A day with friends and talked about the BLOG for the record the problem, inadvertently referred to the space provider IDC. Speaking of IDC, didn't think friends are very unpleasant experience. The thing is this: at the time he was also inexperienced, and want a virtual host to do site, of course, out of habit problems, he offers their own virtual host space[service]()this[service]()device done[security testing](), as a result he got the space provider WEB directory permissions, so...... A little give yourself added time of the year. Didn't think he space provider is found, the closed friend of the space and FTP account. Then he looked under the space trader turned out connected to the Electronic Business license(ICP certificate)are not! Khan ing.... But it is said later that[service]()enhances Security, Configuration was also good! Since you are not only unlawful but also offended even that cute couldn't be more lovely friends, that it is[free]()to make you secondary[safety testing]()! Nonsense not say more, since friends believe that his safety may also be that the system scan this. it wasn't necessary to do, looking directly at the WEB Security! Find Ah find Ah find friends, find a friend...... Halo! Master security is indeed passable, the filter is very strict! Then Domain 3.0 see the following. Halo, so many virtual host with your own station to put together--really will make money Ah! Well, we continue. The import URL path to the scan, sweep out a few upfile. asp upload. asp, try to upload, were unsuccessful(not surprising, after all, is a very old hole). Since this is not, we then look to tell you but have patience. Just from Domain 3.0 left a station in, is a online shopping site that has an ICP license! SORRY SORRY my goal is not you, just borrow a WebShell use only! Went to great lengths to explain after the start of the detection....... First find the BBS-no, but actually saw a message Board, good! Is you, let's see. Open generally to see the next, this message Board couldn't be simpler, try a couple of“and 1=1”,“and 1=2”Not Found problem. Storm[data]()to the library path also don't want to, this BT IDC have all been doing the wrong process, return to the Customize page, so even if the wrong also the lack of useful information(but if it is MSSQL[Data]()to the library at the injection point there are ways to solve this problem) is! At this time, the eyes fell on the“search message”. Hastened to open, intuition told me here are problems. The front saw a message, the keyword is“popular”, that we start in our search box to search the“downloads”and return to the normal page. Then when I want to construct the detection statement of the time and there is a small problem, the query box has a character length limit. But this little CASE! We put the current page source saved to a Local, the search Action to find the following statement: Original code: \------------------------------------------------------------------------------------------ <FORM action=searchresult. the asp method=post> <TABLE class=lybtable height=6 4 cellSpacing=0 cellPadding=0 width=6 5 0 align=center> <TBODY> <TR> <TD width="1 0 0%" height=6 4> <DIV align=center><FONT color=#0 0 0 0 0 0> <B> query:</B> <SELECT size=1 name=classid> <OPTION selected>comment</OPTION> <OPTION>reply</OPTION> <OPTION>name</OPTION></SELECT> keywords: <INPUT maxLength=1 2 size=2 8 name=keyword> <INPUT class=noborder accessKey=s type=submit value=query(S) name=B1> </FONT></DIV></TD></TR></TBODY></TABLE></FORM> \----------------------------------------------------------------------------------------- Here we need to change several places, put“action=searchresult. asp”to“action=http://www. xxx. com/lyb/searchresult. asp”(here I hide the original address, in order to protect themselves also to protect the site), of course, can not forget to change the most important thing:“maxLength=1 2”to “maxLength=1 5 2”, the modified code is as follows: \------------------------------------------------------------------------------------------ <FORM action=http://www. xxx. com/lyb/searchresult. asp method=post> <TABLE class=lybtable height=6 4 cellSpacing=0 cellPadding=0 width=6 5 0 align=center> <TBODY> <TR> <TD width="1 0 0%" height=6 4> <DIV align=center><FONT color=#0 0 0 0 0 0> <B> query:</B> <SELECT size=1 name=classid> <OPTION selected>comment</OPTION> <OPTION>reply</OPTION> <OPTION>name</OPTION></SELECT> keywords: <INPUT maxLength=1 5 2 size=2 8 name=keyword> <INPUT class=noborder accessKey=s type=submit value=query(S) name=B1> </FONT></DIV></TD></TR></TBODY></TABLE></FORM> \------------------------------------------------------------------------------------------ Well, then we can local submission! Open the modified page in the search box query:“popular%' and 1=1 and '%'='”--return to the normal page. Next, we try to query:“popular%' and 1=2 and '%'='”--go wrong! Sure enough there are problems. Well, since find a breakthrough, we continue! Manually guess too tired to NBSI 2. We construct the following URL: =message content&keyword=popular, in keywords enter a normal page in a word, here I selected“2 0 0 5”, well, GO! Gave the order, NBSI 2 is quickly running out, before long, the password out. Halo, MD5 encryption, but it doesn't matter, all of a sudden it cracked out. Don't sweep path, on the page directly on the administrator login link, we have successfully logged in! But the situation is not too optimistic, the background function is really simple couldn't be more simple, try to get a WebShell don't say, also really not easy! The idea of a turn, sweep the shopping system of the background(the original also want to talk to the message Board as directly looking for a administrator login link, but can't find) it! Scan results unfortunately, the background path we don't know! Here is it can't? Way not not, but you can't find! We noticed here. The administrator information including mail account, try holding the attitude, I try to log on to the administrator mailbox--turned out successful! Immediately quit, what comes to mind? For the FTP account! With a mailbox@the front of the account number and in front of we crack out the password for a successful connection over between the commercial FTP is! Then? Of course is to upload a WebShell! Immediately transfer the marine 2 0 0 6 Network Security China zrrrshoo personal special edition, visit the link, not to be killed, success. A cursory look under catalog settings, the standard virtual host permissions assigned: each space is independently run, the folder named[name](), you can not traverse through the other site directory, CDE partition root directory concept does not have permission to browse it! Just a“net user”, as expected, can't perform! Try to jump to“c:\winnt\system32\inetsrv\data\”success! 上传一个改名了的 cmd.exe in the ocean in the specified path“c:\winnt\system32\inetsrv\data\cmd.exe/c”execute the command—success!“net start”, again unsurprisingly, the[service](). sure enough there is a Serv-U obediently lying there, waiting to us to enhance the permissions. But let's not optimism, it didn't work before what are not OK!“netstat-an”: the printed into the eye includes a“4 3 9 5 8”, it seems no imagine in the complex! Next directory jump to"C:\Documents and Settings\All Users\Start Menu\Programs\"find Serv-U directory, go download shortcuts back! Know he the Serv-U installation path:“D:\serv-U\”and see if you can jump into—success! Another is the old-fashioned way, writing new user to“ServUDaemon. ini”ready to go, turned out to prompt an error! Depressed, it seems there is no write permission...... However, a mind-popping thing happened, would have thought there should be a firewall filter in addition to a few outside of all port, didn't think to upload Fpipe after forwarding a high port can be directly connected, that also say what, the local new FTP domains, remote connection management, add the user FTP on the go“quote site exec net user zrrrshoo /add”; and“quote site exec net user zrrrshoo zrrr”; the“quote site exec net localgroup administrators zrrrshoo /add”, he had 3 3 8 9, I'm afraid to do the login restrictions, but the fact that my worry is redundant! Directly login into it. Well, security matters, clear all logs, then a ChallengeCollapsar, with 3 0 the proxy transform path access 1 5 minutes(mainly do not let WEB log empty) OK! Tomorrow put him to the friends deal with it!

From the search filter is not strict to the IDC host of penetration-vulnerability warning-the black bar safety net