Taoyuan online storage Getshell

Affected Versions: Latest
Author: the love of the silver God
I met this program during penetration with the silver God and the static stream, and found that this program can directly Getshell to be exact or use the hole in IIS.
To put it simply, there is a default account and password for testing (depending on whether the management is disabled)
After logging in, upload a trojan that exploits the IIS Parsing Vulnerability.
Unfortunately, we don't know the path. We use other methods to get a server.
The path is www.test.com/xx/id/1.asp%1.jpg.
Xx = see the following description
ID = your account
Unfortunately, what should we do if we find that many of them are different in XX?
Later, we found that the directory name of XX can be exposed by directly submitting the following statement.
Http: // test/show. aspx? Type = 1 & filepath = http: // test/
In addition :,
1. Sometimes the default guest is disabled and you need to register for management review.
2. Do not change the name of the uploaded file. If you upload 1.jpg, you cannot change it to 1.asp;1.jpg. If the uploaded file is modified, the uploaded file will eat a ";" symbol.
{This article