Through the target Drone Web site Editor vulnerability, get target drone on the KEY.txt file, and the contents of the file as a key value to submit

Lab Environment:

Category	Ip
target drone -windows	172.16.1.110		"
thunderbolt -kali	172.16.1.111
Attack -windows	172.16.1.112

title: Through the target drone web site editor loopholes, get target drone on the KEY.txt file, and submits the contents of the file as a key value.

Problem Solving Process:

just see this topic is the time is a face, when the virtual machine after starting to think of the FCK should be a class of editor vulnerability,

first scan with Kali , see this should understand the site should be ASP site, and is IIS6.0, there is an analysis of the vulnerability

650) this.width=650; "Src=" https://s5.51cto.com/wyfs02/M01/9A/10/wKioL1lQztSyg6wMAAT83R6BAac868.png-wh_500x0-wm_ 3-wmp_4-s_393005766.png "style=" Float:none; "title=" 1.png "alt=" Wkiol1lqztsyg6wmaat83r6baac868.png-wh_50 "/>

Go to Windows and look in the browser.

650) this.width=650; "Src=" https://s5.51cto.com/wyfs02/M00/9A/10/wKiom1lQztbyzUoYAALj9w-BJU0836.png-wh_500x0-wm_ 3-wmp_4-s_3115486827.png "style=" Float:none; "title=" 2.png "alt=" Wkiom1lqztbyzuoyaalj9w-bju0836.png-wh_50 "/>

It's time to look for the FCK editor, but I didn't find the scan tool and I tried to see if there was an injection bug.

There is an injection vulnerability;

650) this.width=650; "Src=" https://s2.51cto.com/wyfs02/M01/9A/10/wKiom1lQztbggr1QAAFOlbFLWvc987.png-wh_500x0-wm_ 3-wmp_4-s_740836507.png "style=" Float:none; "title=" 3.png "alt=" Wkiom1lqztbggr1qaafolbflwvc987.png-wh_50 "/>

Generally this game of the site background password should be the default, I will no longer inject directly to find backstage; I lost an admin, get backstage, try to get back office account and password are admin

650) this.width=650; "Src=" https://s4.51cto.com/wyfs02/M02/9A/10/wKioL1lQzteTvz0RAAEJXO8sdps088.png-wh_500x0-wm_ 3-wmp_4-s_129014206.png "style=" Float:none; "title=" 4.png "alt=" Wkiol1lqztetvz0raaejxo8sdps088.png-wh_50 "/>

Log in to the background: in the picture management found this, should be the test person in the verification of the time left, is a big horse, but helpless do not know the password

650) this.width=650; "Src=" https://s5.51cto.com/wyfs02/M00/9A/10/wKiom1lQztqxjMP9AAY4cOxRnXI106.png-wh_500x0-wm_ 3-wmp_4-s_4194160289.png "style=" Float:none; "title=" 5.png "alt=" Wkiom1lqztqxjmp9aay4coxrnxi106.png-wh_50 "/>

Get a second word and upload it.

650) this.width=650; "Src=" https://s1.51cto.com/wyfs02/M00/9A/10/wKioL1lQztqzFumKAAEhNO54YHs357.png-wh_500x0-wm_ 3-wmp_4-s_1159678446.png "style=" Float:none; "title=" 6.png "alt=" Wkiol1lqztqzfumkaaehno54yhs357.png-wh_50 "/>

Get the path

650) this.width=650; "Src=" https://s5.51cto.com/wyfs02/M01/9A/10/wKiom1lQztvAdhSaAACWcipR-rg808.png-wh_500x0-wm_ 3-wmp_4-s_1230168044.png "style=" Float:none; "title=" 7.png "alt=" Wkiom1lqztvadhsaaacwcipr-rg808.png-wh_50 "/>

Use a chopper to connect to flag

650) this.width=650; "Src=" https://s5.51cto.com/wyfs02/M01/9A/10/wKioL1lQztuDDj3RAAECSkoo9MI026.png-wh_500x0-wm_ 3-wmp_4-s_1188067742.png "style=" Float:none; "title=" 8.png "alt=" Wkiol1lqztuddj3raaecskoo9mi026.png-wh_50 "/>

650) this.width=650; "Src=" https://s2.51cto.com/wyfs02/M01/9A/10/wKioL1lQztzSOyHEAAAROKjWlfg907.png-wh_500x0-wm_ 3-wmp_4-s_3064408583.png "style=" Float:none; "title=" 9.png "alt=" Wkiol1lqztzsoyheaaarokjwlfg907.png-wh_50 "/>

650) this.width=650; "Src=" https://s2.51cto.com/wyfs02/M02/9A/10/wKiom1lQzt2TY-gnAAQF1aT1ixQ555.png-wh_500x0-wm_ 3-wmp_4-s_509986140.png "style=" Float:none; "title=" rewards. png "alt=" wkiom1lqzt2ty-gnaaqf1at1ixq555.png-wh_50 "/>

This article is from the "12995943" blog, please be sure to keep this source http://taindaochouqin.blog.51cto.com/12995943/1942105

Through a vulnerability in the editor of the target drone web site, get the KEY.txt file on target drone and submit the contents of the file as a key value