A wonderful file upload on ZTE bypasses GetShell

A wonderful file upload on ZTE bypasses GetShell

After a long time, I finally uploaded it. Come to the homepage ~

http://www.appstar.com.cn

On the ZTE application star website, we saw a Common File Upload Bypass Vulnerability.

Next let's take a look at the wonderful file upload.


#1. First, you must go to the upload location and find a place to create a graphic APP. During the process, you will be asked to upload the relevant files, upload a correct docx document before uploading the jsp file. The following message is displayed:

#2 originally intended to use the burp interception for bypassing, and found that no message was intercepted, So I analyzed it for a long time and found this:

The file upload format is controlled by the imgTextBook. js file.



#3. log out of the website, clear all the caches, enable the interception server with burp, and wait for the imgTextBook to be loaded again. js request, and then put the requested imgTextBook. the js file has been changed and has been blocked for a long time:

Okay, the js file has been changed:

#4 next, you can directly upload the jsp shell. You can easily find the uploaded file path by checking the js Code:

Shell address:Http://www.appstar.com.cn/upload/itBook/2015010507709/it201503010048023471/word/J.jsp

 

 

Solution:

Filter