记一次aspx+KindEditor上传拿webshell
& 记一次aspx+KindEditor上传拿webshell&&&
分享到各大社区尊重他人劳动，你我共同努力。
记一次aspx+KindEditor拿webshell
作者:mOon& 博客：
0x01：前言
学员发来的站把，搞一下把。
首先用扫描器扫一些后台的html
现在开发一般都是包含html 这样方便点 随意调用用div+css样式把。
爬虫爬一下可能找到一些比较有价值的东西噢！
弄到kindeditor编辑器。 上面的封面怎么绕都绕不过。试试下面的编辑器把！
这个编辑器出现的地方基本都是这个页面 ，但是每次基本都是白名单验证 基本都是失败，抱着试一试的心态。
拿到分析一下源码
%@ Handler Language="C#" Class="upload" %&
* 作耿 牛腩
* 创建时间:
using System.W
using System.IO;
using System.T
public class upload : IHttpHandler
public void ProcessRequest(HttpContext context)
context.Response.ContentType = "text/html";
// 下面这句是最重要的，取得HttpPostedFile对象后就可以调用他的SaveAs方法亿
HttpPostedFile imgFile = HttpContext.Current.Request.Files["imgFile"];
// 取文件后缀吿
string houzui = new FileInfo(imgFile.FileName).E//这里获取后缀
//string url = context.Request.QueryString["url"].ToString();//莿
string filename = DateTime.Now.ToString("yyyyMMddhhmmss") +
// 服务器上保存的文件名秿
// 保存文件到根目录下的upload目录丿
DateTime now = DateTime.N
string datestr = now.Year.ToString() + "/" + now.Month.ToString();
if (!Directory.Exists(context.Server.MapPath(string.Format("/cpimg/{0}", datestr))))
Directory.CreateDirectory(context.Server.MapPath(string.Format("/cpimg/{0}", datestr)));
string savePath = context.Server.MapPath(string.Format("/cpimg/{0}/{1}", datestr, filename));
imgFile.SaveAs(savePath);
// 插入图片到kindeditor丿
string id = context.Request["id"];
string file_url = string.Format("/cpimg/{0}/{1}", datestr,filename) ;
string imgTitle = context.Request["imgTitle"];
string imgWidth = context.Request["imgWidth"];
string imgHeight = context.Request["imgHeight"];
string imgBorder = context.Request["imgBorder"];
StringBuilder sb = new StringBuilder();
sb.Append("&html&");
sb.Append("&head&");
sb.Append("&title&Insert Image&/title&");
sb.Append("&meta http-equiv=\"content-type\" content=\"text/ charset=utf-8\"&");
sb.Append("&/head&");
sb.Append("&body&");
sb.Append("&script type=\"text/javascript\"&parent.KE.plugin[\"image\"].insert(\"" + id + "\", \"" + file_url + "\",\"" + imgTitle + "\",\"" + imgWidth + "\",\"" + imgHeight + "\",\"" + imgBorder + "\");&/script&");
sb.Append("&/body&");
sb.Append("&/html&");
context.Response.Write(sb.ToString());
public bool IsReusable
&string houzui = new FileInfo(imgFile.FileName).E//这里获取后缀 整个段代码居然没有白名单验证，看到这里也是醉了。
0x02结束：
以后大家遇上这种aspx+KindEditor编辑器可以试试这个上传噢
如果您喜欢本博客，欢迎点击图片定订阅到邮箱
正文部分到此结束
你肿么看？
已有1条评论KindEditor
批量上传图片的同时
怎么带参数上传 - PHP当前位置:& &&&KindEditor
批量上传图片的同时
怎么带参数上传KindEditor
批量上传图片的同时
怎么带参数上传&&网友分享于：&&浏览：0次KindEditor
批量上传图片的同时
如何带参数上传求解脱&、谢谢各位！
用&&KindEditor&&&批量上传图片的同时&&，把下面&“house”&值&&也上传
&&input&type="text"&name="house_area"&id="house"&value=""&style="width:120"/&------解决思路----------------------谢谢&&自己已经搞定
12345678910
12345678910
12345678910 上一篇：没有了下一篇：文章评论相关解决方案 1234567891011 Copyright & &&版权所有KindEditor文件上传的大小限制和类型限制
查看数: 1882|
