Attackers can remotely obtain the content and store it on a local computer, including any files.

<%
'------------------------------------------------------------------------
'------------------- Boundless domain: http://www.5inet.net /---------------------
'----------------- Author: Hip Hop Oh hey, webmaster@5inet.net -----------------
'---------- Obtain the content remotely and store the content on the local computer, including any files! ----------
'--------------- Using XMLHTTP and ADODB. Stream, cool! Absolutely original! -----------------
'On error resume next
'Set the content type to the specific type that you are sending.
'Response. contenttype = "image/JPEG"
'------------------------------- Define the output format -----------------------------

Path = request. querystring ("p ")
Spath = path
If left (lcase (PATH), 7) <> "http: //" then
'------------- If there is no HTTP before, it is a local file. submit it to localfile for processing ------------
Localfile (PATH)
Else
'------------------ Otherwise, the remote file will be handed to remotefile for processing ------------------
Remotefile (PATH)
End if
'Response. Write err. Description

Sub localfile (PATH)
'------------------- If the file is a local file, you can simply jump to this page -------------------
Response. Redirect path
End sub

sub remotefile (Spath)
'------------------------- Remote File Processing Function ------------------------------
filename = getfilename (Spath)
'----------- getfilename is the process of converting an address to a qualified file name -----------
filename = server. mappath ("/uploadfile/Cache/" & filename)
set objfso = server. createobject ("scripting. fileSystemObject ")
'response. write filename
If objfso. fileexists (filename) Then
'------------ check whether the file has been accessed. If so, simply jump to ------------
response. redirect "/uploadfile/Cache/" & getfilename (PATH)
else
'---------------- otherwise, use the getbody function to read --------------------
'response. write path
T = getbody (PATH)
'----------------- write data in binary format to the browser --------------------------
response. binarywrite T
response. flush
'----------------- output buffer ------------------------------------------
SaveFile T, getfilename (PATH)
' ---------------- cache file content to a local path, to wait for the next visit -----------
end if
set objfso = nothing
end sub

Function getbody (URL)
'----------------------- This function is a function for remotely obtaining content ---------------------
'On error resume next
'Response. Write URL
Set retrieval = Createobject ("Microsoft. XMLHTTP ")
'---------------------- Create an XMLHTTP object -----------------------------
With Retrieval
. Open "get", URL, false ,"",""
'---------------- Use the get, Asynchronous Method to send -----------------------
. Send
'Getbody =. responsetext
Getbody =. responsebody
'---------------- The retrieved content returned by the function --------------------------
End
Set retrieval = nothing
'Response. Write err. Description
End Function

Function getfilename (STR)
'------------------------- This function is a qualified file name function -------------------
STR = Replace (lcase (STR), "http ://","")
STR = Replace (lcase (STR ),"//","/")
STR = Replace (STR ,"/","")
STR = Replace (STR, vbcrlf ,"")
Getfilename = Str
End Function

sub SaveFile (STR, fname)
'------------------------- this function is the function of saving stream content to disk -------------------
' on error resume next
set objstream = server. createobject ("ADODB. stream ")
'------------ create an ADODB. stream object, must be ADO 2.5 or a later version ---------
objstream. type = adtypebinary
'------------- open in binary mode -------------------------------------
objstream. open
objstream. write STR
'------------------ write string content to buffer ------------------------
'response. write fname
objstream. savetofile "C: \ Inetpub \ myweb \ uploadfile \ cache \" & fname, adsavecreateoverwrite
'------------------ write the buffered content to the file ----------------------
'response. binarywrite objstream. read
objstream. close ()
set objstream = nothing
'----------------------- close the object and release the resource -----------------------
'response. write err. description
end sub
%>