admin/Penetration_Testing_POC
1
0
Fork 0
mirror of https://github.com/Mr-xn/Penetration_Testing_POC.git synced 2025-11-06 03:03:57 +00:00
Code Issues Packages Projects Releases Wiki Activity
Penetration_Testing_POC/books/金和OA C6办公系统全局绕过漏洞分析.html

312 lines
1.5 MiB
HTML
Raw Normal View History

Update README.md
2024-06-27 08:44:44 -07:00
<!DOCTYPE html> <html lang=en style><!--
Page saved with SingleFile
url: https://xz.aliyun.com/t/14517
--><meta charset=utf-8>
<title>.NET 金和OA C6办公系统全局绕过漏洞分析</title>
<meta name=description content=先知社区，先知安全技术社区>
<meta name=viewport content="width=device-width,initial-scale=1.0,minimum-scale=1.0,maximum-scale=1.0,user-scalable=no">
<style>/*!
* Bootstrap v2.3.1
*
* Copyright 2012 Twitter, Inc
* Licensed under the Apache License v2.0
* http://www.apache.org/licenses/LICENSE-2.0
*
* Designed and built with all the love in the world @twitter by @mdo and @fat.
*/.clearfix:before,.clearfix:after{display:table;line-height:0;content:""}.clearfix:after{clear:both}footer{display:block}html{font-size:100%;-webkit-text-size-adjust:100%;-ms-text-size-adjust:100%}a:focus{outline:thin dotted #333;outline:5px auto -webkit-focus-ring-color;outline-offset:-2px}a:hover,a:active{outline:0}img{height:auto;vertical-align:middle;-ms-interpolation-mode:bicubic}input{margin:0}button{-webkit-appearance:button}body{margin:0;font-family:"Helvetica Neue",Helvetica,Arial,sans-serif;font-size:14px;line-height:20px;color:#333}a{text-decoration:none}a:hover,a:focus{color:#005580;text-decoration:underline}.row:before,.row:after{display:table;line-height:0;content:""}.row:after{clear:both}.container{width:940px}.span10{width:780px}.container{margin-right:auto;margin-left:auto}.container:before,.container:after{display:table;line-height:0;content:""}.container:after{clear:both}p{margin:0 0 10px}strong{font-weight:bold}em{font-style:italic}.text-right{text-align:right}.text-center{text-align:center}h2,h4{margin:10px 0;font-family:inherit;font-weight:bold;line-height:20px;color:inherit;text-rendering:optimizelegibility}h4{font-size:17.5px}ul{padding:0}hr{margin:20px 0;border:0;border-top:1px solid #eee;border-bottom:1px solid #fff}pre{color:#333;-webkit-border-radius:3px;-moz-border-radius:3px}pre{display:block;margin:0 0 10px;white-space:pre-wrap;border:1px solid rgba(0,0,0,0.15);-webkit-border-radius:4px;-moz-border-radius:4px}input{font-weight:normal}input{font-family:"Helvetica Neue",Helvetica,Arial,sans-serif}input[type="text"]{display:inline-block;padding:4px 6px;margin-bottom:10px;font-size:14px;line-height:20px;vertical-align:middle;-webkit-border-radius:4px;-moz-border-radius:4px}input{width:206px}input[type="text"]{background-color:#fff;-webkit-box-shadow:inset 0 1px 1px rgba(0,0,0,0.075);-moz-box-shadow:inset 0 1px 1px rgba(0,0,0,0.075);box-shadow:inset 0 1px 1px rgba(0,0,0,0.075);-webkit-transition:border linear .2s,box-shadow linear .2s;-moz-transition:border linear .2s,box-shadow linear .2s;-o-transition:border linear .2s,box-shadow linear .2s;transition:border linear .2s,box-shadow linear .2s}textarea:focus,input[type="text"]:focus,input[type="password"]:focus,input[type="datetime"]:focus,input[type="datetime-local"]:focus,input[type="date"]:focus,input[type="month"]:focus,input[type="time"]:focus,input[type="week"]:focus,input[type="number"]:focus,input[type="email"]:focus,input[type="url"]:focus,input[type="search"]:focus,input[type="tel"]:focus,input[type="color"]:focus,.uneditable-input:focus{border-color:rgba(82,168,236,0.8);outline:0;outline:thin dotted \9;-webkit-box-shadow:inset 0 1px 1px rgba(0,0,0,0.075),0 0 8px rgba(82,168,236,0.6);-moz-box-shadow:inset 0 1px 1px rgba(0,0,0,0.075),0 0 8px rgba(82,168,236,0.6);box-shadow:inset 0 1px 1px rgba(0,0,0,0.075),0 0 8px rgba(82,168,236,0.6)}input::-webkit-input-placeholder,textarea::-webkit-input-placeholder{color:#999}input{margin-left:0}input:focus:invalid,textarea:focus:invalid,select:focus:invalid{color:#b94a48;border-color:#ee5f5b}input:focus:invalid:focus,textarea:focus:invalid:focus,select:focus:invalid:focus{border-color:#e9322d;-webkit-box-shadow:0 0 6px #f8b9b7;-moz-box-shadow:0 0 6px #f8b9b7;box-shadow:0 0 6px #f8b9b7}.fade{opacity:0;-webkit-transition:opacity .15s linear;-moz-transition:opacity .15s linear;-o-transition:opacity .15s linear}.collapse{position:relative;-webkit-transition:height .35s ease;-moz-transition:height .35s ease;-o-transition:height .35s ease;transition:height .35s ease}.btn{text-shadow:0 1px 1px rgba(255,255,255,0.75);vertical-align:middle;background-image:-moz-linear-gradient(top,#fff,#e6e6e6);background-image:-webkit-gradient(linear,0 0,0 100%,from(#fff),to(#e6e6e6));background-image:-webkit-linear-gradient(top,#fff,#e6e6e6);background-image:-o-linear-gradient(top,#fff,#e6e6e6);background-repeat:repeat-x;border:1px solid #ccc;border-bottom-color:#b3b3b3;-webkit-border-radius:4px;-moz-border-radius:4px;-webkit-box-shadow:inset 0 1px 0 rgba(255,255,255,0.2),0 1px 2px rgba(0,0,0,0.05);-moz-box-shadow:inset
<style>/*! Editor.md v1.5.0 | editormd.min.css | Open source online markdown editor. | MIT License | By: Pandao | https://github.com/pandao/editor.md | 2015-06-09 *//*! prefixes.scss v0.1.0 | Author: Pandao | https://github.com/pandao/prefixes.scss | MIT license | Copyright (c) 2015 */@media only screen and (-webkit-min-device-pixel-ratio:2),only screen and (min-device-pixel-ratio:2){}@media only screen and (-webkit-min-device-pixel-ratio:3),only screen and (min-device-pixel-ratio:3){}/*! prefixes.scss v0.1.0 | Author: Pandao | https://github.com/pandao/prefixes.scss | MIT license | Copyright (c) 2015 *//*!
* Font Awesome 4.3.0 by @davegandy - http://fontawesome.io - @fontawesome
* License - http://fontawesome.io/license (Font: SIL OFL 1.1, CSS: MIT License)
*/@-webkit-keyframes fa-spin{0%{-webkit-transform:rotate(0);transform:rotate(0)}100%{-webkit-transform:rotate(359deg);transform:rotate(359deg)}}@keyframes fa-spin{0%{-webkit-transform:rotate(0);transform:rotate(0)}100%{-webkit-transform:rotate(359deg);transform:rotate(359deg)}}/*! prefixes.scss v0.1.0 | Author: Pandao | https://github.com/pandao/prefixes.scss | MIT license | Copyright (c) 2015 *//*! github-markdown-css | The MIT License (MIT) | Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (sindresorhus.com) | https://github.com/sindresorhus/github-markdown-css */.markdown-body{-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%;overflow:hidden}.markdown-body *{-moz-box-sizing:border-box}.markdown-body a:active,.markdown-body a:hover{outline:0;text-decoration:underline}.markdown-body>:first-child{margin-top:0 !important}.markdown-body>:last-child{margin-bottom:0 !important}.markdown-body img{-moz-box-sizing:border-box}/*! Pretty printing styles. Used with prettify.js. */@media screen{}@media screen{}</style>
<style>/*!
* Bootstrap Responsive v2.3.1
*
* Copyright 2012 Twitter, Inc
* Licensed under the Apache License v2.0
* http://www.apache.org/licenses/LICENSE-2.0
*
* Designed and built with all the love in the world @twitter by @mdo and @fat.
*/.clearfix:before,.clearfix:after{display:table;line-height:0;content:""}.clearfix:after{clear:both}@-ms-viewport{width:device-width}@media(min-width:768px) and (max-width:979px){}@media(max-width:767px){}@media(min-width:1200px){.row{margin-left:-30px}.row:before,.row:after{display:table;line-height:0;content:""}.row:after{clear:both}[class*="span"]{float:left;min-height:1px;margin-left:30px}.container{width:1170px}.span10{width:970px}input{margin-left:0}}@media(min-width:768px) and (max-width:979px){.row{margin-left:-20px}.row:before,.row:after{display:table;line-height:0;content:""}.row:after{clear:both}[class*="span"]{float:left;min-height:1px;margin-left:20px}.container{width:724px}.span10{width:600px}input{margin-left:0}}@media(max-width:767px){body{padding-right:0px;padding-left:0px}.container{width:auto}.row{margin-left:0}[class*="span"]{display:block;float:none;width:100%;margin-left:0;-webkit-box-sizing:border-box;-moz-box-sizing:border-box;box-sizing:border-box}.modal{position:fixed;right:20px;left:20px;width:auto;margin:0}.modal.fade{top:-100px}}@media(max-width:480px){.nav-collapse{-webkit-transform:translate3d(0,0,0)}.modal{top:10px;right:10px;left:10px}}@media(max-width:979px){body{padding-top:0}.navbar .container{width:auto;padding:0}.navbar .brand{padding-right:10px;padding-left:10px}.nav-collapse{clear:both}.nav-collapse.collapse{height:0;overflow:hidden}}@media(min-width:980px){.nav-collapse.collapse{height:auto !important;overflow:visible !important}}</style>
<style>li{line-height:26px}a:hover{text-decoration:none}.post-user-action>span{margin-right:10px;line-height:21px;border:0}.post-user-action .i-seprator{color:rgba(0,0,0,0.1);margin:0 2px}.navbar .brand{padding:0;height:50px;margin-left:0;display:inline-block !important;background-repeat:no-repeat;width:120px;background-size:207px 50px;background-image:url(data:image/svg+xml;base64,PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz4KPCEtLSBHZW5lcmF0b3I6IEFkb2JlIElsbHVzdHJhdG9yIDIxLjEuMCwgU1ZHIEV4cG9ydCBQbHVnLUluIC4gU1ZHIFZlcnNpb246IDYuMDAgQnVpbGQgMCkgIC0tPgo8c3ZnIHZlcnNpb249IjEuMSIgaWQ9IuWbvuWxgl8xIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB4PSIwcHgiIHk9IjBweCIKCSB2aWV3Qm94PSIwIDAgODAwLjQgMTMwLjQiIHN0eWxlPSJlbmFibGUtYmFja2dyb3VuZDpuZXcgMCAwIDgwMC40IDEzMC40OyIgeG1sOnNwYWNlPSJwcmVzZXJ2ZSI+CjxzdHlsZSB0eXBlPSJ0ZXh0L2NzcyI+Cgkuc3Qwe2ZpbGw6IzM3M0Q0MTt9Cjwvc3R5bGU+Cjx0aXRsZT7lhYjnn6XmioDmnK/npL7ljLo8L3RpdGxlPgo8Zz4KCTxwb2x5Z29uIGNsYXNzPSJzdDAiIHBvaW50cz0iMCwxMjEuNCAwLDI3LjMgNTYuMywyNy4zIAkiLz4KCTxwb2x5Z29uIGNsYXNzPSJzdDAiIHBvaW50cz0iODkuOSw4LjQgODkuOSwxMDIuNSAzMy41LDEwMi41IAkiLz4KPC9nPgo8cGF0aCBjbGFzcz0ic3QwIiBkPSJNMTMwLjcsNTguNGMtMi4zLTEuNC00LjctMi45LTcuMi00LjVjNi02LjksMTAuNy0xNi4yLDE0LjEtMjcuOWw4LjMsMS43Yy0wLjcsMS42LTEuNiwzLjktMi44LDYuOQoJYy0wLjcsMi4zLTEuMywzLjktMS43LDQuOGgxNy41VjI0aDguM3YxNS41aDI5LjZWNDdoLTI5LjZ2MTUuMWgzNC43VjcwaC0yNi41djIxLjNjLTAuMiwzLjQsMS42LDUsNS41LDQuOGg3LjIKCWMzLjIsMC4yLDUuMy0xLjMsNi4yLTQuNWMwLjItMS40LDAuNS00LjEsMC43LTguM2MwLDAuNywwLjEtMC4xLDAuMy0yLjRsNy42LDIuOGMtMC4yLDQuMS0wLjcsNy45LTEuNCwxMS40CgljLTEuNiw2LTUuOCw4LjgtMTIuNyw4LjZoLTEwLjdjLTcuNiwwLjItMTEuMi0zLjItMTEtMTAuM1Y3MC4xaC0xNS44djMuMWMwLDE1LjQtOS4xLDI2LjQtMjcuMiwzM2MtMS40LTIuMS0zLTQuNi00LjgtNy42CglDMTM1LjEsOTQsMTQzLDg1LjQsMTQzLDcyLjhWNzBoLTIyLjd2LTcuOWgzOC41VjQ3aC0yMS4zQzEzNS41LDUxLjEsMTMzLjIsNTQuOSwxMzAuNyw1OC40eiIvPgo8cGF0aCBjbGFzcz0ic3QwIiBkPSJNMjEzLjIsNTQuNmMtMC41LTAuMi0xLjItMC43LTIuMS0xLjRjLTEuOC0xLjQtMy4yLTIuMy00LjEtMi44YzQuOC04LjksOC4xLTE3LjksMTAtMjYuOGw3LjYsMS40CgljLTAuNSwxLjgtMS4zLDQuNC0yLjQsNy42Yy0wLjIsMS4yLTAuNSwyLTAuNywyLjRoMjQuMXY3LjJoLTEyYzAsOC43LTAuMSwxNC45LTAuMywxOC42aDE0LjFWNjhoLTE0LjhjMCwyLjMtMC4yLDQuNS0wLjcsNi41CgljMS42LDEuNiwzLjgsNCw2LjUsNy4yYzQuNiw0LjgsOCw4LjYsMTAuMywxMS40bC01LjgsNS4yYy0wLjktMS4yLTIuMy0yLjgtNC4xLTQuOGMtMS44LTIuMy00LjgtNS44LTguOS0xMC43CgljLTIuNSw3LjgtOC40LDE1LjUtMTcuNSwyMy4xYy0yLjMtMi44LTQuMS00LjgtNS41LTYuMmMxMS4yLTguOSwxNy4zLTE5LjUsMTguMi0zMS43aC0xNy4ydi03LjJoMTcuNWMwLjItMy45LDAuMy0xMC4xLDAuMy0xOC42CgloLTYuOUMyMTcuMSw0Ni4zLDIxNS4zLDUwLjQsMjEzLjIsNTQuNnogTTI1MS40LDEwMi43VjMxLjloMzUuOHY3MC41aC04LjN2LTcuNmgtMTkuNnY3LjlDMjU5LjMsMTAyLjcsMjUxLjQsMTAyLjcsMjUxLjQsMTAyLjd6CgkgTTI1OS4zLDM5LjR2NDcuOGgxOS42VjM5LjRIMjU5LjN6Ii8+CjxwYXRoIGNsYXNzPSJzdDAiIGQ9Ik0yOTcuMiw4MS4xYy0wLjItMC45LTAuNi0yLjMtMS00LjFjLTAuNy0xLjgtMS4yLTMuMi0xLjQtNC4xYzkuMi02LjIsMTYuNC0xNC4zLDIxLjctMjQuNGgtMTkuNnYtNi45aDI3LjV2Ny4yCgljLTIuNSw1LjUtNS40LDEwLjQtOC42LDE0Ljh2NDIuM2gtNy42VjcyLjFDMzA1LDc1LjEsMzAxLjQsNzguMSwyOTcuMiw4MS4xeiBNMzExLjcsNDAuNWMtMC4yLTAuNS0wLjYtMS4xLTEtMi4xCgljLTIuOC02LTQuNi05LjctNS41LTExLjRsNi45LTMuMWMwLjcsMS4yLDEuOCwzLjMsMy40LDYuNWMxLjYsMywyLjgsNS4yLDMuNCw2LjVMMzExLjcsNDAuNXogTTMyNi44LDgwLjcKCWMtMS42LTIuMS00LjctNS42LTkuMy0xMC43Yy0wLjItMC4yLTAuNS0wLjUtMC43LTAuN2w0LjgtNC41YzIuMSwxLjgsNC45LDQuNiw4LjYsOC4zYzEuMSwxLjIsMS45LDIsMi40LDIuNEwzMjYuOCw4MC43egoJIE0zMjguNSw1Ni42VjQ5aDE4LjZWMjQuM2g4LjN2MjQuOEgzNzV2Ny42aC0xOS42djM5LjJoMjIuNHY2LjloLTUzdi02LjloMjIuNFY1Ni42SDMyOC41eiIvPgo8cGF0aCBjbGFzcz0ic3QwIiBkPSJNMzg5LjgsMTAxLjRWMjkuMUg0NjJ2Ny42aC02NC4zdjU3LjhoNjUuN3Y2LjlIMzg5Ljh6IE00NTAuMyw5MC40Yy02LjItNi42LTEyLjYtMTMtMTkuMy0xOC45CgljLTYsNS43LTEzLjQsMTIuMy0yMi40LDE5LjZjLTEuNC0xLjYtMy40LTMuOC02LjItNi41YzguMy01LjcsMTUuOC0xMiwyMi43LTE4LjljLTYuOS02LjQtMTMuOC0xMi43LTIwLjYtMTguOWw2LjItNS4yTDQzMSw2MC4yCgljNS41LTYuMiwxMC45LTEyLjgsMTYuMi0yMGw3LjIsNC41Yy01LjcsNy42LTExLjYsMTQuNC0xNy41LDIwLjZjNi45LDYuNywxMy42LDEzLDIwLjMsMTguOUw0NTAuMyw5MC40eiIvPgo8L3N2Zz4K)}.brand-box{position:absolute}.related-section{min-height:42px;padding:5px 0;margin-top:25px;border-top:1px solid #eee}.related-section>.related-
<style>a{color:#778087}.topic-list p{margin:0}.topic-content{min-height:40px}.collapse form{position:relative;width:300px;float:right}div.search{padding:10px 0}.d1 input{height:20px;padding-left:18px;border:1px solid #ddd;border-radius:15px;outline:0;background:#fff;color:#9e9c9c;float:right}.vote{font-weight:normal;margin-left:6px}.topic-list{word-break:break-all;word-wrap:break-word}ul{margin:0 0 10px 0}/*!*border-bottom: solid #eee 1px;*!*/.user-info{padding:5px 0 5px 0}.topic-info a,.topic-info{padding-top:5px}.topic-info a:hover{text-decoration:solid}.reminder{min-height:200px;border:1px #ddd solid;border-radius:3px;line-height:200px;text-align:center}</style>
<style>body{background-color:#eee}form{margin:0 !important}a:focus{text-decoration:none}.box ul,ol{margin-bottom:0px !important}.box a:hover{text-decoration:none}.box-container>ul>li{list-style-type:none}#Wrapper .row.box{margin-left:0px}.navbar-inner{border-radius:0px;min-height:40px;padding-right:0px;padding-left:0px;outline:0;margin-bottom:0;list-style:none;z-index:1050;background:#fff;-webkit-box-shadow:0 1px 4px rgba(0,21,41,0.08);box-shadow:0 1px 4px rgba(0,21,41,0.08);line-height:46px;-webkit-transition:background .3s,width .2s;-o-transition:background .3s,width .2s;transition:background .3s,width .2s}.bs-docs-footer{text-align:left;color:#99979c;height:64px;background-color:#FFF;border-top:1px solid rgba(0,0,0,0.22);line-height:64px}.bs-docs-footer .links>a{display:inline-block;padding:0 12px;border-left:1px solid #e8e8e8;color:#8c8c8c;line-height:1}.bs-docs-footer .links>a:first-child{border-left:0}.box-container .user-info{margin-bottom:10px;background:#fff}.content-title{font-size:24px;color:#333;text-decoration:none;line-height:24px;text-shadow:0 1px 0#fff}.markdown-body h2{border-bottom:0}.box-container{padding:20px}.breadcrumb{padding:8px 10px 8px 15px;margin-bottom:10px;border-radius:0;color:#000;background-color:#fff}.breadcrumb>li{text-shadow:none !important;margin:2px 0px}.active{text-shadow:none !important}.breadcrumb .active{color:#555;display:inline-block;text-shadow:none !important}.label{background-color:#f4f4f4;line-height:12px;display:inline-block;padding:4px 4px 4px 4px;-moz-border-radius:2px;-webkit-border-radius:2px;border-radius:2px;text-decoration:none;text-shadow:none;font-weight:normal}.topic-info{color:#999 !important;font-size:12px !important}.topic-info a{padding:0px;color:#555 !important;font-size:12px !important}.topic-info a:hover{color:#4d5256;text-decoration:underline}.topic-info .cell{padding-left:0 !important;margin-left:0px;font-size:10px;font-weight:bold}.markdown-body img{max-width:90% !important;text-align:center;margin-left:auto;margin-right:auto;display:block;padding:10px 0px 10px 0px}.topic-info span{margin-left:0px;font-size:10px;color:rgba(0,0,0,0.45)}.btn{display:inline-block;padding:4px 12px;margin-bottom:0;font-size:14px;line-height:20px;background-color:#f4f4f4;color:#444;border-color:#ddd;font-family:"Helvetica Neue For Number",-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,"PingFang SC","Hiragino Sans GB","Microsoft YaHei","Helvetica Neue",Helvetica,Arial,sans-serif;-webkit-box-sizing:border-box;box-sizing:border-box;margin:0;list-style:none;font-weight:400;text-align:center;cursor:pointer;background-image:none;white-space:nowrap;border-radius:2px;height:32px;-webkit-user-select:none;-moz-user-select:none;-ms-user-select:none}.box{font-family:Monospaced Number,Chinese Quote,-apple-system,BlinkMacSystemFont,Segoe UI,Roboto,PingFang SC,Hiragino Sans GB,Microsoft YaHei,Helvetica Neue,Helvetica,Arial,sans-serif;font-size:14px;line-height:1.5;color:rgba(0,0,0,0.65);-webkit-box-sizing:border-box;box-sizing:border-box;margin-top:0 !important;margin-bottom:20px;padding:0;list-style:none;background:#fff;border-radius:2px;position:relative;-webkit-transition:all .3s;-o-transition:all .3s;transition:all .3s;-moz-box-shadow:0 1px 1px rgba(0,0,0,0.15);-webkit-box-shadow:0 1px 1px rgba(143,168,191,.35);box-shadow:0 1px 1px rgba(143,168,191,.35);border-bottom:1px solid #e2e2e9}.span10{float:left;min-height:1px}#Wrapper .span10{margin-left:0px !important;max-width:960px}@media(min-width:1200px){.container{width:82% !important}}@media screen and (min-width:1500px){#Wrapper.container,.navbar .navbar-inner .container,.bs-docs-footer .container{max-width:1100px !important}#Wrapper .span10{max-width:810px !important}}@media screen and (min-width:980px) and (max-width:1499px){#Wrapper.container,.navbar .navbar-inner .container,.bs-docs-footer .container{max-width:1100px !important}#Wrapper .span10{max-width:74% !important}}@media screen and (min-width:768px) and (max-width:979px){#Wrapper.container,.navbar .navbar-inner .container,.bs-docs-footer .container{width:90% !important}#Wr
<style>/*! prefixes.scss v0.1.0 | Author: Pandao | https://github.com/pandao/prefixes.scss | MIT license | Copyright (c) 2015 */@media only screen and (-webkit-min-device-pixel-ratio:2),only screen and (min-device-pixel-ratio:2){}@media only screen and (-webkit-min-device-pixel-ratio:3),only screen and (min-device-pixel-ratio:3){}/*! prefixes.scss v0.1.0 | Author: Pandao | https://github.com/pandao/prefixes.scss | MIT license | Copyright (c) 2015 *//*!
* Font Awesome 4.3.0 by @davegandy - http://fontawesome.io - @fontawesome
* License - http://fontawesome.io/license (Font: SIL OFL 1.1, CSS: MIT License)
*/.pull-right{float:right}.pull-left{float:left}@-webkit-keyframes fa-spin{0%{-webkit-transform:rotate(0deg);transform:rotate(0deg)}100%{-webkit-transform:rotate(359deg);transform:rotate(359deg)}}@keyframes fa-spin{0%{-webkit-transform:rotate(0deg);transform:rotate(0deg)}100%{-webkit-transform:rotate(359deg);transform:rotate(359deg)}}/*! prefixes.scss v0.1.0 | Author: Pandao | https://github.com/pandao/prefixes.scss | MIT license | Copyright (c) 2015 *//*! github-markdown-css | The MIT License (MIT) | Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (sindresorhus.com) | https://github.com/sindresorhus/github-markdown-css */.markdown-body{color:#333;font-family:Monospaced Number,Chinese Quote,-apple-system,BlinkMacSystemFont,Segoe UI,Roboto,PingFang SC,Hiragino Sans GB,Microsoft YaHei,Helvetica Neue,Helvetica,Arial,sans-serif;font-size:15px;line-height:24px;letter-spacing:.05em;word-wrap:break-word}.markdown-body a{background:transparent}.markdown-body a:active,.markdown-body a:hover{outline:0}.markdown-body img{border:0}.markdown-body pre{font-family:"Meiryo UI","YaHei Consolas Hybrid",Consolas,"Malgun Gothic","Segoe UI","Trebuchet MS",Helvetica,monospace,monospace}.markdown-body *{-moz-box-sizing:border-box;box-sizing:border-box}.markdown-body a{color:#4183c4;text-decoration:none}.markdown-body a:hover,.markdown-body a:active{text-decoration:underline}.markdown-body pre{font:12px Consolas,"Liberation Mono",Menlo,Courier,monospace}.markdown-body>*:first-child{margin-top:0 !important}.markdown-body>*:last-child{margin-bottom:0 !important}.markdown-body h2{position:relative;margin-top:1em;margin-bottom:16px;font-weight:bold}.markdown-body h2{padding-bottom:0em;font-size:24px;line-height:1.225}.markdown-body p,.markdown-body pre{margin-top:0;margin-bottom:24px}.markdown-body img{max-width:100%;-moz-box-sizing:border-box;box-sizing:border-box}.markdown-body .highlight{margin-bottom:16px}.markdown-body .highlight pre{padding:16px;overflow:auto;font-size:85%;background-color:#f7f7f7;border-radius:3px}.markdown-body .highlight pre{margin-bottom:0;word-break:normal}.markdown-body pre{word-wrap:normal}/*! Pretty printing styles. Used with prettify.js. */@media screen{}.markdown-body .highlight pre{line-height:1.6}@media screen{}</style>
<style>.highlight .s{color:#4e9a06}.highlight .na{color:#c4a000}.highlight .nt{color:#204a87;font-weight:bold}</style>
<style>@-webkit-keyframes a{0%{-webkit-transform:rotate(0deg);transform:rotate(0deg)}to{-webkit-transform:rotate(359deg);transform:rotate(359deg)}}@keyframes a{0%{-webkit-transform:rotate(0deg);transform:rotate(0deg)}to{-webkit-transform:rotate(359deg);transform:rotate(359deg)}}@media(max-width:800px){}</style>
<!--[if lte IE 8]>
<script src="http://code.jquery.com/jquery-1.11.3.min.js"></script>
<![endif]-->
<!--[if !IE]> -->
<style>#waf_nc_block{position:fixed;width:100%;height:100%;top:0;bottom:0;left:0;z-index:99999}</style><style>@media(pointer:coarse){@media only screen and (max-device-width:1024px){}@media only screen and (max-device-width:414px){}@media only screen and (max-device-width:320px){}}</style><style>@media screen and (max-width:768px){}</style><style>/*!