评论数: 0|
1.页面代码
&div&& tr &&/div&&div&& t d &&/div&&div& &wbr&&&&wbr&图片上传&/div&&div&& /td &&/div&&div&& td colspan=&5& align=&left& style=&text-align:& &&/div&&div&& div id=&filediv_infvaluelog_pic& &&/div&&div&& /div &&/div&&div&& input type=&button& id=&file_btn_infvaluelog_add_pic& value=&上传& /& &wbr&&/div&&div&& /td &&/div&&div&& /tr &&/div&复制代码
2.脚本代码
用编辑器打开 /kindeditor/asp/upload_json.asp
&div&&div&var uploadbutton3 = KindEditor.uploadbutton( {&/div&&div&button : KindEditor('#file_btn_infvaluelog_add_pic'),&/div&&div&fieldName : 'file',&/div&&div&url : 'upload_file_XXX_json?dir=image', //文件上传的action，设置dir为image&/div&&div&afterUpload : function(data) {&/div&&div&if (data.error === 0) {&/div&&div& &wbr&&&&wbr& //正确的时候执行&/div&&div&} else {&/div&&div& &wbr& //上传错误后，提示&/div&&div& &wbr&&&&wbr& &wbr&alert(data.message);&/div&&div&}&/div&&div&},&/div&&div&afterError : function(str) {//没正确执行时异常&/div&&div&alert('自定义错误信息: ' + str);&/div&&div&}&/div&&div&});&/div&&div&uploadbutton3.fileBox.change(function(e) {&/div&&div&uploadbutton3.submit();&/div&&div&});&/div&&div& &wbr&});&/div&&/div&&div&3.action方法&/div&&div&&div&public String fileupload() throws FileNotFoundException{&/div&&div&//最大文件大小&/div&&div&long maxSize = 1000000;&/div&&div&InputStream is =&/div&&div&if(imgFile!=null&&imgFile.isFile()){&/div&&div&is = new FileInputStream(imgFile);//传过来的文件&/div&&div&}else{&/div&&div&if(file.isFile()){&/div&&div&imgFile=&/div&&div&imgFileFileName=fileFileN&/div&&div&is = new FileInputStream(imgFile);//传过来的文件&/div&&div&}else{&/div&&div&error = 1;&/div&&div&message = &请选择要上传的文件。&;&/div&&div&}&/div&&div&}&/div&&div&HttpServletRequest request = ServletActionContext.getRequest();&/div&&div&String savePath =&/div&&div&String saveUrl =&/div&&div&//检查目录&/div&&div&File rootDir = new File(savePath);&/div&&div&if(!rootDir.isDirectory()){&/div&&div&error = 1;&/div&&div&message = &上传根目录不存在。&;&/div&&div&}&/div&&div&//检查目录写权限&/div&&div&if(!rootDir.canWrite()){&/div&&div&error = 1;&/div&&div&message = &上传根目录没有写权限。&;&/div&&div&}&/div&&div&String dirName =&/div&&div&if (dir == null) {&/div&&div&dirName = &other&;&/div&&div&}else{&/div&&div&dirName =&/div&&div&}&/div&&div&//创建文件夹&/div&&div&savePath += &/&+dirName + &/&;&/div&&div&saveUrl += &/&+dirName + &/&;&/div&&div&File saveDirFile = new File(savePath);&/div&&div&if (!saveDirFile.exists()) {&/div&&div&saveDirFile.mkdirs();&/div&&div&}&/div&&div&SimpleDateFormat sdf = new SimpleDateFormat(&yyyyMMdd&);&/div&&div&String ymd = sdf.format(new Date());&/div&&div&savePath += ymd + &/&;&/div&&div&saveUrl += ymd + &/&;&/div&&div&File dirFile = new File(savePath);&/div&&div&if (!dirFile.exists()) {&/div&&div&dirFile.mkdirs();&/div&&div&}&/div&&div&//检查文件大小&/div&&div&if(imgFile.length() & maxSize){&/div&&div&error = 1;&/div&&div&message = &上传文件大小超过限制。