"<tr><td>"&temp&"</td><td>she"&domybest&"ll.application 或者 clsid:13709620-c27"&domybest&"9-11ce-a49e-444553540000</td><td>危险组件，一般被asp木马利用。"&infiles&"</td><td>"&getdatecreate(filepath)&"<br>"&getdatemodify(filepath)&"</td></tr>"
sun = sun + 1
end if
'check .encode
set regex = new regexp
regex.ignorecase = true
regex.global = true
regex.pattern = "@\s*language\s*=\s*[""]?\s*(vbscript|jscript|javascript).encode\b"
if regex.test(filetxt) then
report = report&"<tr><td>"&temp&"</td><td>(vbscript|jscript|javascript).encode</td><td>似乎脚本被加密了，一般asp文件是不会加密的。"&infiles&"</td><td>"&getdatecreate(filepath)&"<br>"&getdatemodify(filepath)&"</td></tr>"
sun = sun + 1
end if
'check my asp backdoor :(
regex.pattern = "\bev"&"al\b"
if regex.test(filetxt) then
report = report&"<tr><td>"&temp&"</td><td>ev"&"al</td><td>e"&"val()函数可以执行任意asp代码，被一些后门利用。其形式一般是：ev"&"al(x)<br>但是javascript代码中也可以使用，有可能是误报。"&infiles&"</td><td>"&getdatecreate(filepath)&"<br>"&getdatemodify(filepath)&"</td></tr>"
sun = sun + 1
end if
'check exe&cute backdoor
regex.pattern = "[^.]\bexe"&"cute\b"
if regex.test(filetxt) then
report = report&"<tr><td>"&temp&"</td><td>exec"&"ute</td><td>e"&"xecute()函数可以执行任意asp代码，被一些后门利用。其形式一般是：ex"&"ecute(x)。<br>"&infiles&"</td><td>"&getdatecreate(filepath)&"<br>"&getdatemodify(filepath)&"</td></tr>"
sun = sun + 1
end if
set regex = nothing
'check include file
set regex = new regexp
regex.ignorecase = true
regex.global = true
regex.pattern = "<!--\s*#include\s*file\s*=\s*"".*"""
set matches = regex.execute(filetxt)
for each match in matches
tfile = replace(mid(match.value, instr(match.value, """") + 1, len(match.value) - instr(match.value, """") - 1),"/","\")
if not checkext(fsos.getextensionname(tfile)) then
call scanfile( mid(filepath,1,instrrev(filepath,"\"))&tfile, replace(filepath,server.mappath("\")&"\","",1,1,1) )
sumfiles = sumfiles + 1
end if
next
set matches = nothing
set regex = nothing
'check include virtual
set regex = new regexp
regex.ignorecase = true
regex.global = true
regex.pattern = "<!--\s*#include\s*virtual\s*=\s*"".*"""
set matches = regex.execute(filetxt)
for each match in matches
tfile = replace(mid(match.value, instr(match.value, """") + 1, len(match.value) - instr(match.value, """") - 1),"/","\")
if not checkext(fsos.getextensionname(tfile)) then
call scanfile( server.mappath("\")&"\"&tfile, replace(filepath,server.mappath("\")&"\","",1,1,1) )
sumfiles = sumfiles + 1
end if
next
set matches = nothing
set regex = nothing
'check server&.execute|transfer
set regex = new regexp
regex.ignorecase = true
regex.global = true
regex.pattern = "server.(exec"&"ute|transfer)([ \t]*|\()"".*"""
set matches = regex.execute(filetxt)
for each match in matches
tfile = replace(mid(match.value, instr(match.value, """") + 1, len(match.value) - instr(match.value, """") - 1),"/","\")
if not checkext(fsos.getextensionname(tfile)) then
call scanfile( mid(filepath,1,instrrev(filepath,"\"))&tfile, replace(filepath,server.mappath("\")&"\","",1,1,1) )
sumfiles = sumfiles + 1
end if
next
set matches = nothing
set regex = nothing
'check server&.execute|transfer