* Waves v0.7.5
* http://fian.my.id/Waves
*
* Copyright 2014-2016 Alfiana E. Sibuea and other contributors
* Released under the MIT license
* https://github.com/fians/Waves/blob/master/LICENSE
*/</style><style>@media(max-height:620px){}@media(max-height:783px){}@-webkit-keyframes srFadeInUp{0%{opacity:0;-webkit-transform:translateY(100px);transform:translateY(100px)}to{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}}@keyframes srFadeInUp{0%{opacity:0;-webkit-transform:translateY(100px);transform:translateY(100px)}to{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}}@-webkit-keyframes srFadeInDown{0%{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}to{opacity:0;-webkit-transform:translateY(100px);transform:translateY(100px)}}@keyframes srFadeInDown{0%{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}to{opacity:0;-webkit-transform:translateY(100px);transform:translateY(100px)}}</style><style>@-webkit-keyframes fadeOutUp{0%{opacity:1}to{margin-top:0;padding:0;height:0;min-height:0;opacity:0;-webkit-transform:scaleY(0);transform:scaleY(0)}}@keyframes fadeOutUp{0%{opacity:1}to{margin-top:0;padding:0;height:0;min-height:0;opacity:0;-webkit-transform:scaleY(0);transform:scaleY(0)}}@media(pointer:coarse){}</style><style>:root{--sr-annote-color-0:#b4d9fb;--sr-annote-color-1:#ffeb3b;--sr-annote-color-2:#a2e9f2;--sr-annote-color-3:#a1e0ff;--sr-annote-color-4:#a8ea68;--sr-annote-color-5:#ffb7da}</style><style>@-webkit-keyframes sr-annote-slideInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0);visibility:visible}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@keyframes sr-annote-slideInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0);visibility:visible}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@-webkit-keyframes sr-annote-slideInDown{0%{opacity:1;visibility:visible}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}@keyframes sr-annote-slideInDown{0%{opacity:1;visibility:visible}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}</style><style>@-webkit-keyframes fadeInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@keyframes fadeInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@-webkit-keyframes fadeOutDown{0%{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}@keyframes fadeOutDown{0%{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}@-webkit-keyframes scaleAnimation{0%{opacity:0;-webkit-transform:scale(1.5);transform:scale(1.5)}to{opacity:1;-webkit-transform:scale(1);transform:scale(1)}}@keyframes scaleAnimation{0%{opacity:0;-webkit-transform:scale(1.5);transform:scale(1.5)}to{opacity:1;-webkit-transform:scale(1);transform:scale(1)}}@-webkit-keyframes fadeOut{0%{opacity:1}to{opacity:0}}@keyframes fadeOut{0%{opacity:1}to{opacity:0}}@-webkit-keyframes fadeIn{0%{opacity:0}to{opacity:1}}@keyframes fadeIn{0%{opacity:0}to{opacity:1}}@-webkit-keyframes swing{20%{-webkit-transform:rotate(15deg);transform:rotate(15deg)}40%{-webkit-transform:rotate(-10deg);transform:rotate(-10deg)}60%{-webkit-transform:rotate(5deg);transform:rotate(5deg)}80%{-webkit-transform:rotate(-5deg);transform:rotate(-5deg)}to{-webkit-transform:rotate(0deg);transform:rotate(0deg)}}@keyframes swing{20%{-webkit-transform:rotate(15deg);transform:rotate(15deg)}40%{-webkit-transform:rotate(-10deg);transform:rotate(-10deg)}60%{-webkit-transform:rotate(5deg);transform:rotate(5deg)}80%{-webkit-transform:rotate(-5deg);transform:rotate(-5deg)}to{-webkit-transform:rotate(0deg);transform:rotate(0deg)}}</style><style>@-webkit-keyframes fadeInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}to{opacity:1;-webkit-transform:translateZ(0);transform:transl
<body>
<div class="navbar navbar-default">
<div class=navbar-inner>
<div class=container style=text-align:center;position:relative>
<!--[if lte IE 8]>
<span style="display:inline-block;margin:0 auto;color:red;">为了更好的体验，请使用IE10及以上版本</span>
<![endif]-->
<div class=brand-box>
<a class=brand href=https://xz.aliyun.com/tab/1></a>
</div>
<a href="https://account.aliyun.com/login/login.htm?oauth_callback=https%3A%2F%2Fxz.aliyun.com%2Ft%2F14517%3Fu_atoken%3Df50c8e7a7d40ceb9aaa813f125fa81a1%26u_asession%3D01a27JH3yYs4Rn04c99AXgZ5YYI4hn6zYChuuLRaajFDS5A6GDxASSQMBySL8AtLcudlmHJsN3PcAI060GRB4YZGyPlBJUEqctiaTooWaXr7I%26u_asig%3D05HTLB4XimLCy_AgwCRcf9yFeuotnUci5qEysOXdsgel_80aalOchpWmtUueK-C1grv_Ew6sk4kJWhIxbGUtIvqwD1xlWS8-p3Rpi7cDE-vQxmekVmWmLx8Mdk5lbqBJH8bWet15V-gKKvzrUOo3dGJVg6Xgeq5X_nZ31gZe5tuw9g2QMxYs6lyXb1lFWKql56VQk-s9fMkC5MAIUnb73u9altTs_pEgT5kGMBqPXKjlFrxDqh8wjGDQNnCEAn9P2zrLfmcl4pPFuyeypc6q01x7mMVlCk5kiJUJeLu8ULWJA%26u_aref%3DD1qbxzhiimt%252Fz5GoeLtMZ%252BpMo%252FY%253D&amp;from_type=xianzhi" class="pull-right anonymous-user hh_loding sf-hidden">
登录</a>
<div class="nav-collapse collapse">
<div class="search d1 text-right">
<form action=/search>
<input type=text placeholder=搜索 name=keyword value>
</form>
</div>
</div>
</div>
</div>
</div>
<div id=Wrapper class=container>
<div class=row2>
<div class=span10>
<div class="row box content" width="1200px !important" style=width:1200px>
<div class=box-container>
<div class=main-topic>
<div class="clearfix user-info topic-list">
<p><span class=content-title>.NET 某和OA办公系统全局绕过漏洞分析</span>
</p>
<div class=topic-info>
<span class=info-left>
<a href=https://xz.aliyun.com/u/76258>
<span class="username cell"> 1960857020362317</span></a> <span class=i-seprator> / </span>
<span> 2024-05-16 15:18:11</span><span class=i-seprator> / </span>
<span>发表于安徽 / </span>
<span>浏览数 307</span>
<span class=content-node>
<span class="label label-default label-node-first">
<a href=https://xz.aliyun.com/tab/1>技术文章</a></span>
<span class="label label-default">
<a href=https://xz.aliyun.com/node/11>技术文章</a></span>
</span>
</span>
<span class="pull-right t-vote cell info-right"><a class="vote vote-up" href=javascript:void(0)>
顶(0)</a>
<a class="vote vote-down" href=javascript:void(0)>
踩(0)</a></span>
</div>
</div>
<hr>
<div id=topic_content class="topic-content markdown-body">
<h2 id=toc-0>0x01 前言</h2>
<p>某和OA协同办公管理系统C6软件共有20多个应用模块，160多个应用子模块，从功能型的协同办公平台上升到管理型协同管理平台，并不断的更新完善，全面支撑企业发展。从此OA C6版本外部已公开的多个漏洞详情，不难发现都有一些共同的特点，那就是URL里的 .aspx后都会加上一个 / ，然后再进行传递参数。比如 /RssModulesHttp.aspx/?interfaceID=1，为此有一些对.NET感兴趣的群友们在星球陪伴的微信群里问起这个原因。<br>
于是笔者带着这些疑问点抽空研究总结了一下，于是便有了此文。</p>
<h2 id=toc-1>0x02 ExtensionlessUrlHandler</h2>
<p>笔者对.NET系统进行漏洞挖掘时第一步喜欢看一下Web.config配置文件，因为此文件包含了一些关于HTTP请求需要经过的管道或者自定义方法，如下所示。</p>
<p><a id=img0 href=https://xzfile.aliyuncs.com/media/upload/picture/20240516150903-2d733dca-1353-1.png title><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAz4AAAGACAYAAABslLf0AAEAAElEQVR4nOzddZwVVf/A8c/Mre1OllhYurtBSlFRAQu7u7swkEZRJAVRUZGSlG7p7u5Y2O7du7dnzu+PWVJ2UeTR5/F33q/XvmBnzpxz5szcu/Odc86MIoQQSJIkSZIkSZIk/Q/TdR0hBJqm4fP58Pl8hISEnF+v/oN1kyRJkiRJkiRJ+lv8M4GP5uTEju04HN5/pPhL2Zn01CPkuXy/W+NzFXB0+QK2T5jEsQNn0P6B2kmSJEmSJEmS9NeVGfgUHtvKws9/pOh6X/G7M1k9aAT5+e7rnPG1ELiKCtG5dMSf5khnyRuPsfbrnzm9YjFbPv+IY6ed/1AdDWdXz+C3matx++ToREmSJEmSJEn6M0oJfHTStyxgbp/RRDZrgr8CIChM3s7sJ+9mdMOmTO73Aw6PRuHRFUx7bQD5xUZ0lLd7PtN7j8GJIP/4JmY+2pPRDZsxdfBkXD6dU9NHMK5xF1IXz2F6h6aMrl2bxdPXAjq5hzcy85HujG7SktlDp2D3Cs6uHsu8EV/xU9cOLPr2J3655zbmjl3K7/tnDEcm9GHN0sMXwhhHCnPffJe0LCd5Bzcw89E7GN2wDXM+n0yRSzfSaMXs/2ko37Ruwg/P9yct24kr+zipJzJp+dk4ek78ibtGDScx3gYIHOkHmftcL8Y0asovH48luySA2z7sLVb9PIuZj9zB1x17sHndEdwp2/jhsfcoLimq8NAipvUeicOjU3h8C3OevosxTZszY9B3FBR5QHOy+dNXWb9oOdN6dWZMh7vYvTsFHYiu2xj3hsksHDEVu7O0FpAkSZIkSZIk6XK/D3x0DycW/8zSsYto/HZfmnWoi1kFdC/7vxmGo/Lt9Px2DNVrReLVdIITG2LJ2c2Jo5kgPBxZtISQJi3x193sGTscX+276PntaKpUCcYrBHEd7uKOb78gsnErOgz/hp4//UTzDvXxFqWxashQwm97kR5jvsByYCIblx3Da8/m4JTllO/WhAPjxhHWviVZyxZQ4LnyDlmjdTIOpJJ3aAlzh0zCXphHYY4LvNmsHjyKsJufp/vYwVhP/sq6hfuNjdL2cfqkH12+GEWMeyObF2zHL74udTs3Z8P7z7Pih5nkFujYrCpCc7P6k7cxtXqY7uNGEencwLrp69EAZ+Y29kz6lYS7XqPdw83Y+vUURFQ1wos3c+hoEQI4NmsOoY3b4qfk8NvAzwlo8yh3jBpGaO4aVk3fBEJgP3WEHWOnUvWpfrS5rwobx0zB4wNbZBU6f9qPaPcW5g8cQ06B6z91XkiSJEmSJEnSv4r5d0t0FycWL0Gp2IVKNcpdiIwUM9V63M3RL6extjiZWrfegb/FhGKOpN4tDdm5bCM1ytcm+YQfbZ+rD4pK9R49OTV6DmsLTlHn9p74mVQs0QnEB3qwhkUQ3aAx5coFAVB4Yhdnl24g53g2pwF37klsEXup3BGi699FrRusnN0ZRZ2ujUldOwtNv/IORVWuT9Hi0yRv8JKevJvUU6GYg5PQ7EdI2bIWy4kUklXw5KaiBm2HOxMhtiE3fvASccEWLIU3smHHGXRLW1q8Ppikw7s5OG8Gvz4xlTZDRlG7ppsTczdgOVhIpqLgLUpFpDbE9XgnIICkx1+lRffGaM7GRLbIwWINpn6vTqyZ+huNP2jNwd0FtHu6Br7MvZzdvBPLoQxSzArevDR8vuZAU7D4Uf+13jTpWBmtTQ2iOuRjKTkQlqAoqna6gX2f/khqai8iQ/2u7xkhSZIkSZIkSf9Cvw98zCG07zuU9V8OZMHnPrq89jARwcbFtV+Vttw5pi3Z+7azuv9zOAfNpkWjOCrdeAdb3v+a/csysDTtQGyYGXSNwFqd6Tm6A9n7tvNb70fxjFlO45phgAIeDy6nB2H8hmoJwK9aPeo+/wJRwTajvEoN8Z48gMUaiKJ6MVtCMZkura6nIJPcDCdRVSthViGofA18eT9ytjiWRg2qs2/DFqy16xHq549/fC2qP/M8sSXBgi2xjpGJyYrJJBCah5wDpzAF10C4nTg8gujazYmqUQ+z80F2zF1D7Vo3YK1UhRrPvUp8eAAA1tga2FQAFbOfDQUw+4cRXycMgIpdH8QzfQBn9jgQNe8gLsIfU14AtvhEqj/4HPGxgUY+lWoZ9VEULH5GG5gCIkmoGWks130kr5nF6h+W0urTodSpFfvXjr4kSZIkSZIk/T/x+8AHsIbE0/69/uwcN5TFg37k9r7PEoybXV/35eSuNGyqitcXhZ+/1UgfXZPqNWHjhBXcMn6C0Uvkc7B9xCec2Z+BTVXRiMfmV1KcXxRx8U4WP/swkaF+VHjuQ1reUIMabSuy56cfCbOpKECtPmMJKrP6Xg5+/Snzf9jBg5s2khgGhCbglzoLu2sY7W4LY9t9zxL/8o0ExdcjqU0FDkz8gRQ/M4rFnxpvDaYiCtbi4yx86H5sKuQ5rXQZ0YLi5G0sHjAStVgAgrwcF00HtkE1R9H4/rZsmfgTaQEWFAQVX+xLpTIeE6EGVaJ+LZVFX66k+YeDsZoUiKxG7bbV2ftLST4ikEov9KZS9dLzSd84i1WTttL6w0FUrRpdZstIkiRJkiRJknSBUtYLTIXmIuNUFlFJFTAjcOWlcXzNBnxulYiWN5BQIRJVAaF7OTb5MzZsjaDXl8/jZwIQOHLOcnLtJnxeM5GtO5JQLgxFMfJ25aVycv0mPLl2Qlt2JrF6ApqnmNOb1lJ0KhOAmBvvJFg7QWZqCPHVdNIPeYmrG0zqjmQS2rbEzwTFqQc5eTCXqh3b4KcC6JxaMRVztZspn+DH8fkr8G/cjnIVwtA8dpI3b6DwZDqoFqI73Eq58sFkHdlD+p5DCDWMuHZtiY4OAs1D+pE9ZO05CrYwIpq2oHz5iJKG8ZK8eQ15R1NBCMJad6VS1Vgyd6zEF92YchXCfteWzszDHNmcRs1b22MzGVGS7nWQvG0DBcdTQbcS3qozFZPCSduyDnNSc6KjAy7Jw5GVissaTkSo/1887JIkSZIkSZL073K1F5iWGfj8EdmbF7N5/GSSz2h0HD2SmlUj/nKlJUmSJEmSJEmS/oyrBT5XHOr2Z5hDwolucSsN+91CQnzoX81OkiRJkiRJkiTpuvvLPT6SJEmSJEmSJEn/tKv1+PxuSn5BQQGapv2tlZQkSZIkSZIkSfpPumLgo+ulvCRHkiRJkiRJkiTpf1AZD2H+73L84HheWzYbL7Bt50SG7tjyB7fU2HNyHSn5maw/sRfXRWt89rOsSD7JucF+h5J/40heEfiK2XliHXZvWfkWs/zAapzFWaw7cwrfNe3V7+VmrOSRmcOvU26SJEmSJEmSJMF1eLjB38FVtIv3lw8nqOpjTN87Gaf9BL/un0Wgcg+hZgATlaPa0io+4Qpbe1mybQKNWg8kzLGbDxZvo2+XxwkygzfnAGP3FtA+3Mzs0+tZtmMUpph7aB9jYs6OObRr8ARJUQ3pWrk2pt/lm8/o3yZQ84EhHNs7mO3pj/NCsxYcOPgtv6SePJ9K191sObWDplVaXdLYd9Z9E1PuUqan7gW8pGam8nKnsaTtnUnlxKeucwtKkiRJkiRJ0v9v//HAJ+fYTO7fcZQl97yLcu4lPn+Cz5HOV0v6clgEcJvNzcn8k2RlbAdzILn2k+QCJsVGvXLBACxb8xYzCk1E+Z/bNcH2rG1s2zqIqsH++Nx5DNsWx7stbzlfhmoNpW5MPQ76h2EKrUn9aDObbGupGV2fykEhbDu1knRX0eV7RprjKIvOrCWqYnsczkNsTImjba1HCQreyD57HgCar4gth7fTOKE5fiVbVoxuT6PIcIi9j4a17gMKmTDnLQoKTzLl1DGCvVPpvWI6KelbsYY14+Zaz9CjSuL/TvecJEmSJEmSJP2Xua6Bj7PoNHO2r6R980dJCD
<p>在这里我们发现了一个名为ExtensionlessUrlHandler的一般处理程序，关于此handle背景知识是这样的： .NET WebForms框架早期版本中对于URL请求的设计和管理一直沿用经典的ASP风格，通常URL地址上包含文件及扩展名，比如 UserName.aspx、CheckUser.ashx 等。随着 Web 开发的进步和用户体验需求的提升，陆续出现像MVC框架对无扩展名 URL的需求，即 extensionless URL。</p>
<p>无扩展名 URL 更简洁、易读，用户更容易记住和输入。例如，/about 比 /about.aspx 更直观和易记。因此.NET框架在后来4.0发布时引入了一个ExtensionlessUrlHandler这是一个专门用于处理无扩展名 URL 请求的 .NET Handler。</p>
<p>当启用该配置后基于WebForms框架实现的Web应用便可以像MVC那样通过使用 / 分割路径和参数。这比如 /Mall/Product/GetById/10 ，使用该组件时需要当运行在IIS7以上版本，并且需要IIS的一个快速修复程序KB980368，配置Web.config后将会正常处理上面这种 extensionless URL。</p>
<p>在IIS经典模式下，用的是aspnet_isapi.dll，通过映射到System.Web.DefaultHttpHandler进行处理，如下配置所示。</p>
<div class=highlight><pre><span></span><span class=nt>&lt;system.webServer&gt;</span>
<span class=nt>&lt;handlers&gt;</span>
<span class=nt>&lt;add</span>
<span class=na>name=</span><span class=s>"ExtensionlessUrl-ISAPI-4.0_32bit"</span>
<span class=na>path=</span><span class=s>"*."</span>
<span class=na>verb=</span><span class=s>"GET,HEAD,POST,DEBUG"</span>
<span class=na>modules=</span><span class=s>"IsapiModule"</span>
<span class=na>scriptProcessor=</span><span class=s>"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\aspnet_isapi.dll"</span>
<span class=na>preCondition=</span><span class=s>"classicMode,runtimeVersionv4.0,bitness32"</span>
<span class=na>responseBufferLimit=</span><span class=s>"0"</span> <span class=nt>/&gt;</span>
<span class=nt>&lt;/handlers&gt;</span>
<span class=nt>&lt;/system.webServer&gt;</span>
</pre></div>
<p>在集成模式下，会映射到System.Web.Handlers.TransferRequestHandle来处理，如下配置所示。</p>
<div class=highlight><pre><span></span><span class=nt>&lt;system.webServer&gt;</span>
<span class=nt>&lt;handlers&gt;</span>
<span class=nt>&lt;remove</span> <span class=na>name=</span><span class=s>"ExtensionlessUrlHandler-Integrated-4.0"</span> <span class=nt>/&gt;</span>
<span class=nt>&lt;remove</span> <span class=na>name=</span><span class=s>"OPTIONSVerbHandler"</span> <span class=nt>/&gt;</span>
<span class=nt>&lt;remove</span> <span class=na>name=</span><span class=s>"TRACEVerbHandler"</span> <span class=nt>/&gt;</span>
<span class=nt>&lt;add</span> <span class=na>name=</span><span class=s>"ExtensionlessUrlHandler-Integrated-4.0"</span> <span class=na>path=</span><span class=s>"*."</span> <span class=na>verb=</span><span class=s>"*"</span> <span class=na>type=</span><span class=s>"System.Web.Handlers.TransferRequestHandler"</span> <span class=na>preCondition=</span><span class=s>"integratedMode,runtimeVersionv4.0"</span> <span class=nt>/&gt;</span>
<span class=nt>&lt;/handlers&gt;</span>
<span class=nt>&lt;/system.webServer&gt;</span>
</pre></div>
<p>这段配置中path="<em>." 匹配所有无扩展名的 URL 请求，verb="</em>" 表示谓词，就是IIS处理所有 HTTP 请求方法，包含了GET/POST/DELETE/PUT 等。type更是直接指向"System.Web.Handlers.TransferRequestHandler"：调用使用TransferRequestHandler处理程序解析运行请求。preCondition表示预先处理的条件必须是应用程序池使用集成模式并且运行时版本为 v4.0 时生效。<br>
ExtensionlessUrlHandler 的引入是为了满足当时WebForms应用具备现代 Web 架构对无扩展名 URL 的需求。随着.NET后续版本的迭代和更新，Web框架已不再需要此项配置便可实现无扩展名的URL。</p>
<h2 id=toc-2>0x03 JHSoft.Log.HttpModule</h2>
<p>我们知道在 .NET 应用程序中，HTTP Modules用于处理进入的 HTTP 请求的生命周期事件。通过自定义 HTTP Modules可以为应用程序添加日志记录、安全验证防护等功能。在企业级应用某和OA中，我们可以看到对 HTTP 模块做了如下配置，例如：</p>
<div class=highlight><pre><span></span><span class=nt>&lt;modules</span> <span class=na>runAllManagedModulesForAllRequests=</span><span class=s>"true"</span><span class=nt>&gt;</span>
<span class=nt>&lt;add</span> <span class=na>name=</span><span class=s>"JHSoft.Log"</span> <span class=na>type=</span><span class=s>"JHSoft.Log.LogHttpModule, JHSoft.Log"</span><span class=nt>&gt;</span>
<span class=nt>&lt;/add&gt;</span>
<span class=nt>&lt;/modules&gt;</span>
</pre></div>
<p>上述配置指定HTTP请求需要经过JHSoft.Log.LogHttpModule模块，从名称上看应该是记录请求等日志数据的，其实反编译后发现不仅做了日志的处理，还有对整个请求做了安全校验。具体代码如下图所示</p>
<p><a id=img1 href=https://xzfile.aliyuncs.com/media/upload/picture/20240516151244-b0cbcb74-1353-1.png><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAuMAAAEnCAYAAAAD7E2bAAB7o0lEQVR4nO29f5Ab13Xn+23MD8q2GEnkkH6S45UoE+BwKL9JpIbskvJE01byTMAUvRRVlWHilJNG2aU8R1UBdpdb1jrj2ZSz4tYC+yI7VkkFSF4r4aRCakKKBkZvJYuifq2tgeWdsjgcAhIpWbEUzQypH5QtcX7gvj+6G+huNNDdGGB6MPP9VKHI7nN/nNt9u+f06XNPS0IIAUIIIYQQQsiSE/BbAUIIIYQQQlYrNMYJIYQQQgjxCRrjhBBCCCGE+ASNcUIIIYQQQnyCxjghhBBCCCE+QWOcEEIIIYQQn6AxTgghhBBCiE/QGCeEEEIIIcQnOv1WgCwRb6Xwz99P4B0AgIz+Px/D9R/3VyVCCCGEkNWOxC9wLgVFvPh3IYxPaZvXZfGnd0Q0A3kYVxsM4/PHwzg6M6TKAQA5HB+M4tVyWwq2D6Vxraf+1Tbe+VwB/3ZH0Fa31/rsZO7axR0CO67zWJUQQgghhNAzvjQEcf3/I3A9dGPbbb0iXvy7KF7VjXfdqD++H9d6MZxfGsGrULDds7FNCCGEEEJaiWPMeEwCYikgLAGSBEhhoGiQF1Pafu2XM1bOqfvCYfXfWEwrFzP3kQob2rDIUDT0rf1ihk6q9LPoUFc/Xc2YuUyqaJbX1a+lFPHuFHB5j25Eq0a92YOdw/FBCQ9pv38+Xqxq5fz0OLCxD5db9x8P46FB1WP/zlOhum00joN+L8XKsof+LoUXDzW7f0IIIYSQ5YurBZyZYeCgAIQAlDxwwGDRBuPqfiGAQhKIWox1ABg4CCRlYLxPLYPxSplcDEj0V9pIjgPhVKVuah+QVypyIYB0xNy+Ub+kDEQNBrOTfrkYEB0HCoYyiX3u9WstEVx9nWooH3/JvsSZQ1G8ujGJ3UMCf/rnSaBOWSvrdozhT4cK6N8IXP65Av50SOBPh6zG/uKor18Oxw9lKn1vn8C4S90JIYQQQlYCroxxeQDQzbM+GRiftC8XjKvG+jGLNd6rVe7vra4zkgGS+yvbuwaA/ISl0Hi1gV9Lv10DADL2HnA7/UYygDJUqR+MA2Kssu1Kv0WRx/j3K57jo0/lTdJr7xDYfh3w6iFVbja0c3jtJeCa7XGsA4CPx9F/HfDqKXX0qudba3MqgaO6B/qQ3dFpBfX108Nn+nXj/7r96N+4RKoRQgghhCwDXMWM2xnROqkwkDDbj0i67b0IjAPIhICEcb9S+W98DJiQgJCk7ZCBgsFYtuoXtOhaVz+t/4FajmAX+i0ec2YTu5jya+8QuPYOTXZIwj9Pa4st35rEO0BV+AmmJnEeEdXzvUOrNzGA3f+PZhQvFU76LaUuhBBCCCHLkMXlGc+phm7WEELiyU4NAv0AlKw5DEWkzcXSBlkSQMgSt13LU++on9b/RC23u0v9anH+eBgP/V0K590Vd2TdjjFsvw54Z0ZT+OO91YYuAGzsXR6G7nLXjxBCCCHEZ5r60Z9iChiXvdXZowCZqH1YiR0TeUDuM+/LD1fCWFKDABQgYq1YQz+n/r3qZ2Rd3wAun0oY4qBzGH8qj2u22mlnRw5nbMJSKgs61ZjyV09oBv9bKYy/BA/tA0AQl280GPg19IhJEqSY16PgoN91e3ANMhjXF2y+dKCS/pEQQgghZBWwuNSGEW3BpBZCIieBAQCJEDCRBdw4kCNpIItKG4DqidYXacYkIGOsIAOFuLkNZQDYJwF6NEp2zKV+Efv+5SQwFnenX10+Hse/vWMCDx2S8NAhddflnyvg37rNyf3WJMYPRXHikGHfxiR2GxZYXntHAe/8XQhHBxPl9r3m/L72jixeG4ziId3wL6dSdMerhvGpVHKh19cvgh13KHjoUAgPPQXguiT6NwKveVOfEEIIIaRtafuP/sQkAG6NY7LMWcwHiAghhBBC2o+mhqkQshjOH9+H8SkZV/fRECeEEELI6oBf4CQ+on1RtBwnXglvIYQQQghZDbR9mAohhBBCCCHtCsNUCCGEEEII8Qka44QQQgghhPiE65jxcz99GD98fgZAD276k6/gM+tbqBUhhBBCCCGrAJee8WeQvP3reH7tl/ClL92CzWtbqxQhhBBCCCGrAZee8Yt47/wHwNorEQxe2lqNCCGEEEIIWSW49IxfjWu3AYcff7q12hBCCCGEELKKcPSMv/bwV3DHd/83LvvS4yh87bNLoRMhhBBCCCGrApd5xp9BYv0t+J///iX84j9ua71WhBBCCCGErAJchqn04XduAt5+7/3WakMIIYQQQsgqwqUx/nP89MfAjht/t7XaEEIIIYQQsopwaYwH8Znbr8PxR36IYvE1nJttrVKEEEIIIYSsBlzGjAPAOfz04R/i+Rl+9IcQQgghhJBm4MEYJ4QQQgghhDQTl2EqhBBCCCGEkGbjyRgfHR1tlR6EEEIIIYSsOugZJ4QQQgghxCc8GeM7d+5slR6uKT4VhjQUQ65BeXPJITYkIXZySTojhBBCCCErjE6/FfBGDgdO5KHsHUOkIbmZ4lNhhE7kbSQykneOIb5xUcouE4pI3RdCYkrdkrcXMPa5YPPqn4xBOpwpb1a379S/z3JH/eswlUL4vgRMM2hjEoU741BbyCE2FEXGUq3ch019Za9AupkfuV3M+AghhBDSekQbUTguC3w/KQoNyuu0LJLfh5CPe62ZFcq3IZSXPHe4ZGQPoXJM3koK2aO+devbbssi+Zb7/n2Vu9C/LlXl1XmEQ1lLwRrzy1pf08f7PKyn3yLGRwghhJCW00YLOIs4dioPeesu2Pv1nOSNooaiSNov/FSxfunDEqTDxiCZIlL3VeqbZVqYy1MphHX5fSlU96DpcNhr8E0OIycB5RbNU7sxjqFtQOaU1s6U2m9lTJquZR0c6m+MY2zQ4MnduAsDG/MYnii6699vuaP+Xgli11YZmJ60OYcu2BjHwe0y8qeOWeo3eP6bPj5CCCGENJv2WcB58gASUwqGar1id5I3SO5wFJmNSRQGBcSdSeBEqE6MuGr8yT1BQ/0QEhuyEIMCYrCA5HS0yqDPnAIODgqIwSyUqQQONCsGfWoS45DRtwHAyRxyAII9BmNxYxxjexXkT+xDagooPrUPCRjCLJzqV1HExBTQvyHorn+/5U76+0CwbwDy1DCOTbWidf/HRwghhBAzbWKMF5F6OgN5+/4aseBO8kZx8rxaSh+OIgPjA0EOIydlJG/RtVI9p/kZsylY8eYH0bcRGJ+2mooRpAcFxF6Po5ueUOORp1MIH44iaud135ZGdlseifskhE4AydvjlTcLbuobOTmCjG78uqnvt9xJf8+ob2ewobfJb2caPP9WFj0+QgghhDSb9sim4pNXXPWs2mDxrGYOqyEm0ZMyknemKw8EU5MYh2ro6mEqdgtGW+ap3NAHGQA2qOEK4s64rZEY2ZuFAkDeftC8aNVlfZUcYoczwLahShtO9f2WO+nvCuP5DalvFhZrNLeERsdHCCGEkFbSBp5x1euNbXvqesVryxfBxl702+23eD6VvVoIysY8Eo8YvK9afVVu+C2VsbaxF/3IY2K6sqs4U+25VT36KIereK1fzhqy0WKIOtX3W+6kvytkJO9Uz2u2CVlQihPDyKMfvU01mBczPkIIIYS0kuVvjE8dw/CUMdTDo3xRRLBnG5B5WjOwp1IYPAkoW+36CiJ+exKyKeZbq394sXnPG13A6UL/kzHNoy/UcBXjw4Sb+lMphIeiyGzL2niener7LXfS3xuRW6zn3yNTKew7kbcJt2r0/KOp4yOEEEJI8/GUZ3x0dHTJQ1VyTyeQ35bFWA1PoZN8sUT2FpC8L4TQUAKAmqe5Zh7ojXEMbUsgejiGPdvUcJXIXoEsJESHKrmem55Lug519Z9KIXw4A3l7QQ1d0Mveh/IizvrjzyGm58k+GYWkG6GGXNtOx89fubP+ntgY
