Prepare the environment and open it with VMware, the password is admin123.
Port Scanning#
The firewall is enabled by default, and ping scanning is disabled.
Pay attention to the following ports: database port 1433 and web port 27689.
Web Application#
Access port 27689, the interface is as follows:
Attempted weak password but failed.
Directory Scanning#
Use Yujian for directory scanning.
robots.txt file
Found a backup file web.config.bak, download it and find the database account and password from the file.
Database Connection#
Based on the previous port information, port 1433 is open on the target. Use Navicat to connect.
Found a key in the database.
Looking for the website's backend password.
Backend Login#
Logged in to the backend with the account and password. After logging in, found another key.
The backend has a file upload function.
Accessing an uploaded file randomly will display an error message with the file path.
D:\web\upfile\affix\
File Upload#
Upload a normal image file randomly.
In the image above, the file with ID 44 has a file description.
Note: If the file name is too long, the system will truncate it to the first 32 characters, including the system time, as the file name. Please do not use a file name that is too long. We apologize for any inconvenience caused.
The system will truncate the uploaded file's .jpg extension using the truncation function. Since it is not necessary to have the .jpg extension, according to the above prompt, the truncation will start at 32 characters. So, we need 8 characters for the image name.
Prepare the following file:
The uploaded file will look like this:
Webshell Connection#
Concatenate the webshell URL based on the website path.
D:\web\upfile\affix\
http://192.168.10.22:27689/upfile/affix/638252986630625000-88888888.aspx
View the current user's permissions, which are ordinary user permissions.
At the same time, the second key can be found in the website's web directory.
The last key is on the desktop in the administrator directory, but we don't have permission to access the contents of this directory at the moment.
Database Connection to Obtain Key as sa#
Continue to search for the website's configuration file and find the file D:/web/web.config.bak.2017-12-12 containing the sa account for the database.
Log in to the database using the sa account, and then use xp_cmdshell to view the file, right?
use master;
exec master..xp_cmdshell 'dir "c:\Documents and Settings\Administrator\桌面\"'
Obtained the last key.
Environment Link#
Link: https://pan.baidu.com/s/140cLWvmzs0CauuA_JOro5A
Password: 6666