可以在线查找空间里的asp木马
复制代码 代码如下:
%@LANGUAGE="VBSCRIPT" CODEPAGE="936"%>
%
'设置密码
PASSWORD = "jb51net"
dim Report
if request.QueryString("act")="login" then
if request.Form("pwd") = PASSWORD then session("pig")=1
end if
%>
!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
html>
head>
meta http-equiv="Content-Type" content="text/html; charset=gb2312">
title>ASPSecurity for Hacking/title>
/head>
body>
%If Session("pig") > 1 then%>
form name="form1" method="post" action="?act=login">
div align="center">Password:
input name="pwd" type="password" size="15">
input type="submit" name="Submit" value="提交">
/div>
/form>
%
else
if request.QueryString("act")>"scan" then
%>
form action="?act=scan" method="post">
b>填入你要检查的路径:/b>
input name="path" type="text" style="border:1px solid #999" value="." size="30" />
br>
* 网站根目录的相对路径,填“\”即检查整个网站;“.”为程序所在目录
br>
br>
input type="submit" value=" 开始扫描 " style="background:#fff;border:1px solid #999;padding:2px 2px 0px 2px;margin:4px;border-width:1px 3px 1px 3px" />
/form>
%
else
server.ScriptTimeout = 600
DimFileExt = "asp,cer,asa,cdx"
Sun = 0
SumFiles = 0
SumFolders = 1
if request.Form("path")="" then
response.Write("No Hack")
response.End()
end if
timer1 = timer
if request.Form("path")="\" then
TmpPath = Server.MapPath("\")
elseif request.Form("path")="." then
TmpPath = Server.MapPath(".")
else
TmpPath = Server.MapPath("\")"\"request.Form("path")
end if
Call ShowAllFile(TmpPath)
%>
table width="100%" border="0" cellpadding="0" cellspacing="0" class="CContent">
tr>
th>ASPSecurity For Hacking
/tr>
tr>
td class="CPanel" style="padding:5px;line-height:170%;clear:both;font-size:12px">
div id="updateInfo" style="background:ffffe1;border:1px solid #89441f;padding:4px;display:none">/div>
扫描完毕!一共检查文件夹font color="#FF0000">%=SumFolders%>/font>个,文件font color="#FF0000">%=SumFiles%>/font>个,发现可疑点font color="#FF0000">%=Sun%>/font>个
table width="100%" border="0" cellpadding="0" cellspacing="0">
tr>
td valign="top">
table width="100%" border="1" cellpadding="0" cellspacing="0" style="padding:5px;line-height:170%;clear:both;font-size:12px">
tr>
td width="20%">文件相对路径/td>
td width="20%">特征码/td>
td width="40%">描述/td>
td width="20%">创建/修改时间/td>
/tr>
p>
%=Report%>
br/>/p>
/table>/td>
/tr>
/table>
/td>/tr>/table>
%
timer2 = timer
thetime=cstr(int(((timer2-timer1)*10000 )+0.5)/10)
response.write "br>font size=""2"">本页执行共用了"thetime"毫秒/font>"
end if
end if
%>
hr>
div align="center">本程序取自a href="http://www.0x54.org" target="_blank">雷客图ASP站长安全助手/a>的ASP木马查找功能br>
powered by a href="http://lake2.0x54.org" target=_blank>lake2/a>
/div>
/body>
/html>
%
'遍历处理path及其子目录所有文件
Sub ShowAllFile(Path)
Set FSO = CreateObject("Scripting.FileSystemObject")
if not fso.FolderExists(path) then exit sub
Set f = FSO.GetFolder(Path)
Set fc2 = f.files
For Each myfile in fc2
If CheckExt(FSO.GetExtensionName(path"\"myfile.name)) Then
Call ScanFile(PathTemp"\"myfile.name, "")
SumFiles = SumFiles + 1
End If
Next
Set fc = f.SubFolders
For Each f1 in fc
