WooYun.org

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
  <configSections>
    <sectionGroup name="applicationSettings" type="System.Configuration.ApplicationSettingsGroup, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089">
      <section name="SFOAV5._0.Properties.Settings" type="System.Configuration.ClientSettingsSection, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" requirePermission="false" />
    </sectionGroup>
  </configSections>
  <appSettings>
    <add key="aspnet:MaxHttpCollectionKeys" value="5000" />
    <add key="strConn" value="server=192.168.0.1;database=SFOAV5;uid=sa;pwd=123456" />
    <add key="CASHost" value="" />
    <add key="ServiceURL" value="" />
    <add key="Filter" value="xp_-ＸＰ_$$sp_-ＳＰ_$$[　| |\)|\]|\']+(or)[　| |\(|\[|\']+- ｏr $$[　| |\)|\]|\']+(and)[　| |\(|\[|\']+- ａnd $$exec[　| |\[]+-ｅxec $$dbcc[　| |\[]+-ｄbcc $$(alter[　| ])|([　| |\)|\]|\']alter[　| ])+-ａlter $$(drop[　| ])|([　| |\)|\]|\']drop[　| ])-ｄrop $$(insert[　| ])|([　| |\)|\]|\']insert[　| ])-ｉnsert $$(update[　| |\[]+)|[　| |\)|\]|\']+(update[　| |\[]+)-ｕpdate $$(delete[　| |\[]+)|([　| |\)|\]|\']delete[　| |\[]+)+-ｄelete $$count-ｃount$$master-ｍaster$$(truncate[　| ])|([　| |\)|\]|\']truncate[　| ])+-ｔruncate $$char[　| ]+-ｃhar $$char\(-ｃhar($$declare[　| ]+-ｄeclare $$[　| |\)|\]]+where[　| |\(|\[]+-ｗhere $$set[　| |\[]+-ｓet $$mid[　| |(]+-ｍid $$chr[　| |(]+-ｃhr $$net[　| ]+-ｎet $$backup[　| ]+-ｂackup " />
  </appSettings>
  <connectionStrings>
    <add name="strConn" connectionString="server=127.0.0.1;database=sfoav5;uid=sa;pwd=w@soffice86960380L" />
    <add name="strConn2" connectionString="" />
    <add name="MailType" connectionString="1" />
    <add name="MailServer" connectionString="192.168.0.32" />
    <add name="MailDNS" connectionString="202.101.224.68" />
    <add name="MenuTech" connectionString="0" />
    <!--<add name="Control" connectionString="0"/>-->
    <add name="Store" connectionString="0" />
    <add name="MenuUpload" connectionString="1" />
    <add name="EpmSystem" connectionString="1" />
    <add name="App" connectionString="0" />
    <!--<add name="Lite" connectionString="0"/>-->
    <add name="SunUrl" connectionString="" />
  </connectionStrings>
  <system.web>
    <webServices>
      <protocols>
        <add name="HttpPost" />
        <add name="HttpGet" />
      </protocols>
    </webServices>
    <pages enableViewStateMac="false" enableEventValidation="false" validateRequest="false" controlRenderingCompatibilityVersion="3.5" clientIDMode="AutoID" />
    <!--  动态调试编译         设置 compilation debug="true" 以启用 ASPX 调试。否则，将此值设置为
          false 将提高此应用程序的运行时性能。          设置 compilation debug="true" 以将调试符号(.pdb 信息)
          插入到编译页中。因为这将创建执行起来          较慢的大文件，所以应该只在调试时将此值设置为 true，而在所有其他时候都设置为          false。有关更多信息，请参考有关          调试 ASP.NET 文件的文档。    -->
    <compilation defaultLanguage="c#" debug="true" targetFramework="4.0" />
    <!--  自定义错误信息          设置 customErrors mode="On" 或 "RemoteOnly" 以启用自定义错误信息，或设置为 "Off" 以禁用自定义错误信息。 
          为每个要处理的错误添加 <error> 标记。          "On" 始终显示自定义(友好的)信息。          "Off" 始终显示详细的 ASP.NET 错误信息。          "RemoteOnly" 只对不在本地 Web 服务器上运行的           用户显示自定义(友好的)信息。出于安全目的，建议使用此设置，以便 
           不向远程客户端显示应用程序的详细信息。    -->
    <customErrors mode="Off" defaultRedirect="SysError.aspx" />
    <!--  身份验证 
          此节设置应用程序的身份验证策略。可能的模式是 "Windows"、 
          "Forms"、 "Passport" 和 "None"
          "None" 不执行身份验证。 
          "Windows" IIS 根据应用程序的设置执行身份验证 
            (基本、简要或集成 Windows)。在 IIS 中必须禁用匿名访问。          "Forms" 您为用户提供一个输入凭据的自定义窗体(Web 页)，然后 
