网奇cms文件上传getshell （限iis6.0）

首先从官网直接下载最新的版本,因为是.net的源码所以先用dnspy(看着有vs的感觉)直接反编译

漏洞文件:admin_UploadDataHandler.ashx

HttpPostedFile httpPostedFile = context.Request.Files["uploadify"];
                                                string text2 = Path.GetExtension(httpPostedFile.FileName).ToLower();

这里简单说下吧:uploadify是FILE参数,GetExtension获取文件后缀并小写

string[] array = new string[4];
                                                array[0] = ".gif";
                                                if (false)
                                                {
                                                        goto IL_77;
                                                }
                                                flag = ((flag2 ? 1u : 0u) + (uint)num < 0u);
                                                if (flag)
                                                {
                                                        goto IL_3C0;
                                                }
                                                array[1] = ".png";
                                                array[2] = ".jpeg";
 
                                                                array[3] = ".jpg";
                                                                array2 = array;

这里简单的说就是创建数组写入允许上传白名单后缀(也就是说限制了危险后缀0.0)

text = string.Format("{0}/{1}/", text.TrimEnd(new char[]
                                                {
                                                        '/'
                                                }), context.Request["saveFile"].Trim(new char[]
                                                {
                                                        '/'
                                                }));

从这里可以看出savefle是用于存储的文件夹,Foramt是格式化函数,这里的text是代码开头生成的日期路径(那么就是路径可控制)

httpPostedFile.SaveAs(context.Server.MapPath(text));

存储写入文件

因为后缀白名单写死了但是路径可控制所以也就是可以利用IIS解析漏洞

poc