set regex = new regexp
regex.ignorecase = true
regex.global = true
regex.pattern = "server.(exec"&"ute|transfer)([ \t]*|\()[^""]\)"
if regex.test(filetxt) then
report = report&"<tr><td>"&temp&"</td><td>server.exec"&"ute</td><td>不能跟踪检查server.e"&"xecute()函数执行的文件。请管理员自行检查。<br>"&infiles&"</td><td>"&getdatecreate(filepath)&"<br>"&getdatemodify(filepath)&"</td></tr>"
sun = sun + 1
end if
set matches = nothing
set regex = nothing
'check crea"&"teobject
set regex = new regexp
regex.ignorecase = true
regex.global = true
regex.pattern = "createo"&"bject[ |\t]*\(.*\)"
set matches = regex.execute(filetxt)
for each match in matches
if instr(match.value, "&") or instr(match.value, "+") or instr(match.value, """") = 0 or instr(match.value, "(") <> instrrev(match.value, "(") then
report = report&"<tr><td>"&temp&"</td><td>creat"&"eobject</td><td>crea"&"teobject函数使用了变形技术，仔细复查。"&infiles&"</td><td>"&getdatecreate(filepath)&"<br>"&getdatemodify(filepath)&"</td></tr>"
sun = sun + 1
exit sub
end if
next
set matches = nothing
set regex = nothing
end if
set ofile = nothing
set fsos = nothing
end sub
'检查文件后缀，如果与预定的匹配即返回true
function checkext(fileext)
if dimfileext = "*" then checkext = true
ext = split(dimfileext,",")
for i = 0 to ubound(ext)
if lcase(fileext) = ext(i) then
checkext = true
exit function
end if
next
end function
function getdatemodify(filepath)
set fso = createobject("scripting.filesystemobject")
set f = fso.getfile(filepath)
s = f.datelastmodified
set f = nothing
set fso = nothing
getdatemodify = s
end function
function getdatecreate(filepath)
set fso = createobject("scripting.filesystemobject")
set f = fso.getfile(filepath)
s = f.datecreated
set f = nothing
set fso = nothing
getdatecreate = s
end function
%>
复制代码 代码如下:
<%@language="vbscript" codepage="936"%>
<%
'设置密码
password = "jb51net"
dim report
if request.querystring("act")="login" then
if request.form("pwd") = password then session("pig")=1
end if
%>
<!doctype html public "-//w3c//dtd html 4.01 transitional//en" "http://www.w3.org/tr/html4/loose.dtd">
<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=gb2312">
<title>aspsecurity for hacking</title>
</head>
<body>
<%if session("pig") <> 1 then%>
<form name="form1" method="post" action="?act=login">
<div align="center">password:
<input name="pwd" type="password" size="15">
<input type="submit" name="submit" value="提交">
</div>
</form>
<%
else
if request.querystring("act")<>"scan" then
%>
<form action="?act=scan" method="post">
<b>填入你要检查的路径：</b>
<input name="path" type="text" style="border:1px solid #999" value="." size="30" />
<br>
* 网站根目录的相对路径，填“\”即检查整个网站；“.”为程序所在目录
<br>
<br>
<input type="submit" value=" 开始扫描 " style="background:#fff;border:1px solid #999;padding:2px 2px 0px 2px;margin:4px;border-width:1px 3px 1px 3px" />
</form>
<%
else
server.scripttimeout = 600
dimfileext = "asp,cer,asa,cdx"
sun = 0
sumfiles = 0
sumfolders = 1
if request.form("path")="" then
response.write("no hack")
response.end()
end if
timer1 = timer
if request.form("path")="\" then
tmppath = server.mappath("\")
elseif request.form("path")="." then
tmppath = server.mappath(".")