           在您的应用程序中验证他们的身份。用户凭据标记存储在 Cookie 中。          "Passport" 身份验证是通过 Microsoft 的集中身份验证服务执行的，           它为成员站点提供单独登录和核心配置文件服务。    -->
    <!--<identity impersonate="true" userName="IUSR_PC2011051123OBY" password="123456"/>-->
    <authentication mode="Windows" />
    <!--  授权 
           此节设置应用程序的授权策略。可以允许或拒绝不同的用户或角色访问
          应用程序资源。通配符: "*" 表示任何人，"?" 表示匿名
          (未经身份验证的)用户。    -->
    <authorization>
      <allow users="*" />
      <!-- 允许所有用户 -->
      <!--  <allow     users="[逗号分隔的用户列表]"
                             roles="[逗号分隔的角色列表]"/>
                  <deny      users="[逗号分隔的用户列表]"
                             roles="[逗号分隔的角色列表]"/>
       -->
    </authorization>
    <!--  应用程序级别跟踪记录
          应用程序级别跟踪为应用程序中的每一页启用跟踪日志输出。          设置 trace enabled="true" 可以启用应用程序跟踪记录。如果 pageOutput="true"，则
          在每一页的底部显示跟踪信息。否则，可以通过浏览 Web 应用程序
           根目录中的 "trace.axd" 页来查看
          应用程序跟踪日志。    -->
    <trace enabled="false" requestLimit="10" pageOutput="false" traceMode="SortByTime" localOnly="true" />
    <!--  会话状态设置          默认情况下，ASP.NET 使用 Cookie 来标识哪些请求属于特定的会话。          如果 Cookie 不可用，则可以通过将会话标识符添加到 URL 来跟踪会话。         若要禁用 Cookie，请设置 sessionState cookieless="true"。    -->
    <sessionState mode="InProc" stateConnectionString="tcpip=192.168.0.30:42424" sqlConnectionString="data source=192.168.0.30;Trusted_Connection=yes" cookieless="false" timeout="20" />
    <httpModules>
      <add name="HttpUploadModule" type="Openlab.Web.Upload.HttpUploadModule, Openlab.Web.Upload" />
    </httpModules>
    <httpRuntime maxQueryStringLength="2097151" maxRequestLength="2147483647" executionTimeout="1800" requestValidationMode="2.0" />
    <!--  全球化          此节设置应用程序的全球化设置。    -->
    <globalization requestEncoding="gb2312" responseEncoding="gb2312" />
    <mobileControls cookielessDataDictionaryType="System.Web.Mobile.CookielessData" />
    <deviceFilters>
      <filter name="isJPhone" compare="Type" argument="J-Phone" />
      <filter name="isHTML32" compare="PreferredRenderingType" argument="html32" />
      <filter name="isWML11" compare="PreferredRenderingType" argument="wml11" />
      <filter name="isCHTML10" compare="PreferredRenderingType" argument="chtml10" />
      <filter name="isGoAmerica" compare="Browser" argument="Go.Web" />
      <filter name="isMME" compare="Browser" argument="Microsoft Mobile Explorer" />
      <filter name="isMyPalm" compare="Browser" argument="MyPalm" />
      <filter name="isPocketIE" compare="Browser" argument="Pocket IE" />
      <filter name="isUP3x" compare="Type" argument="Phone.com 3.x Browser" />
      <filter name="isUP4x" compare="Type" argument="Phone.com 4.x Browser" />
      <filter name="isEricssonR380" compare="Type" argument="Ericsson R380" />
      <filter name="isNokia7110" compare="Type" argument="Nokia 7110" />
      <filter name="prefersGIF" compare="PreferredImageMIME" argument="image/gif" />
      <filter name="prefersWBMP" compare="PreferredImageMIME" argument="image/vnd.wap.wbmp" />
      <filter name="supportsColor" compare="IsColor" argument="true" />
      <filter name="supportsCookies" compare="Cookies" argument="true" />
      <filter name="supportsJavaScript" compare="Javascript" argument="true" />
      <filter name="supportsVoiceCalls" compare="CanInitiateVoiceCall" argument="true" />
    </deviceFilters>
    <xhtmlConformance mode="Legacy" />
  </system.web>
  <system.webServer>
    <modules>
      <add name="HttpUploadModule" type="Openlab.Web.Upload.HttpUploadModule, Openlab.Web.Upload" preCondition="integratedMode" />
