Yifang Virtual Machine 4.x management system background Webshell and repair

IIS6.0 + Server2003
Vulnerability file: Pdt_Image.asp

Key code:
{

FilePath = server. MapPath ("../Pdt_Images/" & PSign & "_IntroPic.gif ")
Set fso = Server. CreateObject ("scripting. filesystemobject") create a fso object
If fso. FileExists (filePath) then
Fso. DeleteFile (filePath) 'determines whether the file exists; otherwise, it is deleted.
End if
Set fso = nothing
Stream. SaveToFile (server. MapPath ("../Pdt_Images/" & PSign & "_IntroPic.gif") output stream, directly take the psign value as the first part of the file name, and parse oday with IIS. The upload vulnerability is generated.
Stream. Close
Set stream = nothing
Call message ("uploaded successfully ","? PSign = "& PSign)

}

Go to the background-product management (item)-add product-Enter "1.asp;" in the "enter a new product number" column, click Next, and upload the image Trojan, right-click to get the image address. for example:

 

The space sales program of Yifang is probably in the AS version, so you don't have to worry too much about the possibility of using it. Of course, the new version of IIS is not ruled out.

Vulnerability Analysis: The uploaded image uses the input product number as the front part of the file name. Combined with the IIS6.0 file name resolution vulnerability, this upload broke through.

Fix: the simplest thing is to change iis7.