逻辑漏洞+编辑器0day=getshell+内网漫游
又是一个深夜,记录前段时间测试的过程。唉,每次小有所学就要懈怠一会。全文高强度打码。
0x00 一个登录框
使用google hacking语法,翻了一翻,锁定了目标范围内一个看起来普普通通的登录页面。

aspx写的页面,应该是Windows服务器。顺手点了一下找回密码,需要提供注册使用的邮箱,没有提前搜集邮箱信息,放弃任意密码重置。
爆破密码,超过一定次数锁定账户,登陆频繁ban IP,放弃暴力破解。
尝试SQL注入,失败。
F12审查元素,发现了二维码登录的接口,但是无法访问。看来,只能从用户注册入手了。
0x01 任意账户注册
打开注册页面,走个流程,填好信息表。

麻利地回车,系统却提示需要确认邮件。

emmm,不耐烦地去邮箱看一下。

嗯,只需要点一下这里,或者那里,就可以完成账号激活操作。看了一下链接,有点意思。
这个URL的结构是这样的:http://x.xx.com/x.aspx?userName=aaa&Tomail=bbb&passWord=ccc
刚好包含了我注册的用户信息,那么,如果我直接构造一个URL,点击之后是不是就能跳过邮箱验证来激活账号了?
想到就试,随意注册一个账号、构造链接、访问、激活,一气呵成。

逻辑漏洞到手,任意账户注册。
0x02 失败的尝试
登陆一下,进来了,里面是长这个样子的= =。

是个投稿的页面,随便点点浏览一下,没有什么东西,功能不怎么多。
看来只有个人中心可以玩了,看看有没有XSS、CSRF,越权什么的。
没有头像,测了一下。输出编码,XSS放弃;通过加密过的cookie来鉴权,且没有敏感的参数,越权放弃;每一步操作都有大量的随机字符串和冗长的参数,挑了几个关键参数构造poc,CSRF失败;不存在SQL注入。
0x03 发现留言板
测试累了,歇了一会,不争气地打起了手游。又玩累了,继续测试。
会不会漏掉了什么功能,要不要fuzz一下。握着鼠标划了一会,发现上面竟然有下拉菜单,长这个样子(反色处理部分)。

有的玩了,有留言就有留言板,打开看看。没见过这个编辑器,没有什么公开漏洞,但是百度百科有记录,也是个有头有脸的编辑器了。

打开插入图片,弹出了一个图片管理器。

脸一黑,居然是白名单策略。试试绕过,失败;试试文件解析,也失败。难道这次测试就以一个低危逻辑漏洞收尾了吗….
0x04 突破白名单
不慌,还有个浏览页面的功能。只能浏览Upload目录,抓包看看能不能改参数来实现目录遍历。

嗯,这一大串一大串的大小写字母+数字等号,不是base64吗。一段一段地解码,有的解不开,疑似经过加密;有的解开了,是无用参数。解到图上这一段,就有点意思了。
里面出现了一些敏感参数:FileType、ViewPaths、FileBrowse等,但是还有第二层base64编码。

继续解开看看,非人哉,还有第三层base64编码。

但是仔细看看,这几个密文的开头都一样,根据base64的编码规则,说明明文的开头也一样,那么这几个到底是什么玩意呢。
于是小心翼翼地解开了第三层编码(Burp Suite里字好小,为了不选中逗号,鼠标要挪半天)。

哎嘿,解开了。这不就是传说中的前端传参吗?(假的,我也没听过这传说。)
激动地将jpg改成了aspx,小心翼翼地编码回去,放包。

这次白名单是不是比之前好看多了,光看不行,试一试。谨慎地上传了一个aspx空文件。

但是,,,不能访问,直接跳转到错误页。不应该,aspx的文件大小都能看到了,应该是传上去了,应该看到一个200的空白页面才对。难道这就完了吗….
0x05 千辛万苦 getshell
既然这windows服务器能跑aspx,那asp是不是也能跑?
小心翼翼地重新抓包,三层解码,这次我把aspx、asp都加到白名单里了,再小心翼翼地编码回去。
这次按照图片的命名规则,直接传了菜刀的小马。

