利用条件:

1.iis版本为6.0 

2.上传文件名不会重命名

利用:

上传一个jpg木马图片 名字为:cs.asp:.jpg 注意是: 默认windows是不允许文件字含:(冒号)的 所以需要抓包后改下!!

上传成功后,iis会忽略掉:后面的字符,也就是成了cs.asp .但是在接收判断文件后缀还是可以检测的.jpg 绕过了 后缀检测 。

iis截取到的数据是完整的cs.asp:.jpg 但是上传过去的文件应该由于windows不允许带:文件名 所以iis直接去掉了:后面的 这个和%00截断应该不是一样,%00截断是直接截断了后面的 这样的话如果在前面有检测就无法通过检测了。

附上测试代码

 <form action=”.asp?s=ys” method=”post”
enctype=”multipart/form-data” name=”form1″>
file:<input name=”FormNameItem” type=”file” />
<button type=”submit”>提交</button>
</form>
<%
if len(Request(“s”))> then
Set oFileObj = New UpFileClass
oFileObj.GetData
For Each FormNameItem in oFileObj.File
FileName = oFileObj.File(FormNameItem).FileName
FileExtName = oFileObj.File(FormNameItem).FileExt
FileContent = oFileObj.File(FormNameItem).FileData
oFileObj.File(FormNameItem).SaveToFile server.MapPath(“\”) &
Response.Write server.MapPath(“\”) & “\.asp:.jpg OK!”
.Next
end if
Dim UpFileStream
Class UpFileClass
Dim Form,File,Err
Private Sub Class_Initialize
Err = -
End Sub
Private Sub Class_Terminate
’清除变量及对像 www.2cto.com
If Err < Then
Form.RemoveAll
Set Form = Nothing
File.RemoveAll
Set File = Nothing
UpFileStream.Close .Set UpFileStream = Nothing
End If .End Sub
Public Property Get ErrNum()
ErrErrNum = Err .End Property
Public Sub GetData ()
’定义变量
Dim RequestBinData,sSpace,bCrLf,sObj,iObjStart,iObjEnd,tStrea
Dim iFileSize,sFilePath,sFileType,sFormValue,sFileName
Dim iFindStart,iFindEnd
Dim iFormStart,iFormEnd,sFormName
’代码开始56.If Request.TotalBytes < Then ‘如果没有数据
Err =
Exit Sub
End If
Set Form = CreateObject (“Scripting.Dictionary”)
Form.CompareMode =
Set File = CreateObject (“Scripting.Dictionary”)
File.CompareMode =
Set tStream = CreateObject (“ADODB.Stream”)
Set UpFileStream = CreateObject (“ADODB.Stream”)
UpFileStream.Type =
UpFileStream.Mode =
UpFileStream.Open
dim ReadedBytes,ChunkBytes
ReadedBytes=
ChunkBytes=* ’100K分块上传方案
Do While ReadedBytes < Request.TotalBytes
UpFileStream.Write Request.BinaryRead(ChunkBytes)
ReadedBytesReadedBytes = ReadedBytes + ChunkBytes
If ReadedBytes > Request.TotalBytes Then ReadedBytes = Reque
Loop
’UpFileStream.Write (Request.BinaryRead(Request.TotalBytes))
UpFileStream.Position =
RequestBinData=UpFileStream.Read
iFormEnd = UpFileStream.Size
bCrLf = ChrB () & ChrB ()
.’取得每个项目之间的分隔符84.sSpace=Mi
RequestBinData,bCrLf)-) .iStart=LenB (sSpace)
iFormStart = iStart+ .’分解项目
Do
iObjEnd=InStrB(iFormStart,RequestBinData,bCrLf & bCrLf)+
tStream.Type =
tStream.Mode =
tStream.Open .UpFileStream.Position = iFormStart
UpFileStream.CopyTo tStream,iObjEnd-iFormStart
tStream.Position =
tStream.Type = .tStream.CharSet = “gb2312″
sObj = tStream.ReadText
’取得表单项目名称100.iFormStart = InStrB (iObjEnd,RequestBinData,sSpace)-
iFindStart = InStr (,sObj,”name=”"”,1)+6
iFindEnd = InStr (iFindStart,sObj,”"”",)
sFormName = Mid (sObj,iFindStart,iFindEnd-iFindStart)
’如果是文件105.If InStr (,sObj,”filename=”"”,1) > 0 Then 106.Set oFileObj = new FileObj_Class
’取得文件属性
iFindStart = InStr (iFindEnd,sObj,”filename=”"”,1)+10
iFindEnd = InStr (iFindStart,sObj,”"”",)
sFileName = Mid (sObj,iFindStart,iFindEnd-iFindStart)
oFileObj.FileName = Mid (sFileName,InStrRev (sFileNam
oFileObj.FilePath = Left (sFileName,InStrRev (sFileName,
oFileObj.FileExt = Mid (sFileName,InStrRev (sFileName, “
iFindStart = InStr (iFindEnd,sObj,”Content-Type: “,)+
iFindEnd = InStr (iFindStart,sObj,vbCr)
oFileObj.FileType = Mid (sObj,iFindStart,iFindEnd-iFindSt
oFileObj.FileStart = iObjEnd
oFileObj.FileSize = iFormStart -iObjEnd -
oFileObj.FormName = sFormName
File.add sFormName,oFileObj
else
’如果是表单项目
tStream.Close
tStream.Type =
tStream.Mode =
tStream.Open
UpFileStream.Position = iObjEnd
UpFileStream.CopyTo tStream,iFormStart-iObjEnd-
tStream.Position =
tStream.Type =
tStream.CharSet = “gb2312″
sFormValue = tStream.ReadText
If Form.Exists(sFormName)Then
Form (sFormName) = Form (sFormName) & “, ” & sForm
else
form.Add sFormName,sFormValue
End If
End If
tStream.Close
iFormStartiFormStart = iFormStart+iStart+
’如果到文件尾了就退出
Loop Until (iFormStart+) >= iFormEnd
RequestBinData = “”
Set tStream = Nothing
Set KS=Nothing
End Sub
End Class
’—————————————————————
’文件属性类
Class FileObj_Class
Dim FormName,FileName,FilePath,FileSize,FileType,FileS
’保存文件方法154.Public Function SaveToFile (Path)
’On Error Resume Next
Dim oFileStream
Set oFileStream = CreateObject (“ADODB.Stream”)
oFileStream.Type =
oFileStream.Mode =
oFileStream.Open
UpFileStream.Position = FileStart
UpFileStream.CopyTo oFileStream,FileSize
oFileStream.SaveToFile Path,
oFileStream.Close
Set oFileStream = Nothing
Set KS=Nothing
End Function
’取得文件数据
Public Function FileData
UpFileStream.Position = FileStart
FileData = UpFileStream.Read (FileSize)
End Function
End Class
%>