ShowAllFile path"\"f1.name
SumFolders = SumFolders + 1
Next
Set FSO = Nothing
End Sub
'检测文件
Sub ScanFile(FilePath, InFile)
If InFile > "" Then
Infiles = "该文件被a href=""http://"Request.Servervariables("server_name")"\"InFile""" target=_blank>" InFile "/a>文件包含执行"
End If
Set FSOs = CreateObject("Scripting.FileSystemObject")
on error resume next
set ofile = fsos.OpenTextFile(FilePath)
filetxt = Lcase(ofile.readall())
If err Then Exit Sub end if
if len(filetxt)>0 then
'特征码检查
temp = "a href=""http://"Request.Servervariables("server_name")"\"replace(FilePath,server.MapPath("\")"\","",1,1,1)""" target=_blank>"replace(FilePath,server.MapPath("\")"\","",1,1,1)"/a>"
'Check "WScr"DoMyBest"ipt.Shell"
If instr( filetxt, Lcase("WScr"DoMyBest"ipt.Shell") ) or Instr( filetxt, Lcase("clsid:72C24DD5-D70A"DoMyBest"-438B-8A42-98424B88AFB8") ) then
Report = Report"tr>td>"temp"/td>td>WScr"DoMyBest"ipt.Shell 或者 clsid:72C24DD5-D70A"DoMyBest"-438B-8A42-98424B88AFB8/td>td>危险组件,一般被ASP木马利用。"infiles"/td>td>"GetDateCreate(filepath)"br>"GetDateModify(filepath)"/td>/tr>"
Sun = Sun + 1
End if
'Check "She"DoMyBest"ll.Application"
If instr( filetxt, Lcase("She"DoMyBest"ll.Application") ) or Instr( filetxt, Lcase("clsid:13709620-C27"DoMyBest"9-11CE-A49E-444553540000") ) then
Report = Report"tr>td>"temp"/td>td>She"DoMyBest"ll.Application 或者 clsid:13709620-C27"DoMyBest"9-11CE-A49E-444553540000/td>td>危险组件,一般被ASP木马利用。"infiles"/td>td>"GetDateCreate(filepath)"br>"GetDateModify(filepath)"/td>/tr>"
Sun = Sun + 1
End If
'Check .Encode
Set regEx = New RegExp
regEx.IgnoreCase = True
regEx.Global = True
regEx.Pattern = "@\s*LANGUAGE\s*=\s*[""]?\s*(vbscript|jscript|javascript).encode\b"
If regEx.Test(filetxt) Then
Report = Report"tr>td>"temp"/td>td>(vbscript|jscript|javascript).Encode/td>td>似乎脚本被加密了,一般ASP文件是不会加密的。"infiles"/td>td>"GetDateCreate(filepath)"br>"GetDateModify(filepath)"/td>/tr>"
Sun = Sun + 1
End If
'Check my ASP backdoor :(
regEx.Pattern = "\bEv""al\b"
If regEx.Test(filetxt) Then
Report = Report"tr>td>"temp"/td>td>Ev""al/td>td>e""val()函数可以执行任意ASP代码,被一些后门利用。其形式一般是:ev""al(X)br>但是javascript代码中也可以使用,有可能是误报。"infiles"/td>td>"GetDateCreate(filepath)"br>"GetDateModify(filepath)"/td>/tr>"
Sun = Sun + 1
End If
'Check execute backdoor
regEx.Pattern = "[^.]\bExe""cute\b"
If regEx.Test(filetxt) Then
Report = Report"tr>td>"temp"/td>td>Exec""ute/td>td>e""xecute()函数可以执行任意ASP代码,被一些后门利用。其形式一般是:ex""ecute(X)。br>"infiles"/td>td>"GetDateCreate(filepath)"br>"GetDateModify(filepath)"/td>/tr>"
Sun = Sun + 1
End If
Set regEx = Nothing
'Check include file
Set regEx = New RegExp
regEx.IgnoreCase = True
regEx.Global = True
regEx.Pattern = "!--\s*#include\s*file\s*=\s*"".*"""
Set Matches = regEx.Execute(filetxt)
For Each Match in Matches
tFile = Replace(Mid(Match.Value, Instr(Match.Value, """") + 1, Len(Match.Value) - Instr(Match.Value, """") - 1),"/","\")
If Not CheckExt(FSOs.GetExtensionName(tFile)) Then
Call ScanFile( Mid(FilePath,1,InStrRev(FilePath,"\"))tFile, replace(FilePath,server.MapPath("\")"\","",1,1,1) )
