Go through the smart innovation IIS Firewall

 

A few days ago, the RILL in the group asked me about how to bypass the IIS firewall and get the SHELL smoothly. Today, I occasionally encountered such a firewall and looked at it.

As follows:

 

The current webpage is temporarily inaccessible (blocking hard drive directory file filtering)

Cause of access failure:

The server administrator has enabled the hard disk directory file filtering Interception Function.

Solution

Contact the server administrator to query the firewall log file to view the details. If it is an error
Intercept. Check the configured interception rules or add this directory or file to the whitelist.

Bytes -------------------------------------------------------------------------------------

Technical Information (provided for server administrators)

If you want to customize the error page prompt information, modify the Server HTML template file.

Bytes -------------------------------------------------------------------------------------

Product Support Service

Professional firewall, Free Download trial http://www.zcnt.com

The above is the information returned by malicious code on the wall.

So which character or format does the firewall drop? This firewall is free of charge. You can continue to study it. For the sake of convenience, I tried the method and did not study it specially.

When the IIS parsing vulnerability is exploited, it is regarded as a malicious script and thus caused by the wall.

Let's see: how to avoid a wall.

If a file is replaced with a file, and the upload is truncated, the danger of being damaged by the wall can be bypassed.

Analysis: Maybe this is the reason for smart innovation, because it is a firewall designed only for IIS and not for files, so it bypasses the IIS folder, there may be some gains on the files in the directory. In fact, the IIS parsing vulnerability is also a truncation method. I do not know that this .asp;.swf should not be regarded as an IIS resolution vulnerability or be counted as a cut-off ....

From: zgg Space