else
tmppath = server.mappath("\")&"\"&request.form("path")
end if
call showallfile(tmppath)
%>
<table width="100%" border="0" cellpadding="0" cellspacing="0" class="ccontent">
<tr>
<th>aspsecurity for hacking
</tr>
<tr>
<td class="cpanel" style="padding:5px;line-height:170%;clear:both;font-size:12px">
<div id="updateinfo" style="background:ffffe1;border:1px solid #89441f;padding:4px;display:none"></div>
扫描完毕！一共检查文件夹<font color="#ff0000"><%=sumfolders%></font>个，文件<font color="#ff0000"><%=sumfiles%></font>个，发现可疑点<font color="#ff0000"><%=sun%></font>个
<table width="100%" border="0" cellpadding="0" cellspacing="0">
<tr>
<td valign="top">
<table width="100%" border="1" cellpadding="0" cellspacing="0" style="padding:5px;line-height:170%;clear:both;font-size:12px">
<tr>
<td width="20%">文件相对路径</td>
<td width="20%">特征码</td>
<td width="40%">描述</td>
<td width="20%">创建/修改时间</td>
</tr>
<p>
<%=report%>
<br/></p>
</table></td>
</tr>
</table>
</td></tr></table>
<%
timer2 = timer
thetime=cstr(int(((timer2-timer1)*10000 )+0.5)/10)
response.write "<br><font size=""2"">本页执行共用了"&thetime&"毫秒</font>"
end if
end if
%>
<hr>
<div align="center">本程序取自<a href="http://www.0x54.org" target="_blank">雷客图asp站长安全助手</a>的asp木马查找功能<br>
powered by <a href="http://lake2.0x54.org" target=_blank>lake2</a>
</div>
</body>
</html>
<%
'遍历处理path及其子目录所有文件
sub showallfile(path)
set fso = createobject("scripting.filesystemobject")
if not fso.folderexists(path) then exit sub
set f = fso.getfolder(path)
set fc2 = f.files
for each myfile in fc2
if checkext(fso.getextensionname(path&"\"&myfile.name)) then
call scanfile(path&temp&"\"&myfile.name, "")
sumfiles = sumfiles + 1
end if
next
set fc = f.subfolders
for each f1 in fc
showallfile path&"\"&f1.name
sumfolders = sumfolders + 1
next
set fso = nothing
end sub
'检测文件
sub scanfile(filepath, infile)
if infile <> "" then
infiles = "该文件被<a href=""http://"&request.servervariables("server_name")&"\"&infile&""" target=_blank>"& infile & "</a>文件包含执行"
end if
set fsos = createobject("scripting.filesystemobject")
on error resume next
set ofile = fsos.opentextfile(filepath)
filetxt = lcase(ofile.readall())
if err then exit sub end if
if len(filetxt)>0 then
'特征码检查
temp = "<a href=""http://"&request.servervariables("server_name")&"\"&replace(filepath,server.mappath("\")&"\","",1,1,1)&""" target=_blank>"&replace(filepath,server.mappath("\")&"\","",1,1,1)&"</a>"
'check "wscr"&domybest&"ipt.shell"
if instr( filetxt, lcase("wscr"&domybest&"ipt.shell") ) or instr( filetxt, lcase("clsid:72c24dd5-d70a"&domybest&"-438b-8a42-98424b88afb8") ) then
report = report&"<tr><td>"&temp&"</td><td>wscr"&domybest&"ipt.shell 或者 clsid:72c24dd5-d70a"&domybest&"-438b-8a42-98424b88afb8</td><td>危险组件，一般被asp木马利用。"&infiles&"</td><td>"&getdatecreate(filepath)&"<br>"&getdatemodify(filepath)&"</td></tr>"
sun = sun + 1
end if
'check "she"&domybest&"ll.application"
if instr( filetxt, lcase("she"&domybest&"ll.application") ) or instr( filetxt, lcase("clsid:13709620-c27"&domybest&"9-11ce-a49e-444553540000") ) then
report = report&"<tr><td>"&temp&"</td><td>she"&domybest&"ll.application 或者 clsid:13709620-c27"&domybest&"9-11ce-a49e-444553540000</td><td>危险组件，一般被asp木马利用。"&infiles&"</td><td>"&getdatecreate(filepath)&"<br>"&getdatemodify(filepath)&"</td></tr>"
sun = sun + 1
end if
'check .encode
set regex = new regexp
regex.ignorecase = true
regex.global = true
regex.pattern = "@\s*language\s*=\s*[""]?\s*(vbscript|jscript|javascript).encode\b"
if regex.test(filetxt) then
report = report&"<tr><td>"&temp&"</td><td>(vbscript|jscript|javascript).encode</td><td>似乎脚本被加密了，一般asp文件是不会加密的。"&infiles&"</td><td>"&getdatecreate(filepath)&"<br>"&getdatemodify(filepath)&"</td></tr>"
sun = sun + 1
end if
'check my asp backdoor :(
regex.pattern = "\bev"&"al\b"
if regex.test(filetxt) then
report = report&"<tr><td>"&temp&"</td><td>ev"&"al</td><td>e"&"val()函数可以执行任意asp代码，被一些后门利用。其形式一般是：ev"&"al(x)<br>但是javascript代码中也可以使用，有可能是误报。"&infiles&"</td><td>"&getdatecreate(filepath)&"<br>"&getdatemodify(filepath)&"</td></tr>"
