Serv-u the implementation of the ASP version of local privilege Promotion _ Vulnerability Research

Source: Internet
Author: User
Tags rar ftp protocol
The spread of the Internet can be implemented using Mswinsock controls, which is not a good drop. Because this is a third party component, oh, the probability is quite small, since to kill the dead, hehe, sure to adopt a set of means of killing.
Serv-u Server Management where the FTP protocol is used, so we should study the FTP protocol first.

The authentication process for the normal FTP protocol:

Serv-u FTP Server v5.2 for WinSock ready ...

User Lake2

331 User name Okay, need password.

Pass Lake2lake2

230 User logged in, proceed.

......




Now I'm screwing around:



Serv-u FTP Server v5.2 for WinSock ready ...

Hi, I ' m Bill gates!

530 not logged in.

open!

530 not logged in.

I am Hacker!

530 not logged in.

Give you

530 not logged in.

User Lake2

331 User name Okay, need password.

Pass Lake2lake2

230 User logged in, proceed.

......




Note that if the expected data is not user Xxx,serv-u will return the error message and wait for the correct login command. What is implied, hehe, implies that we will succeed.

More recently, the XMLHTTP component is used to send and receive data using the HTTP protocol. We will use this component to implement Serv-u's claim. The question now is how do we send the FTP protocol through the HTTP protocol?

Hey, did not see the results of my painstaking testing, as long as the use of post to submit data, post is the FTP command on the line, because the front of the HTTP headers will be serv-u considered illegal commands and ignored, and post content that FTP command will be accepted to execute!

Due to the characteristics of XMLHTTP and serv-u, it brings a series of problems: XMLHTTP has no timeout setting, because the HTTP headers that can't be answered by the server will always hang; XMLHTTP is single user and reused socket, There are only 2 or 4 connections to the same target based on the HTTP protocol version, so you cannot connect once (or 2) after you delete the domain by adding the domain; The Serv-u management mode uses the pseudo FTP protocol, which means that the QUIT command is not recognized, Cause the connection cannot disconnect (with ServerXMLHTTP can solve these problems very well, but only under XP, 2000/2003 is not good, depressed).

So there is only one compromise to solve some of these problems:

1, XMLHTTP first add FTP users;

2, the landing of their own FTP with a new account for the implementation of N-Multiple command rights;

3, XMLHTTP Delete new user

You have to remember, because the connection can not disconnect, you have only one or two times to perform the above steps of the opportunity! If you want to come again, oh, wait for IIS or FTP restart it.

Fortunately, I have also written a use of the implementation of the FTP account to execute the command procedures, making the 2nd step convenient a lot of programs here download: Http://xiazai.jb51.net/tools/hacktools/ftpshell.rar

Complete ASP code here to download: Http://xiazai.jb51.net/tools/hacktools/suASP.rar

The ASP program will add a user name Lake password admin123 in Port 21 user, what special circumstances (such as FTP port is not 21), change the code yourself.

Extrapolate, it seems that you can also use ASP to access FTP in certain situations to do something, but that's your business.

Take care of the enjoy it!
Related Article

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.