General file upload vulnerability getshell of a digital campus system (penetration test -0day)

Catalog

1. Preface

2. File upload point （ Actual combat recurrence ）

3. Submit SRC

4.getshell POC

---

 

Statement ：

        For penetration testing only , White hat vulnerability mining . Do not use it for illegal purposes , Illegal use will result in consequences .

 

1. Preface

        By chance F12sec See the article on the side , So there is today's hole digging process . A white hat master found a general vulnerability in a station building system , Belong to 0day Oh . But this 0day Loopholes are speechless enough ... Upload directly without any restrictions aspx Executable file , And the vulnerability point is on the registration page . This loophole