Introduction to the principle of the error message when executing the aspx Trojan

 

Author: constanding

Each student may encounter an error message when uploading the aspx Trojan and cannot execute the cmd command or IISSPY. For example:
Figure 1]

I believe many people do not understand the principles. Let me talk about it.
First, post some microsoft official instructions on configuring code access security in ASP. NET.
By default, Web applications run at the level of full trust with unlimited permissions. To modify the trust level of ASP. NET code access security, you must set a parameter in Machine. config or Web. config, and then configure the application as a partially trusted application.
Configure the trust level
The <trust> element in web. config controls whether to enable code access security for Web applications. Open web. config and search for <trust>. You can see the following content.
<System. web>
<! -- Level = "[Full | High | Medium | Low | Minimal]" -->
<Trust level = "Full" originUrl = ""/>
</System. web>
If you set the trust level to "completely", code access security is disabled because access to resources is required by permissions is not blocked. This is the only option for Web applications built on. NET Framework 1.0. Refer to the "full" to "lowest" permission list below. Several permissions are removed at each level. By gradually limiting application permissions, you can only access secure resources and perform privileged operations. Application Isolation is generated at each level to a greater extent. Figure 1 shows the predefined trust level, pointing out the main limits compared with the previous level.
Figure 2 ASP. NET trust level restrictions

Lock trust level

If the Web server administrator wants to ensure application isolation through code access security and restrict access to system resources, the Administrator must be able to define a security policy at the computer level and prevent personal programs from replacing it.

The Application Service Provider (or anyone responsible for running various Web applications on the same server) must lock the trust level of all Web applications. Therefore, in the web. config file<Location>Add in tag<Trust>Element, SetAllowOverrideSet propertyFalse, As shown in the following example.

<Location allowOverride = "false">
<System. web>
<! -- Level = "[Full | High | Medium | Low | Minimal]" -->
<Trust level = "Medium" originUrl = ""/>
</System. web>
</Location>
Let's talk about my own understanding and my testing on a virtual machine.
The web. config file to be set exists in C: \ WINDOWS \ Microsoft. NET \ Framework \ v2.0.50727 \ CONFIG \.
The key part is not modified by default.
<SecurityPolicy>
<TrustLevel name = "Full" policyFile = "internal"/>
<TrustLevel name = "High" policyFile = "web_hightrust.config"/>
<TrustLevel name = "Medium" policyFile = "web_mediumtrust.config"/>
<TrustLevel name = "Low" policyFile = "web_lowtrust.config"/>
<TrustLevel name = "Minimal" policyFile = "web_minimaltrust.config"/>
</SecurityPolicy>
<Trust level = "Full" originUrl = ""/>
Please note that trust level = "Full" is the key here,
Full is the Full permission, which is the default setting of the system. There are no restrictions on the permissions. You can execute the aspx Trojan without restrictions on functions. You can use aspx to connect in one sentence.
High: the code access permission is High. In this case, you can execute the aspx Trojan, but the function is restricted. You cannot execute commands, view the registry, system processes, system services, or use IISSPY, the error page shown in Figure 1 is displayed. The following error occurs when you use a kitchen knife to connect aspx with one sentence:

If the site needs to support aspx and you need to configure permissions to prevent intrusion, we can choose High.
Medium is configured as Medium. Most domestic virtual hosts are configured in this way. aspx ing exists in the application configuration in IIS, but no aspx code can be executed. In this way, the execution of the aspx code is completely cut off.
For other permission explanations, refer to figure 1.
Relatively speaking, we only need to master the configuration of the above three permissions. After the configuration is complete, we set web. config to read-only, which ensures the security of the site and server.