<p>Init 方法用于初始化自定义的模块，并注册一系列事件处理程序，其中AcquireRequestState事件在获取当前请求的状态时触发，常用于检查请求的数据。具体定义如下图所示</p>
<p><a id=img2 href=https://xzfile.aliyuncs.com/media/upload/picture/20240516151257-b87c4aba-1353-1.png><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAz4AAAEaCAYAAADQaYLRAAEAAElEQVR4nOzddXgVV/rA8e91ibsbCRCc4O4tUkqppu5KHWhLlXqBlpY6VKCl0BaoAMXdLThJSELcPbm5rvP7I0DxFtnd/nbP53l4djN35sw7Z+buznuPySRJkhAEQRAEQRAEQfgvVFVVB4D8PxyHIAiCIAiCIAjCv5xIfARBEARBEARB+K8nEh9BEARBEARBEP7ricRHEARBEARBEIT/epeV+EiSB4fLhtPjOW27223H7nZxubMmuD0O7C4XYvoFQbgyPB4XVqcND4Ak4XRZMTvM2FyX/309k9vjwOIwY3Ha8ZwoXHJjdZgxOyy4xBdbEARBEIR/I+XlHGwxH+HFxdMYOfITRgYFHd9q4MdVD3Ms+iVe7tQJzRnH2JrS+b1wLzb3iZceL/onjyVJpz6r/EPZb/FFUTu+Hn7r5YT5t1itJWzKXUetLJA+CSNI9Doz8hNclFVsYV1VEXrfbtyY0B65TAaAuWEvCwuzaRk9hH4hEXg8TWzJ/JVCt5KU+Jvo5KcDHOQUrWZ7fS1hIYMYFZ0AeKit28f60nQkfWtGxvfET6XAZi9nc85qqmR+9I6/hpbeGsDG/mNLOGSykBh1LQNCg0+JzUZu8Rbs/oNo53t2feI2sLdwE0ea6gEZMWHDGBgZRX1dGpuKM7AAMrmKLvE30lpVypLsbZgBf9+2DI3rie8lPS128ku3YvbuQwd//TliMnKgaCMHDc2zbUSGDGFIdBw5xRuQB3SljY8fblshW8ob6BaXgo+ritWFW9H49aFfeORFPsBuqmr2sL4sC4V3O0bHd8NLeb7c38rurF/JtDpJjr2B3kF+gJPS8s2sqyrBy78HN8W3RSaDxqYMNhamYVXHMjR+AGFaFW63gS1Hf6PIraZL/A109NOBrZzlBZupttkIDx3CyKg4wENN7V7Wl2WAPplR8T3wVZnYcXQV2TYLKH3oFjucDn4+gI29Ob9zxGyjZfR19AsJPG/s2zIXcsx+4gcJH4a1u4kYNVSU/MRtSxbw6VPL6CQ52ZE+g6+O/EFDwGP8MPougs5T4vkZ2J65khy7leCQIVwbHXd8eyMLNk5kQbWNNlHDeLzXvcSobRzL+Zwnd6UR4R/L40PfpZv3372DEvUNhzhi8WFgVOJFRwluKqt3sb48B6V3B8YkdEGnOP+933n0F7JsLtrG3UTPQB/ASUnZJtZVl+Ib0Isb49sAEo2GdDYU7cWmjmNYwgBCNUpcrga2ZC2m2K2hW8INtPfVAkb2Zq/hiCeAa1v0I1ijBtxU16axvuwocn1brknohrfSxLbMlRyzW0HpR4/Yq2jn5wNY2ZP9OxkWO61jxtInOOAS6kAQBEEQ/rddRouPRHb+IhzRN9PXP+jktsaK1ay0teXeNmcnPQByhRdhXkFUFc1jSaWNCJ9QdHI54MZib8JgM2B1e846zu2yYHG5AQm3247RbsBgNx9vbfJgd5iwOCw02ZqwnPLrtUdyYrJbcF/w12U3q/a8xrIaC9aGNUzb/RtGlwe704zV5QY8WB0m7G43DfV7eHPLt8hUEhvSXuH3SjsAmQXf8PjvH2H3CcdfpQY8HEl/l1kF1ejduUzb/AmFVg+V5ct4e9cyvDR2Fu14lQ11buy2Sj7bMoVip0TG0Rl8k3MMcLNh7+v8VmnEadjC1J0/0+D0UJg/m/cP78dX1cCsLW+xz+DBZjrGlM2fUuSoZ8ehj1hTZTn3ZTqr+HXnTErkEYR5qZi9ZTK76hpQq3wJ0nn4bd8cDFIA3ko5lsadzDm0DZUmgOxjn/Pmvq3NrQQ0txKYnI4LPh12SyEfbvmYY9Y6dqd/yooKw7l3dNWwZM9X5EvBRPjomLd1Mptr6jiQOZdFpfkAVBbN47OcHFwyCVNDGh8enM0vu3+h2nmyGQGXy4rJab9gTGZzPh9t+Yg6SWLfkWn8UFAGkguzw4zDI+HxODE5LLglD3k5n/FhZjZ+yho+2fQOR4we6ut28vqW71BpJNbufpGl1W4kycX3m19in1mitGg2Hx3eBXg4eOQdvimsQevKYtqWzym22NiR+SmLSxuJUFtYtONzDlk82KylfLJlGuUuiSOZHzInrwCoYvGuzynxRKCwH+Dr3b/R5PJQkPcVHxw5jK+yji82v8WBprO/J80MrDgwmyZ5BBE+EUT4hKKRgctlQeXXjVdHvEAcgFzNwM4v8mnPG884XsLtth3/jl3guyPZOZT5JTOO5RHh4+H3rW+zrroJCfDUbWFBZTBvXT+HKQPuJUYNkrWYmfsO8PC1M5lz3bTmpEdyYrQZMNgMGB0Wmn8PkXA6zRhsBpoczffU7baQVbSILw5vxGAzYHI6z7j3F34eTcYcpm/5BAMSaYffY35h1cl77/RIeDyOk/c+N3sGH2Xl4a+s4qON75Jp8lBXs43JW75Hq5VYtetF/qh24/HYmL35FQ5ZJIoLvuHjI2mAh32H32ZOUR1qRzrTtsykzOYiv3AnmaYqftr/BUUWKwAWSxEztkyn2i1xIOMDvssvASr4fdcXlEsRYEvjq7QlmFwe8o99yfSMDPyUtXy66R0OnffeC4IgCIJwPpee+NiO8VtOIVe3G4av4vg2t5G1RzfRstVoWpyjwQFA7ZXAkMRh9AiKJD6kLyOSBhGlUVJfs5DU727h6eW3Mm7TAqpOe4e1sHpTKs8ezkWS3Czd8xxPLXucB5Y9zsyjB4BSPl40nLtXvsf4lXczbu0P1Lmaj6w3LGPI13dzsLHp/NfiPMLmYis3J9/BVW3vprF2I5XWSjbtfpZ7NvxCad12xv36FCuqKsivXAcBo7kudgwPt4piXs4OHNTyzdY5tGt3NQqrFW+VDlxFrMg8zNjOjzMw+XGinds53FDCwcJ1RMTewcj4VG6JlPi14CANxi0UuTpwU8IYUtv0YV3BJmzOo2wsaOCmdvcwrO29OBo3UmIpYUv2FronP8SQpAcZ6F3EuopjNJpz2V1biM/fup16usSPYGRSKl11Bo4aGwjwTWZAi/7E6sPoGTuIFl4aQEaAT2sGJY3lqa63Ulq4jDwngJW1u8Zx1fJ5FzyLyVLIrupj6P9mTJ3jrmZE0q308jaTbqilS4v2FJekA2b2F+8iKaYPATI3h8t30TEqFa1rLwVNxuPHO9i09xkGLv76gmepbdhEjaInN8SP4c7kzizL24Ldns+UpXcxLfMIaUc/5v5l0ymzl7H26HYGdRjHoFbj6K7OYFt1Ibnla1EEX8eY2DE82iqc77N34rDvZG99BKktxnBtu+vYV7wOi6uAlUczGNt5HIOSHyPMsZ0Mo4E+Xd7j66seY0S7m0hRHCGtxkyDYQtlnhRuTBjDrW16sjp/MzZApfKla+wIBoYlUWXMw+qsYWPWVnq3fYQhLR+hnz6PjZV5nO/1V6cNo1f8CEYkjWBE0gBCVVBc+B3Pr36Wh//4iKIL1JPbZeKn7eN5evkT3PvH48zPyz73ftYKfjhyjHsGPMKIpAe4NUrGL/lp2CWorc/B6deGWK3q5P4Wax1F+NHB50TLn5PivE+4ev59TFw7kXf3zKPUBmZTBu+uepiJa5/mtiXPcaDRSlXpb0w/vJr9hT8yce1EPs86eLwMG+v3PMmQpXMueO+r6zfRoO7L9fFjuDu5PUvytmK35/HWkjuZfjSD3Rkfcv/yGVQ5SlmdsYOrOj7OgFZPkqI8yPaaInLK16AOvYkxMWN4OCmIuTm7sNl2cNAQzS0txnBdu2vYU7QOqyufVdk5XN/pEQa3eZRA2zYymxpoEX81NyWPIvqUX4PqGzdTSTduSBjDHW26sDJvM3ZApfKja+wIBoW2oLKpALurmvVZ2+jf7jEGtXqM3tostlTlX/GuiYIgCILw3+7SurpJLjLyfqPUdyQvhnif3GxoOsKGehWPdE++yPIa2bD/Jzr3/oLJbX15
<p>代码中对aspx扩展名做了深入的处理，通过 context.Request.Path.ToLower(); 获取请求路径并转换为小写，然后text.EndsWith(".aspx") 判断请求路径是否以 .aspx 结尾，如果是则调用 SqlFilter 方法检查请求是否包含敏感字符，这是一个防御SQL注入的方法。<br>
这么看如果是.ashx或者.asmx文件有注入漏洞则完全不受该约束，可以顺利的进行SQL注入攻击。<br>
如果没有注入的风险，程序会继续向下执行，通过 if ((context.Session == null || context.Session["UserCode"] == null) ... 检查会话是否为空。接着通过类似这样的判断 text.IndexOf("/jhsoft.web.login/password.aspx") == -1 排除特定的页面，除此之外所有的请求都会被强制重定向至登录页。这里和某通一样在此处定义了很多需要排除验证的文件，如下图所示</p>
<p><a id=img3 href=https://xzfile.aliyuncs.com/media/upload/picture/20240516151331-ccbe4db6-1353-1.png><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAz4AAAHOCAYAAABZxtzoAAEAAElEQVR4nOyddXjVR/O37+M5cSPuCQnB3Z1StNBSWopboUDR4lKc4m6lxdtCKRQp7i7BIUBCiLvrSXL8vH+cGBCkLX36PL+Xz3VxNd2z39nZ3ZnZmVWBwWAw8B7v8R7v8R7v8R7v8R7v8R7v8X8Ywn+bgfd4j/d4j/d4j/d4j/d4j/d4j38arw18dBpIjIKMghd/MKaHhEBCBuhfs2Zk0GtJTwgnJCSEjAJ9KQllLjGRT3kWFUu++u9U4f82dMocclOT0f7bjPwdaCAhxigviemgK04vhNBQY3qO6u1IZcZcZur4qQQnFZZJVXH/t/l8vfrYO2b8/x+ocxJR5OShf3PW8r9XZBD5LISQkBBiUrLR/VVC/wp0qFLiUOb/eS1T5STz7Kmx3vEZ+f8Ab38DaoiJNOpXSjYUm2mdwpgWEgL5utLsmoJsosNDiIxJ571Jfh66whzyklLR6d7tBgltXiqZISFkhEWjKhI/vUZJcuwznoY9I1v5dnT0yjwU0Ullxgk9mqwU8hIyi/5fRWFcPOp30bE6FYXxMeSEhZOfnvva8f/vwYA2N42C9Dzeal+KMoucsDBywmJRq//eiKlTZLzQnm+GXpGGIiEL3Zuz/tdAr86nIDkFnea/x2DrNIUkRoXwNCyBtxT/9/iPQ0t+fAzKwncs7dp8cp49JSPkGYrc0t7PS40mJCSEhMzC13xcCoNeizIpnkKFkvJMx2sDn/wUmP45bLv1fHrERRg7DjZvhgvB8LqxIDfkDJPGjWPZxs08TClSLk0hN39bxZiZi9h98CSJireqy1tAT0bkLf44fwfNXx6gDGTHP+TomesoVG/TqZlEX9jDw9M/8+jCZd6165P77DCnV35H2jum+x9FPpw9DLOHw7TNlLZRBmxbD327wKHItyOl1xaQnpqOWlu2fw2oFBmkZv2nHE8loWf3cCni7wiuiohLv3M2NPst8hooSHtA6OmfeXh6D1Fh0Wj+RsnlIfrYNC4cPs+Lcxxvi7jLm+k+aBibN2/myI0wNHpAmUzCgd9IfhRG9B+nKVRrQZlEwsFT5BYVlH33DOkxOe+qGuiy44n7fStPNm7kyW+nKMh5m6Ezm/DvRvL0Zuars2hyST97gIQHMSQcO0hWci4AmeFX+XnrWr7p35lxW4LeTSXeFXLh8F6Y2B8WH6QkmFHGw+ZV0O1DuJZXmj0/JYwjezYz7avR7LsZ9Ybgx0BOQjC/blzO8nU/cOFpRlG6mpigI6xbtZzlOw8T/4aBSpEWxomT58n4C0FnMZS5sZw+doKk3DdphYrMG8e5u3w5N4v+hQe/nWXNe/QHp2euIDf7z0YOehTPrvBg+XJubthC/LOyMpbK4/kTOD93HcE7/yC3qKlir+xm/ORprN++i+LshWGXiTl3j/RLB4i/G/eCc60h9+IOgmb9QmlrF5Cy+ztOT/6p6P/DeTB8NAkxf5L9l6BFcf8Pbk1fxLOf95BwPxqdXkdB+E1irj35u8RfgJr0o6u5vfEc+rcZitNDCd+8hiu9pxCbmP23Ss69tJmLveeQ9fZfkLRpCnd3P3nntvmfhCruGrfnLiU77S1nHt91+bG3iD55g4xrh4m5Ho0OUOelc+HgZuYMH8b3xx7yztzDPw0DWZEpnN8RyrV7eW/OjoKzO1axfPlyNp9+XJKak/ioyE5u4nxoxmu+B8jn5tE93E94Owe/fBRw/+Qebsa8eTRXZzzmURl7eP9IEBr12wTBaQSN60fogz8/dhsMyYQUlRd8/mmZX/JJ/WMtJyYs4cHmX4iPSC8q6hHfTRzF3LWbOfc4pShrDDG//0HavZtEHQ96See0WU94OGkm8U/L1+BXBj56HYgtYfQK6Fa1DNMK+GMPVB4Iy5dD75YgeRUVQzandnyPded5rF2xnFbeYgAUmU/4/Uwovcct5NuxQ6hoW5Rdr0WtUqJUqtBodUWzPAa0ajVKpRKVRovxSJIxTaPRoFIqUWt0GAC9Tk3sw9Ns+/08eQVKVGot+qL8Oq0alVKJUq0xphn0Rhq6InoaNRqtHr1OS9LTy+z87RjpuYWoivOXi0KSrmzjcZQSOzdX8kL2EhlpFASDQY9Oq0anUaPXFwmSwYBep0GnMabrdHpjHcvk1WnUJTNoep0GuVtzGvf/CpvSRsWg0xrzajUl7WHQadGXpBe30yu6RadFqVSW+adGp9ej06ifS1epNa9cATAYQKMGtRpUKtDoKOoD0GiNv+u0oNUB1tBvJHz90QtE3GDxLGhR7ZWs/iPQaYvrqUJX1E4Ggw51Ub2Lg2aDXodGrUatVqNUqdHq9BgMBrSaHG7tXc+h++lF+fVFNPRoVEYaaq2uhIZarUGvNxT9bWxrrSaXB4e+Z+/NxKL8rzY2BkMmwYc2k6O3w8JSR+S1w+TmqnleFsr0+SvkyaDXlsqeVovBYORZr1Xj3Gws9Vs1wKS0VPTFNHTFXocevVaDTqspld8yfEqrfcTy5cv5umt9TMRAQTzRW78n+UkUEXtPUqDSQkEc0dt+I7toNMu4/DvJYZlgMGDQatCpVMZ/ZfS/JF1dVEeDHr1GjU6jQa/RoFOp0ev0GDSFhH03kfhYAVb+7hReu0JSdLqxLpoiGpoy7aTXldAtWxGDXodOrSqhC4Amm+T9W4m5FU3SsYOkxWUD4FznU+bMnUuvVpXLtF350Os0L+md3qBH+4LeqdXacmepjLJQqndKlVG/DIBea9Q7MK7Ua3WAPYwcD31bP0/DrBIsnwm1fJ9Pt/auz8jpyxnVx4m9a3eTnPNqF85ggNM/reRahgUO+jB2bT9BqgoKE4JZ9eMhJM5OpF85xP6gV3vaBp2W9Ni7/LJrP/EZ+UZ7ozfaM71Og0qlRKlWo9MbwFBqo4vtuVqjQ6/Xkp0Swq8/7SI8WYGqOH+5EGHi6IFtgA3Rh/ahtfHHylYO6NGrjfKkVSrRFY0nGAzoNWq0SmWpHBg5R681pmvVmlKZVKvRF40neo0anVaPXpXAzQVLyJW4Yi6P5uZ335NZ5GQawi/w5KY9Db5fRcv5o6lgARjSOfjLb1TvNZ9l82dRz8VYYv6DY4QdukZW0DEiL0U+F/joFRnEX3mCY5+PsACjXKuF2Lb7ksYTujzHd7Eu6bX60jqWq3dFbaJSGduj2E6q8kk5eg3ph32pM2ca/h9UR4yKvHuneXr05ss69mKf63XoNVrjeFX8X62RvqFEH9VFclDyEXq1Cl1xW78Kbo2oM3EEDv4VXiy1tI7l6r8Gvaa0TL1GhWnNT6i3dCRWz/GtQadWl/BnKENfHXmL8PsWBA5phElR25XaHKM8GYrkqWxaaf3UJX1QzEdJe6iK6w4GnQa9VmfkV2e0xyU6U0L79XayrK3Vv2bcKWVPW8TH8/1i0GlL+dMUjSd6bWk7qYp8n6J6G3XI2Bd6rbH+qmfnCfvtDNl3ThJ++ilaQG7rTq9xy1m2sgvnF6/iXsxrJjT1OtQqVRn7qSry4162tbrXyU450CrzeXwhE0VKMudvZL8xf/rVraw4nYWft4gT67Zyv+iTsz+v5Gq6OY6GcHZtO0bKK+biDHo9GnUmp3au51JYFiqVCm0ZX0StUqJUqUr8Db1Oi7rIxzX+rUFv0KNRZ3Np13pOPcl4zp8pD0ITW2xr+pJ/eScJBe7YezogFGLUF40GnVKJVlWqdwa9tsjulbVARX6ISolWVWQDi+1Kke0waDVFMpJL1LpveRRjhkNNGyKXzCbkfpZRPzKjefTTY3xnz6X18tlUquUGhgKCfltDjP9QNq5eTt9mXsYiFWGE/bCD9OB7PN13+YVJOgO5l39H6dcJt2rOCMqpt/hVDRJ3GWashaCrMHQPTGhhTFflQ4wGmnq/si1LkXSb/UF2DJ9WE9MyJWUFXyBG2JDRVZwQFHGlVeZxdsc8Np98iEoh
