Virtual Host Privilege Escalation experience

This time, the target is a virtual host and the data of one of the forums is required. The target station is discuz x2.5, and the last few 0-day attempts have been made, and the passwords of several logon ports have been tried again, without any gains. So we started the bypass tour.
First, I need to know whether the other virtual host supports asp.net. Under normal circumstances, the aspx permission is higher than asp and php.
Find a nearby website and add xxxx. aspx to it to check the error page.


This is the default 404 page of iis. Generally, this site does not support aspx. If aspx is supported, the returned error page does not.

Next we will face a problem. How can we find a website that supports aspx and intrude into it to escalate permissions.

Here I have a tip to use bing's search function.


In this way, we can find the aspx website under the ip address 61.191.54.20.
Finding An aspx website does not necessarily mean it can be successful, but it takes a small step.
For the aspx website, I first need to check whether fckeditor, findeditor, and cuteEditor exist.
Coincidentally, the fckeditor editor is available on the first site.
Then we got the webshell.


After I put it right away, usually the first step is to upload a batch of aspx Trojans to see if the security mode is enabled, and then scan the writable directory again.




Then the aspx detection results are also returned, and the security mode is not enabled, and the permissions are not limited .. Www.2cto.com





Then I found several replaceable files...

Then, the iis configuration file is read, and the ftp and password of the Administrator account are displayed .. The target station is ready.

In fact, this server can be completed in 15 minutes if the process is fast .. In order to write this article, it took a lot of time to reproduce the process.

I often read articles in red and black. I will take this article as a feedback this time.

Edit Note: thanks to the support of the author. It is recommended that you mark the author's information in the manuscript, or post the manuscript after logging on to the website, so that you can easily contact other users.