sun = sun + 1
end if
'check exe&cute backdoor
regex.pattern = "[^.]\bexe"&"cute\b"
if regex.test(filetxt) then
report = report&"<tr><td>"&temp&"</td><td>exec"&"ute</td><td>e"&"xecute()函数可以执行任意asp代码，被一些后门利用。其形式一般是：ex"&"ecute(x)。<br>"&infiles&"</td><td>"&getdatecreate(filepath)&"<br>"&getdatemodify(filepath)&"</td></tr>"
sun = sun + 1
end if
set regex = nothing
'check include file
set regex = new regexp
regex.ignorecase = true
regex.global = true
regex.pattern = "<!--\s*#include\s*file\s*=\s*"".*"""
set matches = regex.execute(filetxt)
for each match in matches
tfile = replace(mid(match.value, instr(match.value, """") + 1, len(match.value) - instr(match.value, """") - 1),"/","\")
if not checkext(fsos.getextensionname(tfile)) then
call scanfile( mid(filepath,1,instrrev(filepath,"\"))&tfile, replace(filepath,server.mappath("\")&"\","",1,1,1) )
sumfiles = sumfiles + 1
end if
next
set matches = nothing
set regex = nothing
'check include virtual
set regex = new regexp
regex.ignorecase = true
regex.global = true
regex.pattern = "<!--\s*#include\s*virtual\s*=\s*"".*"""
set matches = regex.execute(filetxt)
for each match in matches
tfile = replace(mid(match.value, instr(match.value, """") + 1, len(match.value) - instr(match.value, """") - 1),"/","\")
if not checkext(fsos.getextensionname(tfile)) then
call scanfile( server.mappath("\")&"\"&tfile, replace(filepath,server.mappath("\")&"\","",1,1,1) )
sumfiles = sumfiles + 1
end if
next
set matches = nothing
set regex = nothing
'check server&.execute|transfer
set regex = new regexp
regex.ignorecase = true
regex.global = true
regex.pattern = "server.(exec"&"ute|transfer)([ \t]*|\()"".*"""
set matches = regex.execute(filetxt)
for each match in matches
tfile = replace(mid(match.value, instr(match.value, """") + 1, len(match.value) - instr(match.value, """") - 1),"/","\")
if not checkext(fsos.getextensionname(tfile)) then
call scanfile( mid(filepath,1,instrrev(filepath,"\"))&tfile, replace(filepath,server.mappath("\")&"\","",1,1,1) )
sumfiles = sumfiles + 1
end if
next
set matches = nothing
set regex = nothing
'check server&.execute|transfer
set regex = new regexp
regex.ignorecase = true
regex.global = true
regex.pattern = "server.(exec"&"ute|transfer)([ \t]*|\()[^""]\)"
if regex.test(filetxt) then
report = report&"<tr><td>"&temp&"</td><td>server.exec"&"ute</td><td>不能跟踪检查server.e"&"xecute()函数执行的文件。请管理员自行检查。<br>"&infiles&"</td><td>"&getdatecreate(filepath)&"<br>"&getdatemodify(filepath)&"</td></tr>"
sun = sun + 1
end if
set matches = nothing
set regex = nothing
'check crea"&"teobject
set regex = new regexp
regex.ignorecase = true
regex.global = true
regex.pattern = "createo"&"bject[ |\t]*\(.*\)"
set matches = regex.execute(filetxt)
for each match in matches
if instr(match.value, "&") or instr(match.value, "+") or instr(match.value, """") = 0 or instr(match.value, "(") <> instrrev(match.value, "(") then
report = report&"<tr><td>"&temp&"</td><td>creat"&"eobject</td><td>crea"&"teobject函数使用了变形技术，仔细复查。"&infiles&"</td><td>"&getdatecreate(filepath)&"<br>"&getdatemodify(filepath)&"</td></tr>"
sun = sun + 1
exit sub
end if
next
set matches = nothing
set regex = nothing
end if
set ofile = nothing
set fsos = nothing
end sub
'检查文件后缀，如果与预定的匹配即返回true
function checkext(fileext)
if dimfileext = "*" then checkext = true
ext = split(dimfileext,",")
for i = 0 to ubound(ext)
if lcase(fileext) = ext(i) then
checkext = true
exit function
end if
next
end function
function getdatemodify(filepath)
set fso = createobject("scripting.filesystemobject")
set f = fso.getfile(filepath)
s = f.datelastmodified
set f = nothing
set fso = nothing
getdatemodify = s
end function
function getdatecreate(filepath)
set fso = createobject("scripting.filesystemobject")
set f = fso.getfile(filepath)
s = f.datecreated
set f = nothing
set fso = nothing
getdatecreate = s
end function
%>