One technical penetration test for a university website

My habit is to look for the background first. After all, many of the weak background addresses are open-source CMS and BBS, or they are weak.

Site: pku.edu. cninurl: admin

A bunch of things ......

There is such a system, and the weak password goes in ...... But fruitless ...... For example:

There is also a FCKEDITOR... I didn't have time to try this. I don't know if it will succeed. I will try again after I finish sending the text ...... Yes

Try it if you are interested:

Finally, we found an injection:

Search for the backend:

It's a big blow, but it's fruitless after going in ......, So I want to inject some data and try reading and writing,

Report a path.

The physical path is available. Read it.

With the inc/conn. php address

It's still root .....

Select '20180101'/xxxx/f4cku. php'

No result. I cannot write the test.

Finally, I found a phpmyadmin. It turns out that I have nothing to do with phpmyadmin.

Obtained!

Directly log on to the system. The Administrator takes a look at the following directory:

After reading this directory, I thought it was a linux system. Then I thought of UDF privilege escalation and directly inserted the hexadecimal udf content.

Into the table, but it's strange that it's not dumpfile... Egg pain ),

But

Outfile: indicates that the data cannot be written.

So I thought about this strange phenomenon,

At this time, the goddesses collectively asked: Is it windows ......?" So I checked the xampp file directory, a linux,

One windows (as you can see, the directories are different)

View by directory ...... It seems to be windows xampp, so don't hesitate ...... Write a PHP sentence

Connected ...... Windows...

Then raise the udf permission (this process is too simple, I will not talk about it, basically it is to find mysql/lib/plugin/, upload

Dll is OK, and no export is needed ......), So:

Finally, delete the shell, delete the dll, cut a graph, and leave it for you.

Tip:

PKU's sister said, "Please do not use this article for illegal purposes! No damage is allowed !"