Windows Alternative execution Exp right

This is found in the power of a foreign server, the environment of the server is win2k3+iis6.0.

Barbecue, PR,IIS6 bug patch are not hit, but, can write very little. After uploading the D-Bull script, I found the writable directory.

Writable Directory

C:\Program Files\zend\zendoptimizer-3.3.0\lib

Follow the conventions upload Cmd.txt pr.exe

Then run exp on the chopper, where the egg hurts. After execution, the file cannot be found directly. Think of a way to set exp to the path of CMD. Then execute the command where I want to execute the cmd command, and find out or not.

What's the swelling? After a discussion in the group, it is found that there are spaces in the path, so the execution of exp will be truncated where there are spaces.

Then a variety of Baidu, finally found a way. We can take advantage of the short naming of Windows paths

Program Files are equivalent to Progra~1

Specific Introduction http://blog.sina.com.cn/s/blog_5f044a4d010145ay.html

Then change the path of the PR to C:\progra~1\zend\zendoptimizer-3.3.0\lib\pr.txt

Execute "c:\progra~1\zend\zendoptimizer-3.3.0\lib\pr.txt" "WhoAmI"

Successful echo, it is important to note that the PR path is also enclosed in double quotation marks.