Oblog 4.5-4.6 access&mssql getshell 0day
影响范围：4.5 - 4.6 漏洞需求: IIS6.0\开启会员 挖掘作者:henry 绝对原创，技术含量不高,但影响范围比较广.. 漏洞文件： AjaxServer.asp (372行) log_filename = Trim(Request(filename))//未过滤自定义文件名 AjaxServer.asp (259行)(关键) If (oblog.chkd
漏洞需求: IIS6.0\开启会员
挖掘作者:henry
绝对原创，技术含量不高,但影响范围比较广..
漏洞文件：
AjaxServer.asp (372行)
log_filename = Trim(Request("filename"))//未过滤自定义文件名
AjaxServer.asp (259行)(关键)
If (oblog.chkdomain(log_filename) = False And log_filename "") and isdraft1 Then oblog.adderrstr ("文件名称不合规范，只能使用小写字母以及数字！")
逻辑错误,只要有一个条件不满足,则跳过.请看:
206行isdraft = Int(Request("isdraft")) //可控
isdraft=1 www.2cto.com 则成功跳过
漏洞利用：
⒈ 注册会员，发表一日志。
⒉ 修改日志，高级选项，文件名称这里写abcdefg，内容为一句话木马源码。然后抓包保存。
⒊ 修改表单数据，将filename改为a.asp;x，isdraft参数为1，提交表单。
⒋ 回到博文管理，选择重新发布日志，日志地址则为SHELL地址。
tips: 若博文目录不可, 则可控制filename=../../data/a.asp;x
Oblog 4.5-4.6 access&mssql getshell 0day
Hot AI Tools
Undresser.AI Undress
AI-powered app for creating realistic nude photos
AI Clothes Remover
Online AI tool for removing clothes from photos.
Undress AI Tool
Undress images for free
Clothoff.io
AI clothes remover
AI Hentai Generator
Generate AI Hentai for free.
Hot Article
Hot Tools
Notepad++7.3.1
Easy-to-use and free code editor
SublimeText3 Chinese version
Chinese version, very easy to use
Zend Studio 13.0.1
Powerful PHP integrated development environment
Dreamweaver CS6
Visual web development tools
SublimeText3 Mac version
God-level code editing software (SublimeText3)
Hot Topics
1358
52
How to disable background applications in Windows 11_Windows 11 tutorial to disable background applications
May 07, 2024 pm 04:20 PM
1. Open settings in Windows 11. You can use Win+I shortcut or any other method. 2. Go to the Apps section and click Apps & Features. 3. Find the application you want to prevent from running in the background. Click the three-dot button and select Advanced Options. 4. Find the [Background Application Permissions] section and select the desired value. By default, Windows 11 sets power optimization mode. It allows Windows to manage how applications work in the background. For example, once you enable battery saver mode to preserve battery, the system will automatically close all apps. 5. Select [Never] to prevent the application from running in the background. Please note that if you notice that the program is not sending you notifications, failing to update data, etc., you can
How to convert deepseek pdf
Feb 19, 2025 pm 05:24 PM
DeepSeek cannot convert files directly to PDF. Depending on the file type, you can use different methods: Common documents (Word, Excel, PowerPoint): Use Microsoft Office, LibreOffice and other software to export as PDF. Image: Save as PDF using image viewer or image processing software. Web pages: Use the browser's "Print into PDF" function or the dedicated web page to PDF tool. Uncommon formats: Find the right converter and convert it to PDF. It is crucial to choose the right tools and develop a plan based on the actual situation.
What does dao mean in java
Apr 21, 2024 am 02:08 AM
DAO (Data Access Object) in Java is used to separate application code and persistence layer, its advantages include: Separation: Independent from application logic, making it easier to modify it. Encapsulation: Hide database access details and simplify interaction with the database. Scalability: Easily expandable to support new databases or persistence technologies. With DAOs, applications can call methods to perform database operations such as create, read, update, and delete entities without directly dealing with database details.
Can't allow access to camera and microphone in iPhone
Apr 23, 2024 am 11:13 AM
Are you getting "Unable to allow access to camera and microphone" when trying to use the app? Typically, you grant camera and microphone permissions to specific people on a need-to-provide basis. However, if you deny permission, the camera and microphone will not work and will display this error message instead. Solving this problem is very basic and you can do it in a minute or two. Fix 1 – Provide Camera, Microphone Permissions You can provide the necessary camera and microphone permissions directly in settings. Step 1 – Go to the Settings tab. Step 2 – Open the Privacy & Security panel. Step 3 – Turn on the “Camera” permission there. Step 4 – Inside, you will find a list of apps that have requested permission for your phone’s camera. Step 5 – Open the “Camera” of the specified app
What does field mean in java
Apr 25, 2024 pm 10:18 PM
In Java, a "field" is a data member in a class or interface that is used to store data or state. The properties of field include: type (can be any Java data type), access rights, static (belongs to a class rather than an instance), final (immutable) and transient (not serialized). Field is used to store state information of a class or interface, such as storing object data and maintaining object state.
How does the Java reflection mechanism modify the behavior of a class?
May 03, 2024 pm 06:15 PM
The Java reflection mechanism allows programs to dynamically modify the behavior of classes without modifying the source code. By operating the Class object, you can create instances through newInstance(), modify private field values, call private methods, etc. Reflection should be used with caution, however, as it can cause unexpected behavior and security issues, and has a performance overhead.
How to read dbf file in oracle
May 10, 2024 am 01:27 AM
Oracle can read dbf files through the following steps: create an external table and reference the dbf file; query the external table to retrieve data; import the data into the Oracle table.
What does a memory stick look like?
Apr 21, 2024 pm 01:01 PM
What does a computer memory module look like? This is an overview of the graphics card and memory module in the computer. The computer's independent graphics card is inserted into the graphics card slot, with a fan, and the memory module is inside the memory module slot on the computer's motherboard, shaped like a green rectangle. Laptop memory modules are different from desktop memory modules, and they cannot be used interchangeably. Appearance difference 1: Desktop memory, slender, 13-14 cm in length. 2: Notebook memory is shorter, about five centimeters. Memory is the bridge in the computer, responsible for data exchange between the processor and hardware such as hard disk, motherboard, and graphics card. The red circle on the way is the memory stick, next to the CPU fan and plugged into the memory stick. Look, a computer memory stick looks like this. Use a screwdriver to open the cover of the desktop computer. The red circle in the middle is the memory module. What is a memory stick?
