HTTP/1.1 200 OK
Date: Thu, 15 Mar 2007 07:19:22 GMT
Server: Microsoft-IIS/6.0
Content-Length: 346
Content-Type: text/html
Cache-control: private
<!--此文件支持上传到文件夹名中有“.”文件中-->
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=gb2312">
<link href="../system/css.css" rel="stylesheet" type="text/css">
</head>
<body bgcolor="#f1f1f1">
上传成功<script>parent.myform.imageurl.value='200703/2007031515192230130.'</script></body></html>
上传ASP木马,提示上传成功
可截取的封包后面地址是200703/2007031515192230130.
试用200703/2007031515192230130.asp访问,不存在页面``` 上传图片都正常
本人是个菜鸟,望大虾们帮忙想想办法
上传页面源码如下:sub shangchuan(wjj,lx,dx,xz,myform,txt,lj,fs)
if request("chuan") = "yes" then
set c=new clsUp
c.AllowExt=lx&";" '限制文件格式
c.SetFileSize(dx*2048) '最大文件大小
randomize
ranNum=int(900*rnd)+100
wj=trim(year(date()))&right("0"&trim(month(date)),2)&right("0"&trim(day(date)),2)&right("0"&trim(hour(time())),2)&right("0"&trim(minute(time())),2)&right("0"&trim(second(time())),2)&ranNum
wz=wjj&"/"&wj
FSPath=server.MapPath(wz)
'response.write""&FSPath&""
'response.end
if c.iserr then
Response.Write c.errmessage
Response.end
else
tp=c.AutoSave("file",FSPath&"/")
dx=c.Filesize
if xz=1 then
response.write "上传成功 [<a href=# onclick=history.go(-1)>继续上传</a>]"
else
response.write "上传成功"
end if
end if
set c=nothing
Select case fs
case 2
response.write "<script>parent."&myform&"."&txt&".value='
![](http://"&lj&""&tp&")
'</script>"
case 1
response.write "<script>parent."&myform&"."&txt&".value+='
'</script>"
case else
response.write "<script>parent."&myform&"."&txt&".value='"&lj&""&tp&"'</script>"
End Select
else
Response.Write "<form name=form method=post action=?chuan=yes enctype=multipart/form-data><input name=file type=file class=wenbenkuang size=25>"&_
" <input name=Submit type=submit class=wenbenkuang value=上传 onSubmit=javascript:document.form.submit;>只允许"&dx&"k以下,"&replace(lx,";","或")&"格式</form>"
end if
end sub
%>
