Database plug-in, shell, and Elevation of Privilege

Source: Internet
Author: User

Today, a friend threw me a background and said he couldn't take the shell. I just decided to go and check it out ~

After reading about the background, I had a database backup, and it hurt me. Why can't he take it?

When I saw a database backup, I despised it. As a result, I found that database backup was DataBackUp. The asp page has been deleted. That is to say, it cannot be backed up ~

Then I finally sorted out my ideas,

On the upload page, he showed the path of the original database, and I visited it decisively, but the page cannot be found. I observed it carefully and found:/Data/# xk. mdb. there is a # in the asp path. As you know, the URL with # is incorrect. Then I changed # To % 23 and accessed it again.

Locate the database,/data/% 23xk. mdb. asp His database address is asp suffix, that is to say, if I insert a horse into it, he will directly resolve the old, I will wipe, and I will also ~

Insert a sentence in his basic settings, connect the database address with the kitchen knife, and connect to the database ~

After reading the directory, it means there are a lot of other sites. In this case, it means there is no pressure to use shell in the background ~

Now I have submitted the privilege and uploaded it to a horse ,~

It means that the old man finally gave me the old face and the formation was not deleted ~

The terminal port has been changed, but it is read out. This is not supported after the script is tested. But if you can execute the command, let's talk about it ~

When uploading CMD, his grandmother's missing objects .. Old enough to make a decision ~

Can be executed, indicating that the elevation of permission is not under pressure ~ One PR ends the battle ~

I uploaded a PR file, but the permission was low. I decided to re-upload the file ~

Decisive system permissions ~

However, the user cannot be added ~ Check the patch ~

I couldn't add any patches. I checked the Directory and didn't find any soft targets. I went, it hurts ~ Change other EXP ~

Ms10048EXP wins the game ~ This penetration is over ~ GA

Related Article

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.