<p>比如我们选择其中的一个文件名作为测试，访问 /jhsoft.web.workflat/isconnect.aspx 返回了预期的结果，并没有重定向到登录页。</p>
<p><a id=img4 href=https://xzfile.aliyuncs.com/media/upload/picture/20240516151409-e3ad605c-1353-1.png><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAz8AAAG3CAYAAACaKevfAABwH0lEQVR4nO39d5xc1X3/8b/OvXfK9r7SqleECkggugDTmwBjAwYbMO4xtpPYMU6cfPP9xl/HP/9+yTcuSWzHcYnBxthgbIppBiE6BkSRhHrvbVfb28zce8/vj5lZVtLuarU7i4Tm/Xw8Vtqdcu+Zsjv3fc85n2PWbt1pbRgS2pAgCAj8gDAMsdb2/J/+Cgmz32cuD4KQIPAJUwlGV1dRVFSEDE13dze+71NYWIjjOPi+TyKRIBKJEI1Gj3bzRERERESGZM+ePXQkAjwvguO6OMbBmPR1JvvNsJj09ozBGJPevmNwHAfXdXEcF9dxMI6DZ63tCT5tra00NTUThiFh+G7IsdheIchiQ4u1YG1AEASEfopkVzcFBQU5aHye2990tFsgIiIiIpIzjY2NdCUDXC+CYwzGcYBhBB9ryWwg/R+m50djTDr4GAfHcSgrL6WkpBRwcSETfoIQ3/dZt3YNq1dvpLRi1BG3Ydvu1qE1XkREREREJMdaG/dywrSJnHTyXCAdkrzs8LYwCLFhyMyT5jP/7EuPclNFRERERESG7q0/LyLRvgc/CHAcl8CEeNn5PmGYntPjHu1WioiIiIiI5IANQ8IgIHCC9HC40PYqbhDao90+ERERERGRnAhDm65REKY7exxryRQwCLEo/IiIiIiIyPEhzE7xyXT0OL2ruPVUThAREREREXm/y07vCdO9Px49aSgTgAbJAFEv/eW5EHHB6adanQWCEFJB5ssHP2BI/UwGiEegKGaIR6Egkt43uSgRLvI+EYbQnYKuFHQlLe3dkLNRq/aA/3qYnn9ERERE3h/C0PbUNrDYdLW37CKmgw0/EReKYhCPGAZTntsATiYgQToIdSQs3an094MVcaG8EKqKDZ6rozDJX44LxS4Ux9Mdtm3dUN+W/p0acgdu9n7mgP8OezsRERGRY5dNB59MCPIOXMR04LsaIBaB4pjBcxlU8OmL60BJ3BBxob3b4g8iAMUjUFtqKIkPLnCJ5AtjDCXxdC9sQ5ultevIeoEsR9irY96930EXiYiIiBxTrLXYMOzp6HHeDT6Www1Ei3jp4BPxhh58soyBgigUDyLMuE46+JQWKPiI9MWYdE9sdYmhKP4e7fO92Y2IiIjIkKXLGrxb38DJfnO4nh/XgcJoen5PLsUj6RA0kIqidE+RiAws5hkqCg0x7/C3zZ7uGM5vlsl8qVSKiIiIHJN6FXfLlLoe3GFL1IXYIOf4HAljoCjaf7GEiAuVRerxERkMY9Lz8Ypihwk1h+/oPTIqFikiIiLHoN6j3CzgQeagZYADF2PSQ976CyjD5Tjp7SdSh15XMMjepjAM2blrN4ufe57GxiaCIMR1XWqqq7j8souprqrCKEFJHnCddCVEt2vg+XT6bRAREZH88G5V60EMjkkfJHnOyDXHABEHEn1cF48c/iDNWsvi517gqacX09TchOM4xGIxursTrLKWlStXc911V3Pm6acNqj2pVIpE4tDWdHd3D+r+juMQiUQGdVvf9wmCYNDbHeztotHDjCXMSKVSJJPJQd02DAdfETAbNOPxOGVlZYO6j+ROzEufVKCP8GMBTG7DjzG5GUYnIiIiw3fvL37A/ff894C3+Yu/+l9c+cGb36MWHerxh37Dnl3b+fBHP015RdUB17U0N/LgfXdRWVXNtTd8PKf7HVz4Mbmf63OwiEef6acwNvChlLWW5154ifsfeJDKygo+9YnbOGn2bPbtq+c39z/A+g0b2b13L/fcex9hGHLWGacftgcoOybw4MsGG1Kstbju4J6wIw0/g+m9CsNw0OErCAJ83x/0bQcr284gCLDWHtBuay1dXV0UFBRgjCEIApLJZM9zXlBQgOM4Pc95NohGIhEikUjPtsIwJJVKsWbNGt58800uvvhi6uvrefnll/nMZz5DUVHRoNvbl6amJi677DJOP/10/u3f/o3CwsJhbW+wgiAgCAI8z+sJvGEY4vs+rusO6r0V89Lz9IbrgV/+J/v27uALX/uX4W9MRERE3hON+/dx022f5+oP39Ln9Xf/5Hu0NDe+x6060EmnnMErLzzNA7/+KTfe+jlKyyoAaGtt5sHf/g8b1q3kL/76f+d8v4M6PDKkh9IMJPB9Ojs7CIIDD6STySQdHe0Db98Y+lu2x3MY8IB/9969PPjQHxlVW8PX7/wKZ55+Ghs3bebXv72fzVu29tyura2dRx97kn0NDQO2RXJrz549bNy48YDLdu3axfXXX09HRwft7e386U9/4o477uCaa65h4cKFrF69GmstHR0d/OY3v2HhwoVcc8013H///T29b9Zatm/fzre//W327NlDYWEhruv2hKUjWbC3P3/4wx/4f//v//GjH/2IaDRKa2vroHv/huOFF17gm9/8JmvXriUMQ4IgYOnSpXzrW9/itddeG9Q2PNf02wOTLVIwGKlkgsQgH/ORbFdERERGVrygkJLS8j6/YrH3qDTsAMZPnModX/7fbFi3kt/9+ic0N+2npbmR393z36xZtYw7vvJPjJ84Jef7zclgNmstO7Zv475772b1qhU9PQmJ7m6eW/wUv/vtrwbdu3Ck/vjHx+ns6uK6axdSXl5GZ2cXq9euZceOnYccANc3NPDM4udGpB3St1deeYXf/e53B/SkPf/883zpS18iGo2yaNEinn/+ef7P//k/LF68mMcee4zVq1eTSqV47bXXWLduHU8++SSLFy/m1ltvpaCgAEj3hKxfv55x48Zx+eWXc/PNNzNu3Lictn3Xrl09Q/YaGxt54oknWLNmTU730ZfS0lK2bt3Kd77zHdavX8/y5cv53ve+x65duygpKRnx/Q9HrusoiIiIyPFr7ITJfPGr/5f1a1bwu3v+m/t/+WPWrlrOX975TcaOnzQi+xzUsLfDsdbS0tLM008+xtK33uCzd/w1U6ZM4/lnF/Ef3/3/cuppZ5JKpfC8nOzuAPvqG4h4LqeeMg8A13WZPnUKnuuycdMWNmzcRCqVrqTg+z779zflvA3Sv4qKdBdmEAQ4jkN7eztLlizh7//+79mxYwfr16/njjvuYNKkSQAUFRVxww030NHRwcqVK7nwwgt57LHHqKysZO7cuVRWVgLpuUrPPvsst9xyC42NjTQ1NTFmzJie/W7cuJENGzZQWlrKGWecQVlZGfX19SxbtoyWlhYmTpzI/PnzSSQSrFixgq1b072EJ5xwAjNmzOC5557j7bffpqysjDAMaW9vZ/ny5TQ1NVFYWMjkyZPxPI/W1lb27dvH9OnTSaVSNDc3U1RURGFhIb7vE4bhoOdfZc2fP58vf/nLfP/73+df//VfSSaTxGIx/uqv/oqTTjppeC9INpn000XT0ryf3Tu2HPBzd1cHa1a82XNZRVUto+rGD2n7IiIi73fvLH2dTRsGPhk6/4xzGTch970Wx6PxE6fwsU9+ia/ecROu4/Jv//Vbxk6YPGL7y0kacRyH6TNm8snPfIFf3vUT7vr5fzFjxiwef/Qh5pw8j89/6W96ztjnWhCGWODRx58EDJ7nUlVZyUUXfoDZs2by9DPP0tCwn4ryctauW0cYDn7eigzfpEmTmDp1as8cpJUrVzJ+/Hiqq6vZsGEDGzZsOCC0ZCWTSV5++WWqqqrYuXMny5Yto62tjYsvvpiioiJ27dpFY2MjU6dOZfXq1SxfvpzLLrsMoKdHaOvWrbS0tGCt5bzzzuPll19m9erVuK7bE06WLl3K008/TSwWw/d93nrrLa6//nq2bNlCW1sbu3fvpr6+nu7ubhoaGohGozQ3N/f0ZLW3t/Pmm28yYcIEurq62Lx5M3V1dcTjcTo6OnBdl0gkkl5ReJAFKyAdgC677DK+9a1vEY/H+cd//EdOPvnkHLwiA9u2aS2P3PfTnp872lsIw5DFj9/fc9nJ8xf0H35ERESO
<h2 id=toc-3>0x04 全局绕过权限验证</h2>
<p>经过上面两小节的分析得知，某和OA支持像MVC那样无扩展名的路由请求，而在全局用于检查的AcquireRequestState事件中错误的使用了EndsWith方法判断URL请求是否包含.aspx，因此我们可以构造出如下请求达到绕过全局的校验，如下所示。<br>
/c6/JHsoft.web.Workflat/SetImageModule.aspx/id/121212，或者使用 /c6/JHsoft.web.Workflat/SetImageModule.aspx/?id=2222 均可以实现未授权访问。如图所示</p>
<p><a id=img5 href=https://xzfile.aliyuncs.com/media/upload/picture/20240516151650-43b12b82-1354-1.png><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAz4AAAEACAYAAAByJKMsAADKWklEQVR4nOzdd5xU1fn48c+dvrO9911gCyyw9N5BELH3gmgUW0xi+cWYRL9JjInGGE2MPVas2BURFVF677D0pWzvbbZMn7n398fC4Aosuwgs4vN+vXjp3Ln33Ofend3Xfeac8xxF0zQNIYQQQghx1mlsbKS0tJTU1FQsFgsHDhwgLCyMpKQkiouLcTqdZGRkYDAYujpUIU45xefzSeIjhBBCCCGEOKsZpMNHCCGEEEIIcbbTdXUAQgghhBBCCHGqSeIjhBBCCCGEOOtJ4iOEEEIIIYQ460niI4QQQgghhDjrSeIjhBBCCCGEOOtJ4iOEEEIIIYQ460niI4QQQgghhDjrSeIjhBBCCCGEOOtJ4iOEEEIIIYQ460niI4QQQgghhDjrSeIjhBBCCCGEOOtJ4iOEEEIIIYQ46xnafXffHHQLlh1+rdOjTf4DWo9o0CmnOLRj0zQNnIXo5s+BYbeipYR2WSxCCCGEEEKIM1/7PT6NBei2b0bx6iAkCEry0L98P8qB8tMU3rF4UFa9i27lt9Di7eJYhBBCCCGEEGe69nt8AIhAHX8Lav/uKJ/dj25hOThaQPWj1a1H/+H7oBjQ+s9AG9EPFA2teAH6LxeA3oiWMRilcANa/5mo/XToXnsRJfd61HFDYcd76JYUoF0yEy0pBq1yJfrPPgOdBW3Q9WhD+wB+WPUcuq3FgB56no8aVYJu1VrwNKOb+xe0httRR/Y71fdKCCGEEEII8RPVgTk+DpQ9y9Etm41uewFa9ki05CTYNxfDUw+APgaCjeg++iO6leshfw6G//0TpcYO1mCU1bPQbV2LUtMAfhvKjlUo5TWtTTfsR7djM9hbYNfHGJ77OxhiwOJH994f0K3Pg81voP/8MxQtBMKi0IKCwBQMFgsoOrBGoplNp/YuCSGEEEIIIX7SOtDj04SyejaK5gXrAPy33oQWGYSycik0uVBaatG8LtAaUHbsgIat4FBQr/s7Wr9oWPk0yieft38Kvxt2L4fmg+0Z7KDVoezcBT3qwa2BvR7iJ6ENHYxmHIRauRt91SrUyf8PrVfUybkbQgghhBBCiLNSBxKfBNSbHkXzLkX/wXvo1qxDPX8ySkMFEIwWFQsm0IamQnw61K8CnQ6i4tDQUIIjjt+vpPpRbNWghLS2Z4xFi+4GaT3QBg5HbQDd+q/RLd6MUl2G/xc3//grF0IIIYQQQvxsdCDxAVDQcs9HXbcS3er3UHJ6osV1A10d9L0KNTcRKgogOBY2RIF/D8rmpSiRuSg7V0Gg/oCuNQkq34/mKEG3p+jgZgNaTCro90C/a1B7x0HpAYhOQwkKRptyO/6cAejm/Q+lvgwcblCUgwlTDZo3DIwdvBQhhBBCCCHEz06H1/FRLOmoV8wEXz66r2dDz+tR+8Sge/NGDL+bgv6tV8BrgSHXo/ZJQvfNH9E/cC26Ch8crHytmPqgjegFBe9gePgelBZf6xt6CwybjpYZhO71GRh+dy76994Brx+W/Rv9/edheOYhlBID2jmXQVQkpOaA2Y3u7V+g+3LFqbg3QgghhBBCiLOE4vV6tWO+21SEUtaAlpIJoSFoqgtl/1YUvw4tfQh4ilDKqwDQrDGQ3AMMCtgKUCqqW6uzNW1A//6baJP+if/8kSjNZVBRBqZoCAalzo6WlgXBVmjYj1JZ29peSDwkpkFTIVTVtOZOhmi0zAxQFDR/C0rRXhS3By06C+Jkno8QQgghhBDi6NpPfH4kTVNRtsxC/05r4qOeP7J1iJoQQgghhBBCnEYdHup2wvRmsIbKHBwhhBBCCCFElzmlPT5CCCGEEEIIcSY49T0+QgghhBBCCNHFJPERQgghhBBCnPUk8RFCCCGEEEKc9STxEUIIIYQQQpz1JPERQgghhBBCnPUk8RFCCCGEEEKc9Y5YXEdTVVSt6ytcu71+nB7/aTlXeLAZg/7IHNDv//Hn1+v1R2zTNA1VVX9022caRVHQ6SSXFkIIIYQQZ542iY+madTV1dHS0tJV8QTM3VTOSwsPnJZz3XfZIGZO6dNmm9vloqq6GvVHJD96g4G4uDjMZnOb7TabjUab7YTbPVOZTCZi4+IwGo1dHYoQQgghhBBttPl63maznRFJz+n2/LytfLpqX+C11+ul+kcmPQB+n4+a6uo2PUdNTU1nZdID4PF4qK6u7uowhBBCCCGEOEKbxMfr8XRVHF3K5fVTXnc44dM07aQMcwPw+Xxo3xs66PN6T0q7Z6qf62dICCGEEEKc2Y6Y4/NDmurH6/WiHnx21xlMmAxdNI9DUQgNtmA5OG3G6/Zgc536eUCapuKxN+MzBBNsOe4tO2F+r4umFjch4WEYdUqHjvG5mmnxGQkLNqNTOnaMEEIIIYQQPzfHzWB8LTWsX7uOXXv3kr93F1t37KPR2bFv9d3NtVTW21E1Db+7hfLKOnw/onCCxRrEX+68gP+7fCC3XTScJ6f3JyPkdBRi8LLnq//x5Jxtp/QsJXlz+OX1/4/1Fe0PN9y/ZQVbi+vRNI0D8x/n/z37DfZTEI+maW16q463XQghhBBCiDNVh7puFFM4vfr2JbdvLrH6Rkqrm/H7vHi8XtxOF16/iqb6cbtdOA++Vv1emqtLKCivw+Hx4mqsZX9BCS1uD16PG4/X3/oArfpxe7wdf5BusfHGVxt5dPZKFjujuaBnGJoGRpORmHArcWFmzDrQGw1EBLX2zugMBiKDjegUDZ3eQLjlyEpr7V6/YiZn/ET8G79jt+1wNTZXi42WliZqqquoqrXh8Z94pTZN87Ft3ToGD4li7uId+L93P1zN9VRVVVHX0ILT3siq+R8wf+0u6h1eEodew6+uGI4V0PxebPU1VFVVUVXfHKjO52huwN5sa91e2xho29XSQFVVFTbHkcPvNE3jpZf/x4YN69tUoFNVlfUb1vPSy/874WsVQgghhBDidOvkuC0dRr0OTdFoKN/F7lIvkaEhRKeloG8spdTmQuf1o1oj6Z5kpaK2kRa3hwOlCiEtlTjtbgqKyonVain2xjG4Txq+2mLyynwMGZBJp2qBWczEWjTqm33ojQZGDurJqNRgEmKsFG/eyVv14Tw+Loj7X9mCpXc/3j7XzG0vr0PpkcP/697Cbz4r6NSVG+OHMbXvHBau3k/GeZkYFYVvXryT5a4BxBqd7N9TxeRfPsDVw9M61W6AbRPLN4Rw4wNTefWfC9l76XB6hYCzYjvPP/MmdSERxMdk0T8FVmzeR0PBZ6QkJzO0+gNm2S5kaHYCG+e+zIfrSwkJNnCgxMXVd/6Waf0Tef/xGykMGY1FtZO/vZYZf/sn5yQ38/a/niFfF06voZO54txhRBjbDpXz+/28/MpL3Kk30L9/fwC2bt3CK6+8xIABA0/sOoUQQgghhOgCHUt8ND8upxNVa6GqUSE5OQRsoOlD6dk3C8VbT94uB4m9sgjVO9mXt4fmlNGkJ1bhcMTSu0cCaqOeSnc9vbK7YXBaKN9Wg9vjp7mhhZiEFIwdnZ8SFs2914zB5XKxYH0e3+13oGk6du0pZO9ulfjsLH43IIHX36ug1ppA7zAdlh7RmC1euoVYMSRY2VNUekI3K2voBJZ+vRTb+AxirQo+9MT3P597L+hNxZJXeWzJZs4flkpIJ+faaJqfA6uXYB84nqyMQeTGvsjSdfvJGh/L8tlvYhp1Ow9fmAleO35/EE37N1CSM5NrR6az//ODbXj38/UX2znvwSeYkGGmfs1s/vDuUobmXoNbMZE+4kpuHp9Owdx/89SCPEad38SqsmTu+9ctZJr9R/T9KYrC9dNnYDAYePPNWVw3/XrQNN57bzZDhgzlmquvPaF7KIQQQgghRFfo0FA3zdtC0YEDFBTWkNQ7l7jQ1nVprGGhGBQFtbGOaoeTytJCCoqq0EdGEdxOSmUwxxIdotHY
