用VB編寫一個可以在ASP環境下調用的運行CMD命令的組件

2024-05-04 11:06:33

字體：大中小

來源：轉載

供稿：網友

有時我們在管理服務器時為了安全起見會禁用windows scripting host，這樣能防止某些不法用戶利用wsh生成一個webshell，對服務器造成很大的安全隱患。但如果我們又想禁用wsh，又想使用自己的webshell用于服務器的管理怎么辦呢？這里介紹了一種實現asp中運行cmd并顯示結果的組件編程。希望對大家能有所幫助。

首先我們新建一個activedll工程，命名為aspcmd，新建的類命名為cmdshell。在“project“的“referenct“中添加一個引用：microsoft active server pages object library。

然后我們的思路是使用window api shellexecute調用cmd.exe，將運行的結果保存到一個臨時文本文件，然后讀出這個文件的內容顯示出來。

以下是工程aspcmd的類cmdshell.cls的代碼。

option explicit
dim rp as response
dim rq as request
dim ap as application
dim sr as server
dim sn as session
private declare sub sleep lib "kernel32" (byval dwmilliseconds as long)
private declare function shellexecute lib "shell32.dll" alias "shellexecutea" (byval hwnd as long, byval lpoperation as string, byval lpfile as string, byval lpparameters as string, byval lpdirectory as string, byval nshowcmd as long) as long

private sub shellex(byval slocation as string, byval spara as string, optional maxedform as boolean = false)
on error goto errhandle:
dim lr as long
dim style as long
dim hwnd as long
if maxedform then
style = vbmaximizedfocus
else
style = vbnormalfocus
end if

lr = shellexecute(hwnd, "open", slocation, spara, "", style)
if (lr < 0) or (lr > 32) then
'success
else
rp.write "error occered when starting the program " & slocation
end if
errhandle:
rp.write "error:" & err.description
end sub

public sub onstartpage(byval mysc as scriptingcontext)
set rp = mysc.response
set rq = mysc.request
set sr = mysc.server
set ap = mysc.application
set sn = mysc.session
end sub

public sub onendpage()
set rp = nothing
set rq = nothing
set sr = nothing
set ap = nothing
set sn = nothing
end sub

private function fileexists(filename as string) as boolean
dim i as integer
on error resume next
i = len(dir$(filename))
if err or i = 0 then fileexists = false else fileexists = true
end function

private function isopen(filename as string) as boolean
dim ffile as integer
dim msg as string
ffile = freefile()
on error goto erropen
open filename for binary lock read write as ffile
close ffile
exit function
erropen:
if err.number <> 70 then
msg = "error # " & str(err.number) & " was generated by " _
& err.source & chr(13) & err.description
else
isopen = true
end if
end function

public sub exec1(byval strcmd as string)
on error goto errhandle:
dim mytimer as integer
mytimer = 0

dim strout as string
dim strfname as string
//生成一個臨時文件
if len(app.path) = 3 then
strfname = app.path & "lhtmp.txt"
else
strfname = app.path & "/lhtmp.txt"
end if
//如果在運行前文件已存在則刪除之
if fileexists(strfname) then
kill strfname
end if

//運行行用戶的cmd命令，并將結果輸出到臨時文件中
//注意cmd.exe的/c參數是指運行完一個命令后馬上結束會話狀態。等同于在windows的run中輸入的cmd命令。
dim strpara as string
strpara = "/c " & strcmd & ">" & strfname
shellex "cmd.exe", strpara
//等待生成輸出文件
do while not fileexists(strfname)
sleep 1000
doevents
mytimer = mytimer + 1
if mytimer = 15 then
exit do
end if
loop
mytimer = 0
//等待文件輸出完畢
do while isopen(strfname)
sleep 1000
doevents
mytimer = mytimer + 1
if mytimer = 15 then
exit do
end if
loop

//顯示輸出文件的內容
open strfname for input as #1
do while not eof(1)
line input #1, strout
rp.write strout & vbcrlf
loop
close #1
sleep 1000
//刪除臨時文件
kill strfname
exit sub
errhandle:
rp.write "error occured:" & err.description
end sub

生成aspcmd.dll，使用regsvr32 aspcmd.dll注冊組件。

以下是調用該dll的一個asp程序例子：

<%@language="vbscript"%>
<style type=&quo

菜鳥學堂：
|||t;text/css">

</style>
<form action="" method="post">
<input name="cmd" class="singleborder" value="<%=request.form("cmd")%>" size=102>
<input type="submit" class="singleborder" value="execute">
</form>
<%
if request.form("cmd")<>"" then
set testme=server.createobject("aspcmd.cmdshell")
%>
<div class="noborder"><%=request.form("cmd")%></div><br>
<textarea cols="120" rows="30" class="noborder">
<%=testme.exec1(request.form("cmd"))%></textarea>

<% set testme=nothing
end if
%>

以下是運行ipconfig /all的結果：

windows 2000 ip configuration

host name . . . . . . . . . . . . : ibm-wrk-02
primary dns suffix . . . . . . . :
node type . . . . . . . . . . . . : broadcast
ip routing enabled. . . . . . . . : no
wins proxy enabled. . . . . . . . : no

ethernet adapter 本地連接:

connection-specific dns suffix . :
description . . . . . . . . . . . : intel(r) pro/100 vm network connection
physical address. . . . . . . . . : 00-08-02-bd-d7-eb
dhcp enabled. . . . . . . . . . . : no
ip address. . . . . . . . . . . . : 192.168.0.4
subnet mask . . . . . . . . . . . : 255.255.255.0
default gateway . . . . . . . . . : 192.168.0.1
dns servers . . . . . . . . . . . : 202.106.196.115

上一篇：ASP_NET下使用MD5加密

下一篇：在ASP+的Form中檢查填寫是否正確