复制链接,访问了一下,500内部错误。
不错,说明脚本上传了,而且被运行了。

打开菜刀,成功拿下。美中不足的就是中文目录乱码了,上了冰蝎马。

OK,完美。
0x06 成功提权 漫游内网
传马,msf上线,MS16-075顺利提权。

存在内网,没有域,扫描一波内网。

OK,不再深入。
0x07 总结
这次测试花了一个下午,拿到了一个第三方编辑器的任意文件上传0day,成功提权收获颇丰。
细心一点,再耐心一点。
有没有试着F12改元素上传了?
这个文件上传是后端校验白名单,前端的参数传给后端了
It’s time for communities to rally.
Makes sense to me.
Appreciate you sharing, great blog article. Great.
how long does it take sildenafil to work sildenafil cvs
I was able to find good advice from your content.
Thanks for finally talking about > صفاقس:اجبار مقاول على إعادة تعبيد طريق خالف في عمله المواصفات موقع جريدة الرأي العام
stromectol ivermectin ivermectin pour on for sheep
Very good article. Cool.
Very informative post.Really looking forward to read more. Will read on…
Thank you ever so for you article post.Much thanks again.
I really like and appreciate your article post.Thanks Again. Fantastic.
I really like and appreciate your post.Really thank you! Cool.
Awesome blog post. Awesome.
wow, awesome article.Really thank you! Really Cool.
A round of applause for your article. Much obliged.
ivermectin products does ivermectin kill fleas
Very neat article post.Thanks Again. Really Great.
I really liked your post.Thanks Again.
Wow, great blog post. Want more.
Very fine blog.
A big thank you for your blog article.Thanks Again. Really Cool.
methods priorities us. bought information, to tadalafil 5
Very good info. Lucky me I ran across your site by accident (stumbleupon). I have book marked it for later.
Very neat blog.Really thank you! Great.
Propecia Pharmacie Propecia Gratuit Pilules
ivermectin 500ml ivermectin for humans – ivermectin 6
Very good post.Much thanks again. Much obliged.
I was able to find good advice from your content.
Wow, great article post.Thanks Again. Will read on…
Write more stories, more chapters.
Wow, great blog post.Really looking forward to read more. Keep writing.
A big thank you for your article. Cool.
Thank you ever so for you article. Awesome.
Thank you for your blog article.Really looking forward to read more. Really Cool.
bookmarked!!, I love your website!
Muchos Gracias for your blog article.Much thanks again.
Regards for helping out, superb info.
A round of applause for your blog article.Really looking forward to read more. Great.
online pharmacy australia canadapharmacyonline legit – canadian pharmacy near me
Link Alternatif QQ merupakan situs yang menyediakan banyak informasi mengenai link – link dari berbagai bandar slot online seperti agen MPO777
I will right away snatch your rss feed as I can’t to find your email subscription hyperlink or e-newsletter service. Do you have any? Please let me realize so that I could subscribe. Thanks.
Süryani Büyüsü nedir v nasıl yapılır Süryani Büyüsü neden Süryani BüyüsüLoading…
I love your blog. It looks every informative.
I imagine so. Very good stuff, I agree totally.
I was able to find good advice from your blog articles.
I used to be able to find good advice from your blog posts.
credit score free max credit score how to get a free credit report fico credit score
Write more stories, more chapters.
Great info. Lucky me I ran across your blog by chance (stumbleupon). I have saved as a favorite for later!
ivermectin for sale ivermectin generic – ivermectin 4
ez pharmacy canadian pharmacy certified canada pharmacy online
I’ll right away grab your rss feed as I can’t to find your e-mailsubscription hyperlink or newsletter service. Do you’ve any?Kindly allow me realize in order that I may just subscribe.Thanks.
bookmarked!!, I like your website!
I was able to find good advice from your blog articles.
ivermectin lotion for lice ivermectin near me ivermectin uk boots
you seo backlink
you seo backlink
stromectol and alcohol covid and ivermectin
you seo backlink
you seo backlink
you seo backlink
you seo backlink
you seo backlink
Does it look like we’re in for a big ride here?
you seo backink
you seo backlink
you seo backlink
bitcoin how it worksbitcoin for live 72ecd8d
ivermectin for humans ivermectin purchase – ivermectin uk coronavirus
Nice blog. Could someone with little experience do it, and add updates without messing it up? Good information on here, very informative.
Have you given any kind of thought at all with converting your current web-site into French? I know a couple of of translaters here that will would certainly help you do it for no cost if you want to get in touch with me personally.
Fantastic post.Thanks Again. Keep writing.Loading…
bonjour I love Your Blog can not say I come here often but im liking what i c so far….
Seriously a lot of excellent tips!how to write an effective argumentative essay essays writing service blog writing services
מיה מקבלת את המתנה הטובה ביותר לכריסמס – זיון אנאלי סוער! מתחילה במציצה ומסיימת בגמירה רטובהשירותי ליווי במרכז
Before England’s Industrial Revolution,
Thanks for sharing your thoughts about garden yard flags.Regards
Muchos Gracias for your blog article.Really looking forward to read more. Keep writing.
I don’t normally comment on blogs.. But nice post! I just bookmarked your site
nicee content keep writing
spain jersey home ??????30????????????????5??????????????? ????????
Howdy! Do you use Twitter? I’d like to follow you if that would beokay. I’m absolutely enjoying your blogand look forward to new updates.