&;&/div&&div&}else{&/div&&div&//定义允许上传的文件扩展名&/div&&div& &wbr& HashMap extMap = new HashMap();&/div&&div& &wbr&&&&wbr&&&&wbr&&&&wbr&extMap.put(&image&, &gif,jpg,jpeg,png,bmp&);&/div&&div&extMap.put(&flash&, &swf,flv&);&/div&&div&extMap.put(&media&, &swf,flv,mp3,wav,wma,wmv,mid,avi,mpg,asf,rm,rmvb&);&/div&&div& &wbr&&&&wbr&&&&wbr&&&&wbr&&&&wbr& extMap.put(&file&,&gif,jpg,jpeg,png,bmp,doc,docx,xls,xlsx,ppt,htm,html,txt,zip,rar,gz,bz2&);&/div&&div&
&/div&&div&//检查扩展名&/div&&div&String fileExt = imgFileFileName.substring(imgFileFileName.lastIndexOf(&.&) + 1).toLowerCase();&/div&&div&if(!Arrays.asList(extMap.get(dirName).split(&,&)).contains(fileExt)){&/div&&div&error = 1;&/div&&div&message = &上传文件扩展名是不允许的扩展名。\n只允许& + extMap.get(dirName) + &格式。&;&/div&&div&}else{&/div&&div&SimpleDateFormat df = new SimpleDateFormat(&yyyyMMddHHmmss&);&/div&&div&String newFileName = df.format(new Date()) + &_& + new Random().nextInt(1000) + &_&;&/div&&div&try{&/div&&div&if(imgFileFileName.indexOf(&,&)!=-1){&/div&&div&imgFileFileName=imgFileFileName.replaceAll(&,&, &&);&/div&&div&}&/div&&div&File deskFile = new File(savePath+newFileName+imgFileFileName);&/div&&div&OutputStream os = new FileOutputStream(deskFile);&/div&&div&byte[] bytefer = new byte[1024];&/div&&div&int length = 0;&/div&&div&while ((length = is.read(bytefer)) != -1) {&/div&&div&os.write(bytefer, 0, length);&/div&&div&}&/div&&div&os.close();&/div&&div&is.close();&/div&&div&error = 0;&/div&&div&//message = &上传文件成功&;&/div&&div&//url = urlRoot + saveUrl + newFileName + imgFileFileN&/div&&div&if(&file&.equals(dir)){&/div&&div&url = savePath + newFileName + imgFileFileN&/div&&div&}else{&/div&&div&url = saveUrl + newFileName + imgFileFileN&/div&&div&}&/div&&div&url = url.trim().replaceAll(&\\\\\\\\&, &/&);&/div&&div&url = url.replaceAll(&\\\\&, &/&);&/div&&div&//检查是否是图片，是才进行压缩&/div&&div&if(url.endsWith(&.jpg&)||url.endsWith(&.jpeg&)||url.endsWith(&.png&)||url.endsWith(&.bmp&)||url.endsWith(&.gif&)){&/div&&div&//压缩&/div&&div&ImgProce ip = new ImgProce();&/div&&div&ip.setWideth(400);&/div&&div&ip.proce(savePath+newFileName+imgFileFileName, &400&);&/div&&div&}&/div&&div&}catch(Exception e){&/div&&div&error = 1;&/div&&div&message = &上传文件失败。&;&/div&&div&}&/div&&div&}&/div&&div&}&/div&&div& &wbr&&&&wbr&&&&wbr&&&&wbr& this.map=new HashMap();&/div&&div& &wbr&&&&wbr&&&&wbr&&&&wbr& this.map.put(&error&, error);&/div&&div& &wbr&&&&wbr&&&&wbr&&&&wbr& if(error==0){&/div&&div& &wbr&&&&wbr&&&&wbr&&&&wbr& this.map.put(&url&, url);&/div&&div& &wbr&&&&wbr&&&&wbr&&&&wbr& this.map.put(&filename&,imgFileFileName);&/div&&div& &wbr&&&&wbr&&&&wbr&&&&wbr& }else{&/div&&div& &wbr&&&&wbr&&&&wbr&&&&wbr& this.map.put(&message&, message);&/div&&div& &wbr&&&&wbr&&&&wbr&&&&wbr& }&/div&&div&return &SUCCESS&;&/div&&div&}&/div&&/div&复制代码
Tech Support by}