SumFiles = SumFiles + 1
End If
Next
Set Matches = Nothing
Set regEx = Nothing
'Check include virtual
Set regEx = New RegExp
regEx.IgnoreCase = True
regEx.Global = True
regEx.Pattern = "!--\s*#include\s*virtual\s*=\s*"".*"""
Set Matches = regEx.Execute(filetxt)
For Each Match in Matches
tFile = Replace(Mid(Match.Value, Instr(Match.Value, """") + 1, Len(Match.Value) - Instr(Match.Value, """") - 1),"/","\")
If Not CheckExt(FSOs.GetExtensionName(tFile)) Then
Call ScanFile( Server.MapPath("\")"\"tFile, replace(FilePath,server.MapPath("\")"\","",1,1,1) )
SumFiles = SumFiles + 1
End If
Next
Set Matches = Nothing
Set regEx = Nothing
'Check Server.Execute|Transfer
Set regEx = New RegExp
regEx.IgnoreCase = True
regEx.Global = True
regEx.Pattern = "Server.(Exec""ute|Transfer)([ \t]*|\()"".*"""
Set Matches = regEx.Execute(filetxt)
For Each Match in Matches
tFile = Replace(Mid(Match.Value, Instr(Match.Value, """") + 1, Len(Match.Value) - Instr(Match.Value, """") - 1),"/","\")
If Not CheckExt(FSOs.GetExtensionName(tFile)) Then
Call ScanFile( Mid(FilePath,1,InStrRev(FilePath,"\"))tFile, replace(FilePath,server.MapPath("\")"\","",1,1,1) )
SumFiles = SumFiles + 1
End If
Next
Set Matches = Nothing
Set regEx = Nothing
'Check Server.Execute|Transfer
Set regEx = New RegExp
regEx.IgnoreCase = True
regEx.Global = True
regEx.Pattern = "Server.(Exec""ute|Transfer)([ \t]*|\()[^""]\)"
If regEx.Test(filetxt) Then
Report = Report"tr>td>"temp"/td>td>Server.Exec""ute/td>td>不能跟踪检查Server.e""xecute()函数执行的文件。请管理员自行检查。br>"infiles"/td>td>"GetDateCreate(filepath)"br>"GetDateModify(filepath)"/td>/tr>"
Sun = Sun + 1
End If
Set Matches = Nothing
Set regEx = Nothing
'Check Crea""teObject
Set regEx = New RegExp
regEx.IgnoreCase = True
regEx.Global = True
regEx.Pattern = "CreateO""bject[ |\t]*\(.*\)"
Set Matches = regEx.Execute(filetxt)
For Each Match in Matches
If Instr(Match.Value, "") or Instr(Match.Value, "+") or Instr(Match.Value, """") = 0 or Instr(Match.Value, "(") > InStrRev(Match.Value, "(") Then
Report = Report"tr>td>"temp"/td>td>Creat""eObject/td>td>Crea""teObject函数使用了变形技术,仔细复查。"infiles"/td>td>"GetDateCreate(filepath)"br>"GetDateModify(filepath)"/td>/tr>"
Sun = Sun + 1
exit sub
End If
Next
Set Matches = Nothing
Set regEx = Nothing
end if
set ofile = nothing
set fsos = nothing
End Sub
'检查文件后缀,如果与预定的匹配即返回TRUE
Function CheckExt(FileExt)
If DimFileExt = "*" Then CheckExt = True
Ext = Split(DimFileExt,",")
For i = 0 To Ubound(Ext)
If Lcase(FileExt) = Ext(i) Then
CheckExt = True
Exit Function
End If
Next
End Function
Function GetDateModify(filepath)
Set fso = CreateObject("Scripting.FileSystemObject")
Set f = fso.GetFile(filepath)
s = f.DateLastModified
set f = nothing
set fso = nothing
GetDateModify = s
End Function
Function GetDateCreate(filepath)
Set fso = CreateObject("Scripting.FileSystemObject")
Set f = fso.GetFile(filepath)
s = f.DateCreated
set f = nothing
set fso = nothing
GetDateCreate = s
End Function
%>