Local element modification upload get shell

Target Site: http://www.bkjia.com/admin/index. asp

Check in the background: 1. There is an upload

2. Database Operations

3. system settings

 

 

I have three methods to use shell.

1. Upload

Upload the file path of the captured file directly. You can consider submitting the file by NC or creating a. asp folder by modifying the elements locally.

Here I use google chrome to review elements directly

 

 

 

../Uppics/1.asa/ 201211920201285298.jpg

 

 

 

 

 

2. database recovery

Upload an image horse and get the path.

../Uppics/201211920215665549.jpg

 

Then restore the database

The input box of the background database path still cannot be clicked, which can be broken through local structure. Here, google chrome is used to modify the element to kill it.

 

 

The recovery path can be written as long as you have the write permission. Click OK.

 

 

OK. Check the next sentence.

 

 

3. modify the system configuration and insert a sentence. If you are afraid of inserting the website to death, you will not insert it here. If you do not close the integration, you will not be careful. Here there is shell, you can also change it back when it crashes...