The author of the article: xh0507 [www.xh0507.cn] Fox network address of the hackers learn http://www.foxteam.cn/index.php ¡¾1¡¿ map
Do not talk nonsense, go directly to the theme, take a look at the points of the Website domain name registration time: 2008-5-14 21:23:00¡¿ ¡¾Figure 2
Appears to be new stations, and some may not be safe places, only a personal guess. Let's look for the administrator's name¡¿ ¡¾Figure 3
This is important, when you stop an invasion, at least know that the station manager who is now. Str0m look at the personal data, we Baidu under¡¿ ¡¾Figure 4
Here we found a personal blog administrator str0m front http://www.str0m.cn do all the preparatory work so that you stand for a basic information and management have to understand. We started the following actions: (analysis) sites procedures of the Forum for copyright Phpwind, we all know that such a forum, the general implantation, scanning has almost no use, it can only be from the other side to the start.www.foxteam.cn>> 60.172.190.207www.str0m.cn>> 60.172.190.207 testing administrator of the two sites is the same server, we have the following marginal notes, under which the server site. foxteam.cn has the IP address: 60.172.190.207119 found with the IP 60.172.190.207¡¾Í¼5¡¿ foxteam.cn has the IP address: 60.172.190.207119 found with the IP 60.172.190.207¡¿ ¡¾Figure 5
I was very lucky to find the server, to a site http://www.XXX.com/movie.asp?id=3DB authority of the current library name: sqlsqlXXX the current user: sqlXXX [
Since then we have the authority DB go out under the server's directory¡¿ ¡¾Figure 7
119 points, we find the address of the site directory (hard) I spent 1 hour or so we have to find that the invasion site directory foxteam.cn coke ... ... ... ... ... ... foxteam.cn thinking and in str0m.cn The same server, the same administrator, and that the directory will not be in this str0m, continue to look for ... ... ... ... to luck, Key Figure 8¡¿
Found, after searching look at the physical site addresses found in a fatal loopholes in the e: \ clientweb \ 3g \ str0m \ wwwroot \ kldtpb \ eWebEditor¡¿ ¡¾Figure 9
The default background admin_login.asp began to enter the following background eWebEditor¡¿ ¡¾Figure 10
Here is an administrator forgotten to negligence password! Default account: admin admin behind the steps in the background eWebEditor like to add a direct management style to add PHP horse. (This step is not written in detail ... ... ... ...) on a network of learning success of the hackers had to figure ¡¾11¡¿
|
You are here: hacking technology
> hacker invade
> Content
Category: Home
> hacker invade
