Typecho Blog system store cross-site Vulnerabilities & amp; easy webshell

Hiphop

Source: http://hi.baidu.com/securehiphop/blog/item/f5b3627a1768bcfc0ad187f5.html

Source code download: http://code.knowsky.com/down/14247.html

When I get up early this morning for breakfast, I will download a set of blogs to check out.
I found that the title was not properly filtered when posting an article in the admin background.
So we can use this to belong to the store cross site script.
Describes cross-site scripting attacks such as store cross site script.
Simply put, a stored Script attack writes the attack code to the database.
Attackers can exploit these vulnerabilities to write them into xss worm,
Csrf, xss shell, rebound... can play a lot of games, everything depends on the attacker's ideas.
A simple demo with a picture and a truth first

The above two figures verify the existence of xss. As for how to write the attack syntax, it depends on the individual!
The first batch is used to generate a cookie. The second batch is the certificate line script.
Next, let's talk about how to use shell.
This blog has a set of Preset passwords installed, as shown in figure

Then everyone should think that some people will be very lazy and don't want to change their passwords.
So let's go to google and find Hello World. Welcome to Typecho.
Some of them are actually preset passwords.
But I just want to test webshell on the local machine.
You can edit the webpage module in the background.
A major problem here is that you can edit php
And some sensitive and evil scripts are not filtered.
So you can write a sentence directly.
Everybody knows the next action. Join a sentence to get the horse !!