从后台得到webshell技巧大汇总（Get a great collection of webshell skills from behind the scenes）.doc

从后台得到webshell技巧大汇总（Get a great collection of webshell skills from behind the scenes） Preface Online transmission loophole, I believe we get a lot of broiler bar. Can be said that the network makes upfile.asp upload file filter lax vulnerabilities now feel the world, this vulnerability has been basically more difficult to see, do not rule out some small sites still exist this vulnerability. In the process we often take the station. The fee of nine cattle two tiger force to get the administrator account and password, and successfully entered the background, although at this time and get the site webshell and one step away, but there are still many novice due to a suitable method which was rejected. Therefore, we summarize and sum up the commonly used methods to get webshell from the background. There are ten main aspects of the general situation. Note: how to enter the background, not the scope of this discussion, and its specific methods will not say, and rely on everyone to play their own. This article refers to many previous information and information, and expresses his gratitude. First, upload directly to get webshell Some of the programs of PHP and JSP are relatively common, MolyX BOARD is one example, directly in the mood icon management is uploaded to the.Php type, although there is no indication, in fact has been successful, the uploaded file should be URL http://forums/images/smiles/, JSP system vulnerabilities OurGame station and the NetEase for a while before you can directly upload the JSP file. File name is the original file name, Bo-Blog background can be uploaded directly to the.Php file, upload the file path prompted. A year ago, a very popular upfile.asp vulnerability (Network 5 and 6, many of the early station system), the filter file upload is not strict, resulting in users can directly upload webshell to the website any writable directory, the administrator privileges in order to get a web control. Two, add modify upload type Now many scripts uplo