Yesterday, Xiaofan lost a background program. is a URL navigation. after reading it. it is found that most of the navigation sites use the default database and default user name and password... after obtaining the shell. the permissions are relatively large. some can directly expose the account and password that the Administrator logs on.
...... These are so coincidences... method of exploits:
Keywords: Any website, as long as there is a visit point, will be automatically ranked first, the data is updated instantly, welcome to the link
Default Database: data \ % 23 data % 23.mdb
Default Account Password: admin
Default background: admin/login. asp
The following describes the shell method.
Choose template management center in the background-you can modify a bottom file and a header file
Method: directly write the Trojan into the content of the bottom file or the header file.
Bottom file inc/foot. asp header file inc/head. asp
If you select HTML after modifying the bottom file (inc/foot. asp), an updated bottom file will be displayed on the left.
Directly connect inc/foot. asp ..
Shell to get the image of the shell process.