<p>我们以外部公开的RssModulesHttp.aspx存在SQL注入漏洞为例，查看此文件的Page_Load方法，发现参数 interfaceID 从 Request.QueryString客户端获取后并没有做任何过滤和处理便进入了 GetRssInfo函数，如下图所示</p>
<p><a id=img6 href=https://xzfile.aliyuncs.com/media/upload/picture/20240516151704-4c12452c-1354-1.png><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAz4AAADsCAYAAAC11XNhAAEAAElEQVR4nOzddXRc1drA4d+4ZOITd22Spu7u1KA4XNydDy3u7q69uEuRlkLdvWlTSZM2SePuybjPfH9MKkCbFCmXy93PWizIkXfvIwnnPVuOxOfz+RAEQRAEQRAEQfgHk/6nKyAIgiAIgiAIgnCiicRHEARBEARBEIR/PJH4CIIgCIIgCILwjycSH0EQBEEQBEEQ/vFE4iMIgiAIgiAIwj+eSHwEQRAEQRAEQfjHk/+nK/A/zefF4zLhctrxIUehDUf+F6SiPp8Dl82KTB2K7C9Pfb14XBY8XjlypQap5Hh2seOwm/F6vUjlgSjUGpGxC4IgCIIgCL+JSHyOyo29cz+dbdW4UaHVDyc80E17fTnK6KEEqqS4zWW0mZVERycCVkyNBRiMbfhQow7rS2hETK8n123bR8nqx6huNqBQp5A95y3iA11Y2/Zg9iUSGRHZez079mF0haGPjEMqkQAOzI3bsGuGog/RHqPcZWz68E2SzlxKalTvZ8PjaKKrrQFNeD+0agXgwWE4gNGmJDQiGflvyp7MNBfcT0l9LkOnXU2g5vAan9dIR9V6rK6DSyTItSmEagzs2/Y2zVU78ETezNizryak13J8uG31dHV2oAvPQa0St7ogCIIgCML/MvHi/Ki8uCy1dDblU7n1fvaWVIBtL0VLHqamy/9U7qifz5YtKwAXlual7F73Gg1Vm2ko+YSCzR9jsDh6LcVa8y01nakMPnsB0y54i/hAAAste54kf9fO46inB0PFu2zdvBCPx9u9rIGKlddRUuf8ncf+a07zfvZteIzGls7uJRbaS99mz/ZVOFx/3vdvva5qilfezIED+bQ15tPWuIuu9jpcQaMYPPsjxgyf8hui+bC1r2bv+tdpN9j+tDoKgiAIgiAI/52O+ho8/xvYUAVVeVDihTlXwGUzQW6FxW/BWyv92z3+HQzRANVw6+NglYLP5/+nJRUW3uPfLu9DeOF7MAbBedfDxaMAD+xZDM++CR1AgB6ufARmpMJXt0F1H9i3AJqBG96Ak1PBXAbPvwLbyiB9MNz1BMR317mzHN5+EdZXQHAU3P4iDAvzr3vvBvimAugLr98Jab01pKAkMH4WOfGzqPMUUtbjtjYMNevo8mYzYcztaOUdGDo6CZDLABfGuq8oXPMZZiBs0GsMzU0/tKepYS/yyIsIClID4LFWU7H1Xvbt3YyFWpY3v4IiYgb9Rl6NPkRzlLJVyJVq3G4TcDABseK0xRCsDwIsNO9+mf37NuJUJJM05B76pCb6N3O3ULf9Aao6dyCLuorhJ53B0UoAkEqDkcjseNwHkzk3HpcSTWA0MpkPU8MX7F31MWYgtP9LDBuQBbYiita9TKstguiMNNp2fYM15kqmTp76s9hO4z5K93xDeJ8biAwGeUAq0UMfIi26x5N+iKtjC/u2vkpzuwFtxCX0n3EuQYBx3xNs2vQNhs5OzIuq2BcQRvyIN8hOCT++wIIgCIIgCMI/ylFbfFor4Z1P4ORH4L5zIf8rKG0BmRqmXQ2ffAIvXAp3XAd1bsAMmzdA6kyQGGBAGpRtggagbBk8uR3ueR6evhQ2fgybKsDcDm+9ASkXwkefwLxXYGL3M3n5FvgmHx74BK4bCXc9AnZAmwy3PQYfvQeDgJffBqMXbJ3w2oNgHOKv92UD4OMvwQRseAq+jvPX+fpwuP3ff+R0uXAYqzB1VmA2d+D1eQEdOv0ANMbX2LFrC3aHlKDIXNQqOW57I6XrX0WaeSejT7qczs0XUVTtwOsyYDFUYTJ34HF3Yu2swGQyIFXHkTL6CXKyhhKceQfjz/yE0RMvJ7Q7MToaTUACCquR5pYPWfbO+ZTtycPkUqNQeTGUf87eSiM5U99m6LBRNO98jvoWIwB2qwtF5EkMP/NFgtpfYNvmPDzHKEMm16KVh2G1bWTbJxNZvXo9dpMBn0KN191G6brnIX0uo0+6EuO2SyiscoA6k8yJ/8JbNp/m1liyZ9yAsuw9StvcR0T2YmqaT31ZAx6JEgCfx4bdVOE/x11tuI9epUPkIYPJnvw648/4kCjJdxRsXIXdC7qM/2PYpKvRx02i37R3GDfnDdITQo73QguCIAiCIAj/MMcc+JA+EnLjwdYBHgkYzOAOhIL1UGX2bxO6Hfa2HW51ScsAUxjERIDMBx437MsHrRl25YGsE+ps0G4EWRgkRML+TbBUDmFxMGXs4fKHnARpetBPAvnHsAvoUw87dkKnEzoB4x5osUJoGxyogUumQrwe4m+F6QB2WLoQ0s+HVavAYIHdzX/kdLVSu/V+DCopHtN+7NoUQEpQyuUMm2qjqOBNNn5TT9igV+mXMxCpdR2dxkjSUyahi4SEyIeor95BisrA/vyvaa4uxiz5gD2WJciiL2Hi+FnI1SEoFEqkniDUWn2vNdIGxCD31mPrqsWjH4rKUI1JmkZwkAHj/n3gUtDZuBWZvQFH9yQB6EAdFEdU0jh0WsjoM4I1pTswjR5+1LEzcrkGrVqPqa0YQ9REIq1NWD0yVPHhSJzr6OjUkzZ5CrooSIh+iOqqPLKTx6FQ65Ap1QTFjSI8wkxiZjY+j382A0fHDmr36WjbvYDg/q8THhEIDnCby6jceg8tKlBoppF7ypU9jOfx4DSV09awF6fHh1MdhqtpJxbHFNSaIFTqQGQyFQp1GGpt4O+64oIgCIIgCMI/wzETn4gwkMt+vqx9Bzz2DPSfA2GAtbfhHT7weqG+FmpqIEABkydD31jQhMCVD/gTk5ZaWPQxND4IV43orlh3zYJDQKEArLDqY/imGgZmQUcruA7WzwNeCUh/2X7lBTdQth9SnEAI3DS85yobKz6iwTGEtOxcFL9aG0v6SZ/SN0qFpeQplu9THVoTnH4Do1KvpmXPQ2wvepXWmJeJUnjw/jKEz4syehZDZ8+ievlsDshuYsyU6Ry7TacXSh0quwFTpw1twGxM5h9walLR4MPp7cJmsGLpikQplxOTfjLhIUG/PubOYmTqIce+GaQK5BIp9pYiZAkXIqlaSZfGS6hCi8T762P0eT2HOt5JpHJUmhAghNTJLwBGGhrA6+rEairEYg8kKDDq0LlWBPcje8pXx9fVzdVFc8F7lLbY0Een4rZ0/fp8C4IgCIIgCAK/cXIDRy10RcIVc+GSIRCQ0ssOCsjoCxoLDLkQ5s6FuRcfHmMTlQGXzPUvj6yBA42Hd92+0t+qs30TGLKhrx3qaiFpMtx4E0xOBnmEf1tNBMTLYfFi6DqyfC1MHAeWVji9u5zb5vRyQlwVlG19Ff84/v00VtQRos/oYQ8TFkMlVhNIpFLUYbEo3AqkUhmygNEEaxppbyrCbVpPY7OUsLhBvcz2pkOtDcBuaznKuk42ffAYZ93+AZ2W7qnPgmIJUhkxdZjRqNVYLWU4VeFopcHo9H1ReLwE5V5C7pi55A4+leAg3c9DNn3L7gPlRPWZcWiMT3vNT9x0/i18m999QRQa1CHBuA31yOSJyNiDwSlBo9Qi144mJKCJ9sa9uEwbaWzyoU/oIYnqpomaRp/h95PbL4GmvV/QZe5lBwBcuJ1NuOzdP3ps2LsMqBPPIXv0bURrQ5AcGqgkQSaPQCI14XaJyQ0EQRAEQRD+1x018QmMgLgokElBoYX4OAhQQvgUGG+Hfw2Ha7fA8ACY9yhs7/R3cwtWQVQsBIVCRhIogOw58Nwt8OqFMHw4XHg/lHaAsRluGO5fNnw4VE2C2045XIesMLhkOFz7Djz8uD/mtDlQ8w5MmwJLVaDYBi9+Ch4d3PYKSFbBtOEw9iR4e5M/zvQn4doEOLe7nLvm93xCAlJvZXAm5H89nEXzLsLZ/9/0T9OBNICAsGTUcn9XLakqgqCgUHDb6Sx+g3WfD2fRvFGsW7kc/YBriYwMRqZOJWfyHdh2XsKSz29FMfgzB
GetRssInfo 方法用于从数据库中获取特定 RSS 接口的信息。它使用传入的 interfaceID 参数来查询数据库中的 WFRssModule 表，并返回查询结果，具体代码如下图所示。</p>
<p><a id=img7 href=https://xzfile.aliyuncs.com/media/upload/picture/20240516151734-5dab0e68-1354-1.png><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAz8AAAC9CAYAAACdxcMNAADYIklEQVR4nOzdd3RU1frw8e/0kplk0nsPISGFEmroRQRFRAQRG9gVe9drb9eKvTdUVGyoCEjvnVACpIf0XmaSTO/z/pGAoAjxKvfe93fPZy3WInPa3nvOObOfs8sR+Xw+HwKBQCAQCAQCgUDwf5hIJBKJ/9OJEAgEAoFAIBAIBIJ/ByH4EQgEAoFAIBAIBP8ThOBHIBAIBAKBQCAQ/E8Qgh+BQCAQCAQCgUDwP0EIfgQCgUAgEAgEAsH/BCH4EQgEAoFAIBAIBP8ThOBHIBAIBAKBQCAQ/E8Qgh+BQCAQCAQCgUDwP0EIfgQCgUAgEAgEAsH/BCH4EQgEAoFAIBAIBP8TpGf7AB5nB4VVqymRZHFOSiaBJyzzeuxUVC1llzONqf1yCP3bj+7C0LWfPbXtJCVNo6/f334AgUAg+FNam37hlzoLAzKnkq3WIHYbOVq/iqX11UAEQ1InMSIsGtW/IzFeO01tW1lWfpAuNPSNO4dx0anoJIDPQ6dhG98W76EDFYmRYxkf35/Qs/6rIRAIBALB2XOWf8Y8dJp38O3uRdD/DSb/ZqnDlc83216nud9HnH+avTjMZawtXsyato6TPlcrMpkz4iZy1H+0pYu2ji0s3XeEqWH/LcFPBzv2vMQSvRGFKpaxaTcxPTKgF9uZOFS4iG/ryzD6ZPRPe4TrEoJPWqOz4TteL95JpzeeS0feyTA/ABuV1T+ztHwbNS6Iir+V+9P7IhWLAAf1jev5oWgVZU4Ij5nP7ekDCZBJABet7Tv56dB3HHZASMQsbkgfSZRKBnjo7Mrn5/2L2GuHwNApXJV+Dn00it+kuZOCo8s5ZEtgXJ/RRCsBr5vmmk95pryRAQmzmZuazhm/FnsRXx/4jj2dbbgAJDr6xl7C/H7ZaGlhR/7XrGwsx9izukIZzZj0BVwY3MWm4h9Z1VCOFRAhYuLgN5kR1ovi/iPuLoorvuTtiqLfLIhk5sj7mBAgP+GzFnYd+pZK1blMT0pFe7qrzbyT57ctod7n6/5bnsLk9JlMjo7DVvcFL9WFck/uuQQDuFrYc3QDVeI0JiYPIlQKrqbvuevQPhKiLuGG7EH4/4Us9iSIotIlfFd9iDYP9O37CLclR/RiOzu1DWv5oXgtR50QEXstd6Rno5VKACfNrdv56cgPFDggNHION6YPJ0IpA9x0dB5g2YHP2WeHoLDzmZc+gWQ/BeDFYi3h5z3vsMMGAUFjmZM+jeyA34YHJsprV7FXH0Bu33NJtK3nyfzVtDnsJ6yjJTPxIi5KGUq4DGj9idsO7CA6Yg43DxjM769EH2brHpbt20VC1l2MDPzdCiflvbp2JUtLN1HlOvaZGH91fy4Zei0Deu5TzQ3f8/rWJm5KGkWmWoMYEVKJEj93I8tLdtGmTaX/3xL8+DBbd/PF5i8pANAM5JL0ixgTGtSz3IvRspPPtr5JvnIEo8JVKMSS490BXO7DLN70HOslozknOhilRPoXuwqYKShZzFbPUK5IHYC/TPKX9tbNSVPLFn4sWEaRA8KiLuPm9KGEKs700+bFZC7k57z32WUDXfAE5qafR4a/EgCHs4oVOxeyyQpa3TAuSr+YoYHHfmj0rNz6OKvMoNZkMDX9SsaHanqWdbBt9wt8YzCjVMUzLv1GpkX0XI2GLTx/6BfqbRYQa0iMnsP1WQPxNx1hSdFP7NC3nJA+GeGBucweOJs0JdC5izePrKDUO5SHR00jUnKqsqti2eYP8aQ9zcyIv6NsBQKB4P+ms9rtzetxUFz2DQf8pjKnbxq63yyvKfmQ1ZLzmJ+VTfCpdtBDIgskJWI0k5KGojPuYmeniiGxExgXP4Dw/8+eQpYcfpyHjjSQnTCSRO9hFu9+kx0dZ96upuITXsrfhTJ4KKN0FpZsvpdlrceWNrJx7xMsWPk1psABjE0YTKSse0lb8wY+2v8t9bK+jAlXs2XXnXxc7wSg07CfL/d9xBFPAiMjgjh48HHerWjD6wOLqYIf9i5kizWCEVGRVJa8wvtl5Zjd4HC0s2rvY/zYEciw6AT01R/zYWEerU7wed0cOvgI9+3ZQQcWaprWs6mqgPaeyqDX56KsZglLKndyoGg9FfbfZfX3nLVsKdpIq3IAE5ImMCRIzs6DL/NpZS2gJjoshzFJA6FuCbucmYyPG06KnwLcbeRXbqXCFUZO/CQmhnh4f9U1vFXZ/ie/tRN4rNQ17GBHu5iMpElMSprEIHEVSyur8Ul8uOxNrM17lpcLDmGik6LKn9jUUI/Vc4b92otYfngXirBJTEoaRZKvhEX7FrOnvQOltYjP9/7C0Z5VbaZS1pau5aDJgljU/VlT3RI+qTvAofwfKbD+69k7pqHmW14/uB6X/wDGh4pYuuk2vmk+83Yd7XtYvG8RJb4kRkXoyNv3MO9Vdp/gJmMp3+e9xk57FLmR4ZQVvsj7ZdVYPWC3tbBiz1Os6ApmWHQ8LRXv82FRPu1O8HjsbNh9D4tb/RgSk4qt8Ws+PrKZWlv3MSuOPMYt2zehx0ZD61Y2VeyjyQkYD7L4YCHBCROYlDSJUSGRtLXu41CXGVHPna+l7ls+qj/E4QPfcdjyaz4MtZ9x54YvKLbbsTuL2XTkBwotnIGT5rbtFHZ56RPVfW5MSprImNhswmS/rhWffBuvzniMc7WB3TdgqZaE2Au5NfsicgJDevX99IbX18S3G//Bt9Y4JiUNIsi0mU/yfqTQ2HPR+Tzoa1axoqsP88fdza1Dr2FqTDL+PfVmR/1yPmmM5qoJ93Dr0OuYnpBB8F+639qoqVvB8ppyrB7vX8xdN2NnId/kvcVeZwy5kaEUHXmO98rrcJxh926XmfV7HmBJm5YhMSmY6r/go4LtNPQUzc7dt/J2vZyc2AzE7T/zycEVlPd8/4f33cbTR30MjM8h0LKFT/d9ySFT97Liw4/wj4JmshNyifPks3j32+zsBKhlRd6b7LPEMSphIoNDHOzd9zbb9ICtmk2lBzCoUhmVNImJCaMJ6trMisYOjsU4ne3b+LZxDwf2fsyWTvfxfFj0O3h3+1v81FCHgxZ2HVrE9o6/p2wFAoHg/6qzGvy4PTXsKD9IdML5pP3uMWYjmws2Epo8m+w/bLnpJlWEkh47mRlpUxkeFE64bghT+lzAeSnDiZEDtLHr0FPM/iCHnA9ymLV1I52uU9c2i/LvZPr6b+hyuQAXTS3LeeiL7u1yfniJnfruiprdsYmnPp/MAxufYdoHOeQsvo1Pqyv4ta7uorn9axZ8MY/nSyp6WSIlrDu0kbDUu5iXfgmz+80lwrmZtU1VYMnjtRVzuHLrRrpcbkzmvTz/3YXcvXcHndSxr2IzPt35XJI+l5kDHmaSfCOfVxYAUFu5lA9Lj9BvyB3cnT2XC1NHEScHMHC0eStNnj6cl3Eds/o/xHUh5bxRvAcw06DfylFjIOdk3cwl/e/hmnA9H5duw+tzoDdtI7/Zy9jsO5iTdTvzomF51TaMLgdW+3a2V7QxIvte5mbdzJVxwexp2Eqj1YQPL4ervmSv2YPmFCXg8dZzsLGB8/tMRWLbS35bVy/LTkNqzGSm972IWanTGazWs6+pGiNaEqJGMSVtMgP8VISHTmJayvjjT3BBRWxYLuemzuDCgU9wha6Ib4p382v4U8G3a+czceUSDE5nL9OiIjRgEBPTZjAjLQOR2URc7LkMUkpxOPTsq11Jqc37p5/cyyRh5CTNYEbabC7rMwS1tYYiox5xwljO9f7C+pru9bqszdS5rUT4R3V3T6KZLZUHuSD9WiK829neqP/Nng/y3OcTmbXrQC9T0sThmi1YVaO5qN9VXDTwcS7228YH5fngrGPt3nu5cuXr7DJYgBZ+XDmFySuW0oyJ2vatVJnDmZx5E7P738u14S28X7oDsNPWtY0jrVLGZd3GJdl3Mj/K
