Try IIS write permission and move to asp

Windows IIS has been prone to vulnerabilities, but vulnerabilities can be patched. Write Permission is not a vulnerability because of improper settings of IIS. the issue of IIS write permission has been exposed for a long time. Many people use it to get more than N webshells and catch more than N bots.

Problem Source: in the IIS Service Manager, select a directory to view its properties. there is a "write" option in the directory attribute item, indicating "users can create and delete resources", so you can use telnet or nc to analyze whether we can write in.

I gave up for two years. I didn't even want to play when this problem came out...

The last day, when I got online, I always saw an alert.txt file in the root directory of the website. The content is:
Reference
There are some secure problems in you system, please fix it.
ZwelL
, I am very surprised, why? Later I found that it is the text written by default by the IIS PUT permission scanning tool IIS write permission.

I think this is easier than finding a vulnerability and trying to inject or upload it to webshell. So I tried to play with it, so I checked out the machine in the school and tried an IP segment, but it was actually alive, inadvertently: youth.seu.edu.cn was originally the Youth League committee. I went to the home page and found that with the help of the soft school and some other experts, the page was improved. I remember two years ago, it was an asp page, I guess the database has been replaced. net. however, the server won't change, and the system won't change either, so you can write a txt file or move it to asp to get the webshell at once. i'm late, N and more shells are in it. Forget it. I'm not very interested in the school's website anyway. I have the right to pass...

Bored at night, so I went to Baidu to find a website, ping an IP address, and fill in the IP address segment for scanning. I also found a lot of bots, cold, and had to talk about the current network administrator, why didn't I pay attention to this problem for so long... webshell also took a lot, but I found that not all bots can be successfully transferred from txt to asp, and this problem often occurs:
Reference
HTTP/1.1 207 Multi-Status
Server: Microsoft-Microsoft IIS/5.0
Date: Mon, 18 Jun 2007 08:17:29 GMT
X-Powered-By: ASP. NET
Location: http: // 211.65.63.138/shell. asp
Content-Type: text/xml
Transfer-Encoding: chunked

B6
<? Xml version = "1.0"?> <A: multistatus xmlns: a = "DAV:"> <a: response> <a: href> http: // 211.65.63.138/shell. asp </a: href> <a: status> HTTP/1.1 403 Forbidden </a: status> </a: response> </a: multistatus>
0
I haven't found any answer after Baidu for a long time. The only post that says yes is like this: "You can use GET to create a specific character ", but I really don't understand.

Upload (I think it's an upload problem ...) the result can be converted successfully, but the space is changed to % 20, which becomes the standard file suffix. In fact, it is supported.. net cannot upload the aspx suffix, but can upload php, not. net aspx and php can be uploaded, but cannot be parsed.

If this problem is solved, the use of the IIS write permission will be perfect, because too many OK statements cannot be converted, and we look forward to the experts to solve it !~