A simple record of hard penetration into the Dz-NT Forum

Recently, an X-site is infiltrated. The environment is the main site + forum, and no other programs can be used. After entering the background of the main station, I repeatedly studied that no shell is available. Only the Forum is available. Scan directory, after a painstaking scan, download the backup [Program + database] before transferring the server to the Forum, import the data to mssql2005 immediately, and view the administrator password. Then I went to encrypt 5 for decryption. After five days of decryption, I finally failed to decrypt the password [Discuz! NT 3.6 administrator password is simple md5 ]. Register a Forum member and check that the last logon by the admin Administrator is the second day after the transfer of the server. Therefore, I estimate that the password is still the password in the backup database! Now the problem is how to access Discuz with the encrypted administrator password and account! What about the NT background? [Can I export files by using MSSQL in the background ]? After countless battles with brain cells, they finally entered Discuz! NT background, of course, not to decrypt the md5 value, but to generate a cookie using the MD5 value, and then log on to the background. Discuz! NT has very little information in this regard. I should record this as a special case. 1. Install the downloaded backup forum on your server (website backup data is obtained by scanning or other means ). Change the management password of the Forum to your own. Then download Discuz! Find the source code corresponding to NT, find the dnt encryption function section, obtain the User Password section, change it to a password that cannot be decrypted, and then compile VS2008. [I don't know why, I directly compiled and put it back, but it was a direct Error], and then decompiled the original Discuz of the Forum. forum. dll. forum. the dll is also decompiled to redeem the function body corresponding to the function and then compile it back. Use the generated DLL. Use a management account, a new password, a dnt cookie, and a DNT cookie to log on to the front-end of the target site. [Do not know Discuz! How to generate NT cookies or directly generate them is simpler. repeat the preceding steps to generate the cookie dntadmin required by the backend. web. admin. dll 3. after obtaining the dnt dntadmin cookie, use firefox's cookie management to change the cookie of the target site. Refresh the page and you will get the background management permission to export the shell. The main idea for this time is to find a way to generate the correct cookie through the md5 value that cannot be decrypted, and then use the cookie to enter the background. @ Nyannyannyan the key is called Passwordkey in config/general. config in the root directory of the program. Encryption encrypts the user password, user security questions, and user UID .... What we can do when we know this information is that we can generate cookies without re-compiling or replacement.