Check a well-known coffee site

I chatted with my friends for one afternoon in diocoffee For The Last Chinese New Year,

Think about it, it seems quite well-known, decisive under the baidu domain name, xxoo for ing ..
First, namp came and found that only 80 and 3389 were opened. It should be in the internal network, and the Firewall intercepted other ports,
It seems a bit rewarding. I opened put and move. Haha, I'll try it later. Let's continue watching the main site.

Test the main site:

Http://www.xxx.com/news/news.aspx? Classid = 2

Http://www.xxx.com/news/news.aspx? Classid = 1 & KeysWord =''

Manual, tool test injection, all failed, helpless, continue to google information first ..
Site: www.xxx.com inurl: asp
I personally prefer to first look at the scripts supported by the website, and usually google asp/php/aspx/jsp,

The main site shows that aspx is used, but when asp is searched, the eyes are bright and there is a bbs, which is actually 5.15 of bbsxp,
Click it and check it out. admin and admin. I wiped it and went directly to the bird .. send an article, upload an attachment, and upload the asa directly. But upload a shell, kill a Nima, and change a messy sentence. Upload and fix the problem.
Although the trojan is asp, the permissions are not small, and there are 3 or 4 sites on the server,

Two of them are a famous coffee shop in China,
But at first glance, Nima is a tent,
Switch to the sa password of several sites and continue the test. In the aspx sentence, after the connection, various information about net user and ipconfig is collected. Add an account. Don't let it go. Okay, continue to use the database connection function in the aspx shell, and add users to the net user:

Added successfully:

Previously, nmap detected that it opened 80 and 3389, saving the need to go to the forwarding port and directly entered the port. However, after entering the port, it became disgusting and vulnerable to the trend of InterScan, we can only go here to find out how to kill webshells on the Internet. The trend kill tool is very powerful, but the webshells on websites are so swollen !!