Detection of a primary school

 

In a post bar, I found that a post was used for voting. It was said that I had a voting software, but I couldn't find the voting address and asked me to help analyze it.
Follow the address he gave and briefly read the website.
There is a management logon address at the bottom, indicating that the program is FeitecCMS during background logon, and another forum is dvbbs6.0.
The entire website architecture is FeitecCMS + dvbbs, and there is also a voting program and image display program. However, these two programs cannot tell where they are, let alone finding vulnerabilities.
First, I tried dvbbs. By default, the system account admin admin888 can be used to log on to the Apsara stack console as the administrator. After logging on, you will find that you cannot upload the file. The uploaded page is deleted.
You can register an account from the main site, but you need to review the account before logging on. If you want to register an account, you have no upload permission, so you have to give up. Then a complete set of FeitecCMS source code is provided. From the source code, the default database address is data # v390/feitec # data. asa. After testing, the database address name has not changed, but cannot be downloaded ..
After sorting out the ideas, although bbs deleted the upload page, the backup function is still usable. Change the original path .. /data # v390/feitec1_data.asa1_is 1.mdb. when downloading, the system prompts that this feature cannot be downloaded, the new version is 1.rar, And the downloaded version is changed to suffix. when mdb is opened, the Administrator febirdv password 1c1cd75dff57775c19d6ac34d6963032 cannot be cracked, and several other common passwords cannot be cracked, check that the password 123456 of the newly registered acca is encrypted into 49ba59abf20f883ee10adc39be56e057 and cannot be cracked. It is estimated that the encryption has been modified.
I have Baidu's FeitecCMS encryption method, but I have not found it. Here, by the way, I will mention the FeitecCMS password encryption, which makes up for the gap:
123456 the standard md5 value is 16-bit 49ba59abbe56e057/32-bit e10adc3949ba59abbe56e057f20f883e. In FeitecCMS, 123456 is changed to signature. For comparison, we can find that in FeitecCMS, it is to divide the md5 regular 16-bit encryption into two segments equally, and then add random 16-bit characters in the middle to combine the 32-bit. For example, 49ba59abbe56e057 is compiled into the 49ba59ab + f20f883ee10adc39 + be56e057 method. We only need to select the first 8 bits and the last 8 bits of the 32-bit encoding encrypted by FeitecCMS and combine them into 16 bits for cracking.
After understanding his encryption method, the febirdv password should be 1c1cd75dd6963032, but the prompt is "billing record --! I had to give up. The password of several common members is broken. After login, you cannot upload files. If you cannot start from the main site, you can choose the place where you vote. The voting page contains photos that can naturally upload images.
I guess the login. asp is the place where the management logon is located. I used the dvbbs backup function to back up this file to the txt format to read the code and find the <! -- # Include file = "Connections/conn. asp" --> back up the conn. asp file in txt format. The Code is as follows:
<%
'Filename= "Connection_ado_conn_string.htm"
'Type = "ADO"
'Designtimetype = "ADO"
'Http = "true"
'Catalog = ""
'Schema = ""
Dim MM_conn_STRING
MM_conn_STRING = "Provider = Microsoft. Jet. OLEDB.4.0; Data Source =" & Server. MapPath ("sldata/# shilutp. asp ")
%>
So far, the database file is found. Backup database # download shilutp. asp in rar format. Cup of cake, account admin password admin --! Nima, I am so eager to get such a password...
After logging on, click the "add contestant" Cute ewebeditor editor. Upload a sentence image and back up it to asp. webshell!
In fact, there is no technology in the entire detection process. It is nothing more than uploading and backing up. The purpose is to share ideas

Author: dog-like man's Blog