    </modules>
    <validation validateIntegratedModeConfiguration="false" />
    <security>
      <requestFiltering>
        <requestLimits maxQueryString="904800" maxAllowedContentLength="2147483647" />
      </requestFiltering>
    </security>
    <staticContent>
      <remove fileExtension=".xpi" />
      <remove fileExtension=".grf" />
      <remove fileExtension=".crx" />
      <mimeMap fileExtension=".xpi" mimeType="application/x-xpinstall" />
      <mimeMap fileExtension=".grf" mimeType="text/html" />
      <mimeMap fileExtension=".crx" mimeType="application/x-chrome-extension" />
    </staticContent>
        <defaultDocument>
            <files>
                <add value="default.aspx" />
            </files>
        </defaultDocument>
  </system.webServer>
  <system.serviceModel>
    <bindings>
      <basicHttpBinding>
        <binding name="SFOAWebServiceSoap" maxReceivedMessageSize="99999999" />
      </basicHttpBinding>
      <customBinding>
        <binding name="SFOAWebServiceSoap12">
          <textMessageEncoding messageVersion="Soap12" />
          <httpTransport />
        </binding>
      </customBinding>
    </bindings>
    <client>
      <endpoint address="http://www.isoffice.com.cn/sfoav5/WebService/SFOAWebService.asmx" binding="basicHttpBinding" bindingConfiguration="SFOAWebServiceSoap" contract="ServiceReference1.SFOAWebServiceSoap" name="SFOAWebServiceSoap" />
    </client>
  </system.serviceModel>
  <applicationSettings>
    <SFOAV5._0.Properties.Settings>
      <setting name="SFOAV5_0_ISoffice_SPS_WebService" serializeAs="String">
        <value>http://sps.isoffice.cn/webservice.asmx</value>
      </setting>
    </SFOAV5._0.Properties.Settings>
  </applicationSettings>
</configuration>

<add name="strConn" connectionString="server=127.0.0.1;database=sfoav5;uid=sa;pwd=w@soffice86960380L" />

<add key="Filter" value="xp_-ＸＰ_$$sp_-ＳＰ_$$[　| |\)|\]|\']+(or)[　| |\(|\[|\']+- ｏr $$[　| |\)|\]|\']+(and)[　| |\(|\[|\']+- ａnd $$exec[　| |\[]+-ｅxec $$dbcc[　| |\[]+-ｄbcc $$(alter[　| ])|([　| |\)|\]|\']alter[　| ])+-ａlter $$(drop[　| ])|([　| |\)|\]|\']drop[　| ])-ｄrop $$(insert[　| ])|([　| |\)|\]|\']insert[　| ])-ｉnsert $$(update[　| |\[]+)|[　| |\)|\]|\']+(update[　| |\[]+)-ｕpdate $$(delete[　| |\[]+)|([　| |\)|\]|\']delete[　| |\[]+)+-ｄelete $$count-ｃount$$master-ｍaster$$(truncate[　| ])|([　| |\)|\]|\']truncate[　| ])+-ｔruncate $$char[　| ]+-ｃhar $$char\(-ｃhar($$declare[　| ]+-ｄeclare $$[　| |\)|\]]+where[　| |\(|\[]+-ｗhere $$set[　| |\[]+-ｓet $$mid[　| |(]+-ｍid $$chr[　| |(]+-ｃhr $$net[　| ]+-ｎet $$backup[　| ]+-ｂackup " />

GET /FrmMenuURL.aspx?ID=430 HTTP/1.1
Host: oa.isoffice.cn
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:32.0) Gecko/20100101 Firefox/32.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-cn,zh;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://oa.isoffice.cn/indexnew.aspx
Cookie: Hm_lvt_9f77501cb52bcbcaacbe546cf8ac3644=1411040329; UserName=dGVzdA%3D%3D%26; UserPwd=c29mZmljZQ%3D%3D%26; ASP.NET_SessionId=oclux2raem4tvc1ufab2v10a; SFOAUserCode=test; SFOAUserName=%b2%e2%ca%d4%d3%c3%bb%a7; SFOADeptName=%be%ad%c0%ed%b0%ec; SFOADeptID=1; SFOAWorker=%d7%dc%be%ad%c0%ed; SFOARoleID=81; SFOASysManager=; SFOAStyle=new; SFOAUserIkey=false; SFOAHeadColorR=198; SFOAHeadColorG=198; SFOAHeadColorB=198; SFOAMidColor=%23f0f0f0; SFOAMoveColor=%23e7e7e7; SFOAIPAddress=113.12.200.179; PageIndex=1; OrderInfo=; SFOA16Color=%23c6c6c6; Hm_lpvt_9f77501cb52bcbcaacbe546cf8ac3644=1411041098
Connection: keep-alive