New Concept foreign language network teaching platform file upload and repair solution

Information Leakage and lax permissions caused by column directory and upload to a university as an example: http://www.bkjia.com/NPELSNPELS_LearningCenter_5.0 client Update.exe. the config File exposes an important address <setting name = "Update_CommonSvr_CommonService" serializeAs = "String"> <value> http: // 222.30.60.3/NPELS/CommonService. asmx </value> </setting> and version <add key = "TVersion" value = "1, 0, 0, 2187"> </add> access http directly: // 222.30.60.3/NPELS/CommonService. asmx uses GetTestClientFileList to perform direct http get column Directory: http: // www .Bkjia.com/NPELS/CommonService. asmx/GetTestClientFileList? Version = 1, 0, 0, 2187 further column directory (the returned webpage is large and can be wget directly) http: // xxx/NPELS/CommonService. asmx/GetTestClientFileList? Version = .. /.. /It is found that http:/xxx/npelsv/editor/editor.htm can be uploaded, And the aspx Trojan can be uploaded directly. You do not need to change the suffix name or upload the file header, and then continue to the column directory to find the trojan address and access OOXX directly.

 Solution:


It seems that the test system must use CommonService. asmx is recommended to encrypt the configuration file or prevent it from being leaked and check or delete Upload entries, such as http: // 222.30.60.3/NPELS/Upload. same as aspx