<%
server.scripttimeout = 600
dimfileext = "asp,cer,asa,cdx" '扫描指定文件类型
dim report, sun, sumfiles, sumfolders '定义变量
sun = 0
sumfiles = 0
sumfolders = 1
requestpath = request.form("path")
if requestpath = "" or instr(requestpath,"..\") then
response.write("no hack")
response.end()
end if
timer1 = timer
if requestpath = "\" then
tmppath = server.mappath("\")
elseif requestpath = "." then
tmppath = server.mappath(".")
else
tmppath = server.mappath("\" & requestpath)
end if
call showallfile(tmppath) '以上代码都是如何获取扫描路径
%>
这里可以看出，只是扫描asp,cer,asa,cdx的后缀，对于htr和其他扩展名它是管不着的，所以我们上传htr,php,jsp都可以避过这个专杀。有经验的朋友可能又会说：将asp木马改为jpg或其他格式，然后用include函数包含asp木马，不就行了吗，非也非也，我们继续再往下看代码...
<%
sub showallfile(path) '定义SUB子程序
on error resume next '容错语句
if not response.isclientconnected then response.end() '检查浏览器和服务器是否还在链接
set fso = createobject("scripting.filesystemobject") '建立FSO对象
if not fso.folderexists(path) then exit sub 'if判断，如果路径不存在则退出SUB子程序，否则继续往下执行
set f = fso.getfolder(path) '提取path所在路径
set fc2 = f.files '取得这个目录下的文件
for each myfile in fc2 'for循环，获取每个文件
if err then response.write("权限不足，不能检查目录 <b>"&path&"</b><br>"):exit sub '错误处理，退出SUB子程序
if checkext(fso.getextensionname(path&"\"&myfile.name)) then '使用checkext函数判断
call scanfile(path&temp&"\"&myfile.name, "") '对指定文件类型进行扫描
sumfiles = sumfiles + 1
end if
next
set fc = f.subfolders '取得二级目录路径
for each f1 in fc 'for循环，获取每个文件
showallfile path&"\"&f1.name '递归调用
sumfolders = sumfolders + 1
next
set fso = nothing
end sub
%>
这部分我做了相关注释，主要是遍历处理path及其子目录所有文件，并且path是通过request方式获得相对路径。
sub scanfile(filepath, infile)
if infile <> "" then
infiles = "<font color=red>该文件被<a href=""[url=http://][url=http://]http://"&request.servervariables("server_name")&"/"&turlencode(infile[/url])&"""[/url] target=_blank>"& infile & "</a>文件包含执行</font>"
end if
temp = "<a href=""[url=http://][url=http://]http://"&request.servervariables("server_name")&"/"&turlencode(replace(replace(filepath[/url],server.mappath("\")&"\","",1,1,1),"\","/[/url]"))&""" target=_blank>"&replace(filepath,server.mappath("\")&"\","",1,1,1)&"</a>"
on error resume next
set tstream = server.createobject("adodb.stream")
tstream.type = 1
tstream.mode = 3
tstream.open
tstream.position=0
tstream.loadfromfile filepath
if err then exit sub end if
tstream.type = 2
tstream.charset = "gb2312"
do until tstream.eos
filetxt = filetxt & lcase(replace(tstream.readtext(102400), chr(0), ""))
loop
tstream.close()
set tstream = nothing
set fsos = createobject("scripting.filesystemobject")
if len(filetxt) >0 then
'特征码检查
filetxt = vbcrlf & filetxt
'check "wscr"&domybest&"ipt.shell"
if instr( filetxt, lcase("wscr"&domybest&"ipt.shell") ) or instr( filetxt, lcase("clsid:72c24dd5-d70a"&domybest&"-438b-8a42-98424b88afb8") ) then
report = report&"<tr><td>"&temp&"</td><td>wscr"&domybest&"ipt.shell 或者 clsid:72c24dd5-d70a"&domybest&"-438b-8a42-98424b88afb8</td><td><font color=red>危险组件，一般被asp木马利用</font>"&infiles&"</td><td>"&getdatecreate(filepath)&"<br>"&getdatemodify(filepath)&"</td></tr>"
sun = sun + 1
end if '判断asp程序里是否含有“wscript.shell”这个字符串和对应CLSID