最新文章

  1. nodeJS爬虫---慕课网
  2. MyBatis学习(一)、MyBatis简介与配置MyBatis+Spring+MySql
  3. VUE 入门基础(4)
  4. JqueryEasyUI 解决IE下datagrid无法刷新的问题
  5. .NET技术-.NET各大网站-编程技术网址
  6. SQL数据类型介绍
  7. SQL用row_number进行高速循环
  8. 原创+部分引用啦:C# Winform界面中的分隔线问题
  9. python官方文档
  10. Xcode下执行HelloWorld
  11. ubuntu 自动获取ip的怎么设置
  12. 【爆料】-《昆士兰大学毕业证书》Queensland一模一样原件
  13. Kali Linux NetHunter教程Kali NetHunter支持的设备和ROMs
  14. laravel 还原项目到正常状态
  15. office之Excel 你会用 Ctrl + E 吗?
  16. spring ico
  17. SpringMVC拦截器和@ResponseBody注解冲突
  18. MYSQL中可以实现类似IF判断的方法
  19. mybatis由浅入深day02_7.4mybatis整合ehcache_7.5二级缓存应用场景_7.6二级缓存局限性
  20. [Jenkins]持续集成环境下fingbug插件的安装使用与配置

热门文章

  1. Day 19 磁盘管理
  2. 使用spring拦截器实现日志管理
  3. 08.Django基础六之ORM中的锁和事务
  4. Django REST Framework之频率限制
  5. Sentinel Core流程分析
  6. Spring 梳理-跨重定向请求传递数据-Flash
  7. maven 打包构建相关命令
  8. Linux 远程登录命令telnet
  9. 原创电子书《菜鸟程序员成长之路:从技术小白到阿里巴巴Java工程师》
  10. wordpress新注册用户或重置密码链接失效