Scanning: Uses x-scan2.3 to sweep the port first to faint only opens 80, then has swept an oh same result, looks like the manager not to calculate stupidly!
Checkout system hole hole: Ping ping has not passed unexpectedly first, but had a moment ago scan result to be very clear should be iis5 adds on asp such main engine which on the homepage used obviously certainly is again win2k does not need to say.
Analysis: Above oh also does not have anything to be possible to analyze can only from 80 obtain, to have a look at east some anything east to have referral system input single quotes to try, returns wrong type:
Microsoft OLE DB Provider for ODBC Drivers (0x80040E14)
/mingce/student1.asp, the 30th line
Looks like the luck not to calculate that is too bad ........Should have the problem which sql pours into .........
To further confirm that tries the luck to lose http://x.x.x.x//mingce/student1.asp.BAK
Indeed may submit yo the returns to be as follows correctly:
if request.form (“xsxm”) = "" and request.form (“xsxh”) = "" then
Set Conn=Server.CreateObject (“ADODB.Connection”)
Conn.Open “Driver= {sql server}; Server=localhost; Database=xxxx; UID=sa; PWD= " &application (“mm_xxx”)
Compared with long was only above three lines has been most important: We may see the ASP daemon to carry on uselessly to the user submission any
The filtration, simultaneously the database uses ADODB.Connection object (, if is ADODB.Command has not filtered
Distinctive mark also incorrect), certainly may also see the database use sa to connect!
(Tip: Actually we did not look that the ASP source code we may also try xp_cmdshell 'the iisreset /reboot '
Perhaps xp_cmdshell 'ping you. . if I.P', the first order can carry out successfully that in half minute long-distance
The system will restart one time, second will order you from already loom's firewall will usually prompt to the x.x.x.x main engine to you
Transmits the ICMP data, but regarding this kind the main engine second order which forbids any data to leave possibly not good yo)
Good through above has analyzed us to be possible to make anything:
Through (has not returned in the web page by manager's status executive system order obviously)
If is general system main engine simple xp_cmdshell 'net user ..... 'I has not written
But we now the environment was the system has only operated 80 ports, even if we could add the ADMIN user uselessly also three
Before so long as usually opens 139/445/135 to be possible long-distance to manage now has not been good.
My mentality:
1) found the web table of contents the way
2) read in simple cmd.asp to use for to find firewall's specific name
3) closes the firewall service through xp_cmdshell
Realizes specifically:
The first step is obviously most difficult
You are here: hacking technology
> invades the examination
> Content
Category: Home
> invades the examination