To the Lake2 website high and low 1.5 source code, had discovered that this edition indeed improved many, also increased looked up kills the function:
1: Looked up kills passed Unicode the code ASP wooden horse
2: Looked up kills has used (Open|Create)TextFile, SaveToFile, Save, set Server, Server. (Transfer|Execute), the ShellExecute, Exec, Run method document
3: The change OpenTextFile opens the document originally by the FSO method in the way, presently changes uses ADODB.Stream to open to the method open way
After the procedure increased these three functions, looks up kills the wooden horse the ability big enhancement, must break through the past, had the difficulty! No wonder do not, Lake2 in its website say that can kill all ASP wooden horse nearly. How today do we have a look to break through it.
When I this time read stationmaster the assistant code, noted this kind of question: This Stationmaster ASP the security assistant has used the massive regular expression, regarding the regular expression, my view is: If matches well, must break through is not very easy; But if matches not well, we may the breakthrough easily, a formidable system also become unsafe. Before breaking through it, we have a look at the regular expression the first basic grammar.
* front match sub-expression zero degree or many times. For example, zo* can match “z” as well as “zoo”. * equally in {0,}.
\ s matches any null characters, including blank space, scheduling symbol, form feed symbol and so on. Equally in [\ f \ n \ r \ t \ v].
. The match except line feeds outside Fu \n any single character. Must match. , please use \.
If we use” \ s” and” *” unify are” \ s*”, will match 0 or the many blank spaces finally, the scheduling symbol, the form feed symbol and so on. If we use”.”With” *” unifies is”. *” will match 0 or many besides line feeds the symbol character. After having these knowledge, lets us have a look at its code.
In admin_scanwebshell.asp, has following code:
'Check include file with “
Set regEx = New RegExp // establishment regular expression object
regEx.IgnoreCase = the True // neglects the big small letter
regEx.Global = the True // establishes as the overall situation match
regEx.Pattern = “<! --\ s*#include \ s*file \ s*= \ s*”. * "" // pattern
Set the Matches = regEx.Execute(filetxt) // moves the search with the regular expression pattern in string of character filetxt, and returns contains this search result an array, if the exec method has not found the match, then it returns to null
For Each Match in Matches
tFile = Replace (Mid (Match.Value, Instr (Match.Value, """) + 1, Len (Match.Value) - Instr (Match.Value, """) - 1), “/”, “\”) // carries on the search and the replace work
If Not CheckExt (FSOs.GetExtensionName(tFile)) Then //, if belongs suffix which inspects, then carries on next step Zha Sha to work
Other pages: : 1 * 2 * 3 * Next>>
|
You are here: hacking technology
> hacker invade
> Content
Category: Home
> hacker invade