Thank you ever so for you article post.Really thank you!
Makes sense to me.
How do I subscribe to your blog? Thanks for your help.
turbo credit score how to credit score free credit score ck
bonus mpo100 tidak di berikan kepada member yang aktif bermain
modalert review provigil medication modalert review
Write more stories, more chapters.
ed pills otc – men’s ed pills ed solutions
It was a good article, thank you
We’re developing a conference, and it looks like you would be a great speaker.
ivermectin safety ivermectin fungal infection
What a great article.. i subscribed btw!
I could not refrain from commenting. Well written!
I couldn’t refrain from commenting. Perfectly written.
Appreciate you sharing, great blog article.Much thanks again. Really Great.
Perfect for showing to your pals!
wow, awesome blog article.
A big thank you for your blog post.Really thank you! Keep writing.
A big thank you for your article post.Much thanks again. Really Great.
I couldn’t refrain from commenting. Very well written.
Thanks for finally writing about > Custom Design Playground Completed for GabriellaPark
It was extremely kind of you. What can I do to be able to repay you?
Very good information. Lucky me I found your blog by accident (stumbleupon). I’ve book-marked it for later.
Saved as a favorite, I really like your web site!
provigil for sale provigil medication – modafinil provigil
research paper writers reliable essay writing service research paper writer free
walmart pharmacy online refill pharmacy technician school online
Awesome blog article.Really thank you! Really Great.
A round of applause for your blog. Fantastic.
Wow, great article post.Really thank you! Really Great.
ivermectin side effects in humans ivermectin in humans
What a great article, I really enjoyed it.
Thank You
Very good post.
Wow, great post.Really thank you! Awesome.
Enjoyed every bit of your blog article.Thanks Again. Great.
wow, awesome blog post.Really thank you! Really Cool.
united pharmacy india: ordering medicine from india reputable online pharmacies in india
I’ll immediately clutch your rss as I can’tto find your e-mail subscription link or newsletterservice. Do you’ve any? Kindly allow me realize so that I may just subscribe.Thanks.
คาสิโนออนไลน์นับว่าเป็นวิธีที่ยอดเยี่ยมสวยๆสำหรับในการนักเสี่ยงโชคด้วยเหตุว่าอีกทั้งสบายรวมถึงไม่เป็นอันตราย เล่นที่ใดตอนไหนก็ได้ซึ่งก็หมายความว่าคุณสามารถทำเงินได้ตลอดเวลา แทงบอลได้สะสมทุกเกมไว้คอยคุณแล้วแค่เพียงสมัครเข้ามาก็ทำเงินได้ในทันทีทันใด
Remarkable offers a special blend of supplements that will certainly transform your life right!
Woh I enjoy your content, saved to bookmarks! .
A round of applause for your article.Really thank you! Cool.
What a great article, I really enjoyed it.
Thank You
Awesome post.Really thank you! Cool.
Very instructive and excellent complex body part of content material, now that’s userggenial (:.
Great blog post.Thanks Again. Cool.
Awesome blog article.Really looking forward to read more. Much obliged.
Looking forward to reading more. Great blog.Thanks Again. Keep writing.
Xoilac Tv Thẳng Soccer fpt88Đội tuyển chọn futsal nước ta đã có một trận đấu chấp nhận được trước đối thủ đầy mức độ mạnh Lebanon. Kết quả Bà Rịa-Vũng Tàu vs Bình Phước thời điểm hôm nay 18h00 ngày 5/5, Hạng nhất nước ta.
Muchos Gracias for your post. Want more.
Fantastic article.Thanks Again. Cool.
Muchos Gracias for your blog article.Thanks Again. Great.
Helping me was a wonderful gesture for you to make. Thanks so much.
4 corners pharmacy canadian pharmacy express
Enjoyed every bit of your blog post.Much thanks again. Awesome.
A round of applause for your post.Much thanks again. Awesome.
Very good info. Lucky me I found your site by accident (stumbleupon). I have bookmarked it for later!
I loved your article post.Thanks Again. Really Great.
Would you be eager about exchanging hyperlinks?
Very good article post.Really thank you! Really Great.
What a great article, I really enjoyed it.
Thank You
top 10 online pharmacy in india mexican online pharmacies
Would you be keen on exchanging hyperlinks?
يتجلى تفاني المصنع في الجودة في الأداء المتفوق لأنابيب HDPE ، والمعروفة بقوتها ومتانتها الاستثنائية.
Very neat article.Thanks Again. Really Great.
يتجلى تفاني المصنع في الجودة في الأداء المتفوق لأنابيب HDPE ، والمعروفة بقوتها ومتانتها الاستثنائية.
يتجلى تفاني المصنع في الجودة في الأداء المتفوق لأنابيب HDPE ، والمعروفة بقوتها ومتانتها الاستثنائية.
يتجلى تفاني المصنع في الجودة في الأداء المتفوق لأنابيب HDPE ، والمعروفة بقوتها ومتانتها الاستثنائية.
Awesome post.Really looking forward to read more.
يتجلى تفاني المصنع في الجودة في الأداء المتفوق لأنابيب HDPE ، والمعروفة بقوتها ومتانتها الاستثنائية.
يتجلى تفاني المصنع في الجودة في الأداء المتفوق لأنابيب HDPE ، والمعروفة بقوتها ومتانتها الاستثنائية.
Very good blog article. Really Cool.
I used to be able to find good info from your blog posts.
Thank you ever so for you article.Really thank you! Will read on…
wow, awesome post.Much thanks again. Great.
Perfect for showing your close friends!
Really informative blog post.Really thank you! Want more.
You successfully utilized narration strategies to maintain readers engaged.
Fantastic post. Cool.