IIS 0Day-the IIS of another parsing vulnerability that! Similar to a. asp at the end of the directory! - Vulnerability warning-the black bar safety net

ID MYHACK58:62201026593
Type myhack58
Reporter 佚名
Modified 2010-03-30T00:00:00


When uploading images for x. asp;x. jpg, IIS automatically resolves to the asp format,

So we just upload after x. asp;x. jpg such a form, you can perform our horses, tested, x.php;x. jpg is also possible to perform.



The webshell file name changed 1. asp;. jpg Direct IE access is parsed into ASP That is the asp shell into X. asp;. jpg in win2003 IIS6 environment will automatically resolve to the asp We have to combat it out to see Application: a hidden shell the shell of the suffix is changed to. asp;. jpg cheat administrator has been to hide the shell the purpose of the upload/ Second upload get shell is limited only to the upload after the file name remains unchanged website Three 1. aspx;. jpg 1.php;. jpg

Test asp The can aspx not other not tested