轻松获得oblog2.52的WebShell

                              一、方法

                              1、先进后台。利用CheckUserLogined漏洞直接加个后台管理员。关于这个CheckUserLogined漏洞我在《Blog的噩梦》（http://www.eviloctal.com/forum/htm_data/10/0508/13721.html）中有详细的说明，大概就是说可以通过Cookies欺骗搞SQL注入。

                              2、在后台的“网站信息配置”处有个“普通会员上传文件类型”，给它加一个aaaspspsp类型。
                              3、用个普通帐号登陆，来到上传文件的页面http://blog.***.com/upload.asp，看到了吗？可上传文件多了个“aaspsp”类型。好，把你的马x.asp改名为x.aaspsp，然后传上去。

                              4、到你自己的blog后台去看一看，是不是成功上传了x.asp了？：）

                              二、原理

                              本来刚开始我是直接在后台的“普通会员上传文件类型”里加了个“|asp”，结果发现上传失败。于是去Down个oBlog2.52下来。读了读upload.asp的代码，大家一起看看：

 

                              ’初始化上传限制数据
                              SubInitUpload()
                              ……
                              SelectCasecint(DecodeCookie(Request.Cookies(cookiesname)("userlevel")))

                              Case7
                              ifrs("upfile_user")="true"then
                              themax=round(user_maxsize-theuped/1024)
                              sAllowExt=rs("upfile_user_type")’注意这里，得到我们在后台设置的可上传文件的类型，放入sAllowExt变量中

                              ifthemax>rs("upfile_user_size")then
                              nAllowSize=rs("upfile_user_size")
                              else
                              nAllowSize=themax
                              endif
                              else
                              sAllowExt="暂无上传权限"
                              nAllowSize=0
                              endif
                              ……
                              EndSelect
                              sAllowExt=filtfilename(sAllowExt)’这里是对sAllowExt进行检查

                              ……
                              EndSub

                              以上代码是说如果是普通用户，那么就给字符串sAllowExt赋值为我们在后台设定的那个“普通会员上传文件类型”：jpg|png|bmp|rar|zip|asp。但是请注意，sAllowExt然后还必须经过filtfilename()的检查。再接着看：

                              ’保存操作
                              SubDoSave()
                              SetoFile=oUpload.File("uploadfile")
                              sFileExt=UCase(oFile.FileExt)
                              osize=oFile.Filesize
                              CallCheckValidExt(sFileExt)’检查文件扩展名是不是sAllowExt里有的

                              sFileExt=filtfilename(sFileExt)’哎，filtfilename又来了
                              ……
                              oFile.SaveToFileServer.Mappath(sUploadDir&"/"&sFileName)

                              ……
                              EndSub

                              以上代码就是说文件扩展名必须是sAllowExt里有的然后才能上传。上传后保存到目标计算机上时扩展名还要被filtfilename过滤一次。那么那个filtfilename到底是什么东西呢？我们看看：

                              Functionfiltfilename(filename)
                              IfIsEmpty(filename)ThenExitFunction
                              filename=Lcase(filename)
                              filename=Replace(filename,Chr(0),"")
                              filename=Replace(filename,".","")
                              filename=Replace(filename,"asp","")
                              filename=Replace(filename,"asa","")
                              filename=Replace(filename,"aspx","")
                              filename=Replace(filename,"cer","")
                              filename=Replace(filename,"cdx","")
                              filename=Replace(filename,"htr","")
                              filename=Replace(filename,"asax","")
                              filename=Replace(filename,"ascx","")
                              filename=Replace(filename,"ashx","")
                              filename=Replace(filename,"asmx","")
                              filename=Replace(filename,"axd","")
                              filename=Replace(filename,"vsdiso","")
                              filename=Replace(filename,"rem","")
                              filename=Replace(filename,"soap","")
                              filename=Replace(filename,"config","")
                              filename=Replace(filename,"cs","")
                              filename=Replace(filename,"csproj","")
                              filename=Replace(filename,"vb","")
                              filename=Replace(filename,"vbproj","")
                              filename=Replace(filename,"webinfo","")
                              filename=Replace(filename,"licx","")
                              filename=Replace(filename,"resx","")
                              filename=Replace(filename,"resou","")
                              filename=Replace(filename,"jsp","")
                              filename=Replace(filename,"php","")
                              filename=Replace(filename,"cgi","")
                              filtfilename=filename
                              EndFunction

                              是过滤函数，害我们不成功的就是这个东西。