N years ago, this vulnerability can be used to realize the directory traversal, although Microsoft has a patch, but it seems that the patch is used to limit IIS to only access the virtual directory, so the vulnerability is still existed, but it is only available. For IIS, submit a URL containing% 5C to find files, but other files referenced in the file are not found (% 5c is //'s URL encoding, IIS jumps to the previous directory) Find, of course, can't find; dizziness, haha, I am dizzy).
Later, this vulnerability was excavated by the cattle, but also the legendary 5C branches: due to the relative path of the file references to the database, submit% 5C can't find the file, so IIS will be old and old. Path of the database (do not understand? Looking for Google).
An accidental opportunity I found that you can also use% 5C to bypass the ASP verification; try it when we fails in the branches.
Stapless, look at the following code:
<%
Guest_user = trim (Request ("Guest_USER"))
Guest_password = trim (Request ("Guest_password"))
SET RS = Server.createObject ("AdoDb.Recordset")
SQL = "SELECT * from admin where id = 1"
RS.Open SQL, CONN, 3, 2
Readuser = RS ("Guest_USER")
Readpassword = rs ("Guest_password")
IF readuser <> guest_user or readpassword <> guest_password kil
Response.write "Please enter the correct administrator password!"
Response.end
Else
Session ("admin") = 1 / 'After logging in, write Seesion Save
Response.write ("Successful landing, please return the information page")
END IF
%>
Seeing that there is no, if you want to verify that you must make the username password in the database and submit; what? Let's take a look at the database connection file code:
<%
ON Error ResMe next
Set conn = server.createObject ("adoDb.connection")
Dbpath = server.mappath ("Guestbook.asp")
Conn.open "Driver = {Microsoft Access Driver (* .mdb)}; dbq =" & dbpath
%>
Ah, there is a fault-tolerant statement that cannot be treasure! Wait, if the submission% 5C database can't be found, due to fault, the program will continue, then the username password you get from the database is empty (thinking that sometimes the branches fail is to see the empty frame, because The data is empty), haha, so we will bypass the verification!
Know how to do it, save the landing page to the local, modify the submitted URL, put the last / change to% 5c, username password space (some programs check if the username password is empty, space will be filtered by the program ), Submit, OK. Hey, you don't think that I have nothing to write to the code. In fact, this is a message board program made by our school, just hanging at the home page of the school, huh, huh.
Since understanding the principles, of course, I have to find the actual vulnerability, naturally the "hole" network forum opened by the famous name. But there is a failure because it has such a paragraph:
IF Err THEN
Err.clear
Set conn = Nothing
Response.write "Database connection error, please check the connection string."
Response.end
END IF
The database is not found, huh, huh, empty.
Then go to Down's BBSXP Forum, open the database connection file, halo, there is no tolerant statement; huh, but you can burn.
I am not BT, so I don't look for it, write articles, I will give you a master.
Summarize this condition for this attack method: 1. The relative path for database connection is only a simple fault-tolerant statement; 2. Server IIS version is 4 or 5; 3. If you do not check empty characters or check, filter spaces Filter spaces during comparison; 4, the program cannot be in the first class
As for the prevention, huh, since the attack conditions know, the prevention measures have naturally come out ^ _ ^
- Author: vjoy-- Published: 2004-12-2519: 57: 36-- add .asp code for superuser [original blue screen, Kevin improvements, Ms unpublished vulnerabilities] Author: blue, Kevin Article Source: Ice point limit In fact, I have tested in my broiler and Kevin, as well as Hippo epic. The result is a user who successfully added the Administrators group under User permission (although I can't believe my eyes) The last time Kevin does not speak, I don't dare to release it .... Now I have seen him on his blog, it turns back (I have improved a little more than I last test, add a form. ). Everyone has a blessing `` `Anster code is right, but very few can succeed, do it. . Oh, the next step I want to integrate him into the ocean.嘿嘿.
.NETWORK Object Script Permissions Lifting Vulnerability Utilization Tool