A friendly inspection of a university website

This year, my cousin was admitted to a well-known University, and went out to curious about the university's website for a friendship test yesterday .. The result of the detection is broken... Two bad words .. The article has no technical content .. Please let Daniel go. After starting its main business, I found its address is www.2cto.com/news_more.asp? Lm2 = 93 .. It is also a very old vulnerability. (The vulnerability principle is not repeated here. There are a bunch of articles about the website management system during Baidu news ..) Then I directly enter ica, STHeiti; FONT-SIZE: 14px ">/admin/admin_news_pl_view.asp? Id = 1: An error is displayed. Sure enough, this website has an old vulnerability that appeared more than N points in the website management system during the news. Start disassembling. When I guess 6, the page jumps to the modify comment page .. Joy ..

 

Change the comment to | '+ dfirst ("[user]", "[admin]") + chr (124) + dfirst ("[pass]", "[admin]"), username = 'click Modify and save. the MD5 value of the Administrator account and password is displayed.

 

 

The above is the account .. Followed by the account's MD5 Value

 

Originally, the next part should be ica, STHeiti; FONT-SIZE: 14px "> cookies directly bypass background logon and enter the background management system. However, they do not work .. Now that you have the account and password at the backend, you can solve the problem by entering the MD5 backend. Add the default backend address/admin/admin_index.asp after the domain name.

The Administrator's password is clear .. It will be unlocked in MD5. Go directly

 

I tried to upload a jpg image with the asp suffix twice in the News modification area, and the results all ended in failure. Then, I uploaded the copy merged image (the synthesis method is described in detail in my previous blog .. The final tragedy is that the backup has crashed .. This website has been taken care of for more than n times by numerous coqueies such as Daniel and me. Finally, a page can be found to list directories .. It is still possible to win .. However, I am not continuing to go deep... ZF and school websites still seldom touch .. Dead .... Especially when I wait for cainiao...