Database plug-in, shell, and Elevation of Privilege

Today, a friend threw me a background and said he couldn't take the shell. I just decided to go and check it out ~

After reading about the background, I had a database backup, and it hurt me. Why can't he take it?

When I saw a database backup, I despised it. As a result, I found that database backup was DataBackUp. The asp page has been deleted. That is to say, it cannot be backed up ~

Then I finally sorted out my ideas,

On the upload page, he showed the path of the original database, and I visited it decisively, but the page cannot be found. I observed it carefully and found:/Data/# xk. mdb. there is a # in the asp path. As you know, the URL with # is incorrect. Then I changed # To % 23 and accessed it again.

Locate the database,/data/% 23xk. mdb. asp His database address is asp suffix, that is to say, if I insert a horse into it, he will directly resolve the old, I will wipe, and I will also ~

Insert a sentence in his basic settings, connect the database address with the kitchen knife, and connect to the database ~

After reading the directory, it means there are a lot of other sites. In this case, it means there is no pressure to use shell in the background ~

Now I have submitted the privilege and uploaded it to a horse ,~

It means that the old man finally gave me the old face and the formation was not deleted ~

The terminal port has been changed, but it is read out. This is not supported after the script is tested. But if you can execute the command, let's talk about it ~

When uploading CMD, his grandmother's missing objects .. Old enough to make a decision ~

Can be executed, indicating that the elevation of permission is not under pressure www.2cto.com ~ One PR ends the battle ~

I uploaded a PR file, but the permission was low. I decided to re-upload the file ~

Decisive system permissions ~

However, the user cannot be added ~ Check the patch ~

I couldn't add any patches. I checked the Directory and didn't find any soft targets. I went, it hurts ~ Change other EXP ~

Ms10048EXP wins the game ~ This penetration is over ~ GA