處理圖片木馬的函數

'檢測處理圖片木馬的函數
'一般木馬程式中都包含有 < IFRAME < SCTIPT代碼.檢測這兩個是這個函數的本質
'很多的網頁木馬代碼我跟本就沒有見過,不要以為是萬能的哦
'呵呵

<%
'On Error Resume Next
Server.ScriptTimeOut=9999999

if request("action")="GetFile" then

FileUrl=trim(request("FileUrl"))
FileContent=getHTTPPage(FileUrl)
SaveFilePath=Server.MapPath("HttpFileContent.txt")
Set fso = CreateObject("Scripting.FileSystemObject")
Set f1 = fso.CreateTextFile(SaveFilePath,true)
f1.Write FileContent
f1.Close
set fso=nothing
ShowFileInfo SaveFilePath
response.write "<br>抓取檔案成功,儲存路徑:"&SaveFilePath

if CheckSafeFile(SaveFilePath) then
response.Write("<br>檢測的檔案安全!")
else
fso.DeleteFile SaveFilePath,true
response.Write("<br>檢測的檔案可能不安全!檔案"&SaveFilePath&"已經成功刪除!")
end if
response.write "<br><a href='CheckGIF.asp'>點這裡繼續測試</a>"
response.End()
end if

'檢測操作用到的函數

Function getHTTPPage(Path)
        t = GetBody(Path)
        getHTTPPage=BytesToBstr(t,"GB2312")
End function

Function GetBody(url)
        on error resume next
        Set Retrieval = CreateObject("Microsoft.XMLHTTP")
        With Retrieval
        .Open "Get", url, False, "", ""
        .Send
        GetBody = .ResponseBody
        End With
        Set Retrieval = Nothing
End Function

Function BytesToBstr(body,Cset)
        dim objstream
        set objstream = Server.CreateObject("adodb.stream")
        objstream.Type = 1
        objstream.Mode =3
        objstream.Open
        objstream.Write body
        objstream.Position = 0
        objstream.Type = 2
        objstream.Charset = Cset
        BytesToBstr = objstream.ReadText
        objstream.Close
        set objstream = nothing
End Function

Function ShowFileInfo(SaveFilePath)
Set fso = CreateObject("Scripting.FileSystemObject")
Set f2 = fso.GetFile(SaveFilePath)
s = "<br>檔案名稱：" & f2.name & "<br>"
s = s & "檔案短路徑名：" & f2.shortPath & "<br>"
s = s & "檔案物理地址：" & f2.Path & "<br>"
s = s & "檔案屬性：" & f2.Attributes & "<br>"
s = s & "檔案大小： " & f2.size & "<br>"
s = s & "檔案類型： " & f2.type & "<br>"
s = s & "檔案建立時間： " & f2.DateCreated & "<br>"
s = s & "最近訪問時間: " & f2.DateLastAccessed & "<br>"
s = s & "最近修改時間: " & f2.DateLastModified
response.write(s)
set fso=nothing
end Function

Function BytesToBstr(body,Cset)
        dim objstream
        set objstream = Server.CreateObject("adodb.stream")
        objstream.Type = 1
        objstream.Mode =3
        objstream.Open
        objstream.Write body
        objstream.Position = 0
        objstream.Type = 2
        objstream.Charset = Cset
        BytesToBstr = objstream.ReadText
        objstream.Close
        set objstream = nothing
End Function

Function CheckSafeFile(SaveFilePath)
'開啟檔案並將其值讀取，最後關閉串連釋放資源
set fso=createobject("Scripting.FileSystemObject")
set openfile=fso.opentextfile(SaveFilePath,1)
ImageContent=openfile.ReadAll
if instr(ImageContent,"script")>0 or instr(ImageContent,"iframe")>0 then
CheckSafeFile=False
exit Function
end if
openfile.close
set fso=nothing

CheckSafeFile=true
end Function
%>

<form name="form1" method="post" action="?action=GetFile">
  <table width="559" border="1">
    <tr>
      <th scope="col">&nbsp;</th>
      <th scope="col">抓取網頁內容</th>
      <th scope="col">&nbsp;</th>
    </tr>
    <tr>
      <td>URL</td>
      <td><label>
        <input name="FileUrl" type="text" size="50" maxlength="255">
      </label></td>
      <td>&nbsp;</td>
    </tr>
    <tr>
      <td>&nbsp;</td>
      <td><input type="submit" name="Submit" value="抓取並檢測"></td>
      <td>&nbsp;</td>
    </tr>
  </table>
</form>