上述传入的 interfaceID 直接拼接到 SQL 查询字符串中并且执行查询，因此触发MSSQL注入漏洞，如下图所示。</p>
<p><a id=img8 href=https://xzfile.aliyuncs.com/media/upload/picture/20240516151747-65ca492e-1354-1.png><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAz8AAAHDCAYAAAAKmqQIAAEAAElEQVR4nOzdd1xV5ePA8c+9l733BhXEAQ6cuPfAvXeuksq0TDOt1PqZKzUrjcxUcqZWjnDnFkXcCwERFUWW7L3vvb8/+N6TyBAVm8/79eKlHM551jnn3vOcZ8ny8vLUKpUKlUpFcXExmv9rftRqtfSvWq1GEARBEARBEATh70QmkwEgl8ulH4VCgUKhkH43NjaWaWkqN8XFxeTk5FBYWIhSqSy34iMqP4IgCIIgCIIg/F2o1Wqp4iOTyZDJZFLFR1tbG0NDQ7S0tKT9tVQqFUqlksLCQnbv3o29vf1flXZBEARBEARBEIRqERsby5AhQ0ptk1p+lEolBgYGDB069C9KniAIgiAIgiAIQvVYt24dRUVFUtc3ALlmbI9SqRTd2gRBEARBEARB+FdQq9UUFRWhVCpRKpUAyDUtP5qxPYIgCIIgCIIgCP90arVaqviUqfxoNgiCIAiCIAiCIPzTaSo/TzbyaD09rXV5YmLjqtQqZGFujqGhQbUmWhAEQRAEQRAE4UVoGnk0DT1aVZnG+vips9jZO5TZHvUoAQM9XQqLiklISGRQ7454etSr3hQXJBGw7jdqj/PF06SS/WLO4XfFEN8BjdGt3hT8e8QE4XfVBN/+DUUZCYIgCIIgCJVas2YNV65cKbO9Zs2azJkz55XFu2rVKt544w0MDQ2lbaGhody7d4/+/ftXOZwnh/eoVCrgicqPZkN5MtPTSEyIKbNdpVKRCagBHZm8zN/zEkJYu3o9V24no3SszVtvv0uHulY8OPcrm6/oM29qH1QF2Xz+6Xt0mrScznVM2LXAl0CbN1jm24GkIwv4v5t1aFucTVHFySuRGsnRK5ZMeOHKz2M2zlxFrfc/o6OTDpDJ/m+/YNeph2g7ueE7YyYtalRW+yomPvwyRQ6tcDF9nnhVpEVfY8PytZy+lYzP4qVMbm3Dzi8W8WtIDHq6boyf4cOFjecZ89k0XIwVL5Q7AFLvcPSKDRNE5UcQBEEQBEF4hjNnzrBu3boy2994441XGq+DgwOLlyzhk48/Rl9fn/Pnz7Pj55+Z+wIVrifXLIX/VX40Kmr9CQ29xQ/f+6Gjo0NRUZG0n0KhkJqQ6tStR5/evf84SJ3M3hXLyGr1IWvmNcIgP5bQTG2UxcU41G1I8eHjpKrBUlubesZmhEUl09k9l9Cz2aR1vk5eoTdRERm079GNMZ6myLXVKIuUqChJvEJLG4UclMXFKJUq1EXFmohRKZUUFytRI0NLWxs5SpRqOVoKKC5SItfSRq0qBpkctbIYpQrkCmta9HTi9OW7tHX0QCsrhJPhdizcugjjjHiytEsWgpUrFMhRU6RUoyWHouJi1Go5Wlq5XNi6iJQhu5ngpYVMXZIG5Aq0tRSolErUgEqpRKGtjUpZXJI+LQVqtTVjlnzNpLCfmHjgGuNb96Bxv/cZMNuOU36fcvl6MTVci3kYl4ZLXStALeUbuRZaclCpS/It09JGrlaiVJUuo2KlCgqLKe2PsipJpxxlsRK5lhaoilGhQCGH4sIiVDIZWlraKOSy577oBEEQBEEQhH8mA4OyQ1o000a/KprWnS+/XEHfvn3YvGUrM2d+gI2NzXOH9fTwHq1n7C/p3LkzY8eO5dKlS5w+fRoTExN8fHz4v//7v/IPiAlnd0FzvhvSCAMAbUc8teJYMfE9XD5ZwbBat1l9IpV53cxp2boW396JIvNaKo99BuKQ9pCUx/f5PcKU10YlsWDoMgYHvMfJ4dO44loLdcwdPPt/xpvdFWxd8D03MgtIvX+WovZfoipOZP2ceZyNykeh1qGmz0iGOF1mdXQrVg/T4s1xa5mwyp/IrVPRbzWGW5tW8UDLinZ9fBnWuhmP/A+S2q0ONiY1sc78mrVr6zJtWk+ssx/y6fsf0W/mUjxTAvj4pCHDLO7yXWAYRrL6jHuzJj8fuEHMo6W4f9yXB9u2cebhYwoMTXlz+nRi/BZyVNsOnXunyW80CsusUO7Fqnj384V0qWXAiQP7uPfoEYN6dMMAU9w9TVHnPiL4Whxuk2vRLieUVYE3aV+3C9kpIfh9/DW389TYth3KEKswvtsdjZkyimiLpjSzzSc8/B4tRixmfPs8Ns3/gRtZBaTdP4Oy0zfSKSrIiWbHku84++gxBQZmvPHGm5xfswSXKZ9S/Ps3pLZ5j07Z51m/5TRZBsU06u7L20M6YKD93NedIAiCIAiC8BIOHz5MfHx8me2Ojo706NHjL0jRq6Ojo8PgwYMJCw+nV5++XLl0EWdn5+cOp7yGnSpX29544w1ef/11bty4gVKppLi4mEGDBuHo6Fj+AXIF2iolxU92V9OxZOjsWXRwMaPh0NHk7jtIslJGjUatUERHc+l2At7NvOhsreBC6F0yHQxw0f6jm5dM25j+b37GykXTUd27yq0zR4mpP4zvN2xgyxdT0NKSU3jnGMeK2rBi8wY2bJ6HwZXtJFi2RHEljKBTN7Hv4U3q3cukZ5jjWUvFwzAlXce8zage9bG0qYMHcDs5E3Dkjc/n0qDoNK9N+YRLMdq0r+tISPh9ggMT6NG1Hsn3HmFm3Yzp8yfRpmUfRvdvwqQP51IvLYglvwSSVlRIangQ+69EA1o06vk63275grxzEYz7ZDlT2zsSEREPch2s7OyxMdMl7FIImSpIvXeBRXO+oMZr0xnQ2BkX765Y3gzhfpGKqOCjxNYfzpqNG1j6dl+05QpMarRl+aaVNIyPot7o/+PLua+RdO4yN08fI77hCH7YsIEtS95B/kTLTeqVAJbuOkN6YSEpYWc5cl/NlIWvcdB3MkeKO/O2Rz5frVhPZHEheRlpHDt6hNTcp1uPBEEQBEEQhFfN2toaJyenMj9WVlZ/ddKqnUqlIiIigoSEBD77dB4bNm4iIyOjWsKucsvPkSNHeP/99zEwMODs2bNERUWxa9cuatWqxbBhwzh1KrD0AY71GWiwnc17rzO1rxcGWfcIfqyFTswjjB3csbVoTV3Hn7gW5kP3hu40y1nPzgdevN2hBvYqPaYfC6NLPW90tP6onynkhlhbGKEoMMZIDxQ6WihzclCri0hNSgO1GpmuHmQmUlCkAlUeecbuuHh409F+C0uPNWX+6Foc2L2K7NofUMfGiiW/byNq70LeCzDly6Wz6Oljwlf7r+H9ujt3c+wYNnMRzps/5eDRCD7u04qP1x8hUk/Fuy4OyKd+SseCKJa82Z/mX+3D+H/plBuY0HbAWyxbMBFZzD3y7PUJDNbH0dEKLeNsahiYY2SgS7q2jOL8PMLvxuDSsBXuNQs5MucqqelN+OGLjfSe9wXtpQFEdejWfhMHDt+ns642WoWFqNX5REdnolJrYe9kh46eHtZ65tiYGyJL1UZWVIhcW0Fx9pNlBMXpdzl8Lg13S1PaDZzM0vnjIPou+Y6OFDy8gdzSkvysdIq1tbGs0YT3ln9LI4M8YmJjsTGt8iUjCIIgCIIgVJNmzZr91Un405w/f57NW7aweNEiTE1N2blzJ998s5IPPpiBkZHRS4Vd5ZafLVu2cObMGfz8/AgMDOTRo0esW7eOsLAwzpw5Q2FR4VNHmNN7+hS0Lv3AxLFjGLP4V/QVhdw4fpL7aSX7tvTyJuz2bcCcVj61SM1UY2tmhE2rHlg+vI9Z7dooFDpYOlijixZm9jYYKECupYuZhSl1m/fEMnYPE8a+zU+X07G3NEKvVncmNMtg3uvjGPPGtzj1HYirgSEezepjZWZM7bqemORb0sGnIdpyPQJWTOL7U49o0qUz5rpg07QfNR4HE55pxP3DSxkz5jU23pDTv28L9F3a0kR+EZlTe2zMjMgJ+42P/+8bIt160NHJmPrNW7B9xWeE67agq1kI740fw+JfAkGth7GNNca6ckAXK0crtGWgb2aJmYkhhjmRzPvAlwmTd9Jx2gic
<h2 id=toc-4>0x05 总结</h2>
<p>该系统由 ExtensionlessUrlHandler 和 JHSoft.Log.Module 组件两者配合引发的全局绕过漏洞，攻击者只需要构造出特定的URL请求便可实现任意接口的未授权访问，也证明了 Web应用程序在配置和权限管理上的薄弱环节，因此不当的配置可能导致严重的安全漏洞。</p>
</div>
<div class=post-user-action style=margin-top:34px>
<span class="btn btn-default pull-right" id=mark data-action=topic data-pk=14517>
<span id=mark-text>点击收藏 </span><span class=i-seprator> | </span><span id=mark-count>0</span>
</span>
<span class="btn btn-default pull-right" id=follow_topic data-pk=14517>
<span>关注</span><span class=i-seprator> | </span><span id=follow-count>1</span>
</span>
<span class="btn btn-default pull-right">
<span>
<span id=ready_reward data-toggle=modal data-target=#myModal>打赏</span>
</span>
</span>
<div class=clearfix></div>
</div>
<div class=related-section>
<div class=related-box>
<span><a class=pull-left href=https://xz.aliyun.com/t/14514 title=EagleMonitorRAT通信模型剖析及通信解密尝试><span class=related-label style="padding:3px 4px;margin-right:3px">上一篇：</span>EagleMonitorRAT通信...</a></span>
<span><a class=pull-left href=https://xz.aliyun.com/t/14518 title=探究EL表达式注入的回显方式><span class=related-label>下一篇：</span>探究EL表达式注入的回显方式</a></span>
</div>
</div>
</div>
</div>
</div>
<div class="modal fade" id=myModal role=dialog aria-labelledby=myModalLabel aria-hidden=true>
<div class=modal-dialog>
<div class=modal-content>
<div class=modal-header>
<h4 class=modal-title id=myModalLabel style=text-align:center>
积分打赏
</h4>
</div>
<div class=modal-body id=button-value>
<div style=text-align:center>
<div role=group>
<button type=button class="btn btn-secondary m64" style=min-width:64px data-value=type1>
1分
</button>
<button type=button class="btn btn-secondary m64" style=min-width:64px data-value=type2>
2分
</button>
<button type=button class="btn btn-secondary m64" style=min-width:64px data-value=type3>
5分
</button>
</div>
<br>
<div style=margin-top:20px>
<button type=button class="btn btn-secondary m64" style=min-width:64px data-value=type4>
8分
</button>
<button type=button class="btn btn-secondary m64" style=min-width:64px data-value=type5>
10分
</button>
<button type=button class="btn btn-secondary m64" style=min-width:64px data-value=type6>
20分
</button>
</div>
</div>
</div>
<div class=modal-footer id=confirm>
<button type=button class="btn btn-default" data-dismiss=modal>关闭</button>
<button type=button class="btn btn-primary" id=reward_topic data-pk=14517>确定</button>
</div>
</div>
</div>
</div>
<div class="row box">
<ol class=breadcrumb>
<li class=active>0 条回复</li>
</ol>
<div class="box-container post-container">
<ul>
<li style=min-height:50px;line-height:60px;margin-left:15px><strong>动动手指，沙发就是你的了！</strong></li>
</ul>
</div>
</div>
<div class="row box" id=reply-box>
<div class="box-container clearfix">
<div class=reminder>
<a href="https://account.aliyun.com/login/login.htm?oauth_callback=https%3A%2F%2Fxz.aliyun.com%2Ft%2F14517%3Fu_atoken%3Df50c8e7a7d40ceb9aaa813f125fa81a1%26u_asession%3D01a27JH3yYs4Rn04c99AXgZ5YYI4hn6zYChuuLRaajFDS5A6GDxASSQMBySL8AtLcudlmHJsN3PcAI060GRB4YZGyPlBJUEqctiaTooWaXr7I%26u_asig%3D05HTLB4XimLCy_AgwCRcf9yFeuotnUci5qEysOXdsgel_80aalOchpWmtUueK-C1grv_Ew6sk4kJWhIxbGUtIvqwD1xlWS8-p3Rpi7cDE-vQxmekVmWmLx8Mdk5lbqBJH8bWet15V-gKKvzrUOo3dGJVg6Xgeq5X_nZ31gZe5tuw9g2QMxYs6lyXb1lFWKql56VQk-s9fMkC5MAIUnb73u9altTs_pEgT5kGMBqPXKjlFrxDqh8wjGDQNnCEAn9P2zrLfmcl4pPFuyeypc6q01x7mMVlCk5kiJUJeLu8ULWJA%26u_aref%3DD1qbxzhiimt%252Fz5GoeLtMZ%252BpMo%252FY%253D&amp;from_type=xianzhi"><strong>登录</strong></a> 后跟帖
</div>
</div>
</div>
</div>
</div>
</div>
<footer class=bs-docs-footer>
<div class="container text-center">
<div class=links>
<a href=https://xz.aliyun.com/feed target=_blank>RSS</a>
<a href=https://xz.aliyun.com/about target=_blank><span>关于社区</span></a>
<a href=https://xz.aliyun.com/partner target=_blank><span>友情链接</span></a>
<a href=https://xz.aliyun.com/notice>社区小黑板</a>
<a href=https://xz.aliyun.com/connection>联系我们</a>
<a href=https://report.aliyun.com/ target=_blank>举报中心</a>
<a href=https://www.aliyun.com/complaint target=_blank>我要投诉</a>
</div>
</div>
</footer>
<div id=waf_nc_block style=display:none></div>
Reference in New Issue Copy Permalink