IIS6.0使用冒号上传漏洞利用

利用条件:

1.iis版本为6.0 

2.上传文件名不会重命名

利用：

上传一个jpg木马图片 名字为：cs.asp:.jpg 注意是: 默认windows是不允许文件字含:（冒号）的 所以需要抓包后改下！！

上传成功后，iis会忽略掉:后面的字符，也就是成了cs.asp .但是在接收判断文件后缀还是可以检测的.jpg 绕过了 后缀检测 。

iis截取到的数据是完整的cs.asp:.jpg 但是上传过去的文件应该由于windows不允许带:文件名 所以iis直接去掉了:后面的 这个和%00截断应该不是一样，%00截断是直接截断了后面的 这样的话如果在前面有检测就无法通过检测了。

附上测试代码

 <form action=”.asp?s=ys” method=”post”
 enctype=”multipart/form-data” name=”form1″>
 file:<input name=”FormNameItem” type=”file” />
 <button type=”submit”>提交</button>
 </form>
 <%
 if len(Request(“s”))> then
 Set oFileObj = New UpFileClass
 oFileObj.GetData
 For Each FormNameItem in oFileObj.File
 FileName = oFileObj.File(FormNameItem).FileName
 FileExtName = oFileObj.File(FormNameItem).FileExt
 FileContent = oFileObj.File(FormNameItem).FileData
 oFileObj.File(FormNameItem).SaveToFile server.MapPath(“\”) &
 Response.Write server.MapPath(“\”) & “\.asp:.jpg OK!”
  .Next
 end if
 Dim UpFileStream
 Class UpFileClass
 Dim Form,File,Err
 Private Sub Class_Initialize
 Err = -
 End Sub
 Private Sub Class_Terminate
 ’清除变量及对像 www.2cto.com
 If Err <  Then
 Form.RemoveAll
 Set Form = Nothing
 File.RemoveAll
 Set File = Nothing
 UpFileStream.Close .Set UpFileStream = Nothing
 End If .End Sub
 Public Property Get ErrNum()
 ErrErrNum = Err .End Property
 Public Sub GetData ()
 ’定义变量
 Dim RequestBinData,sSpace,bCrLf,sObj,iObjStart,iObjEnd,tStrea
 Dim iFileSize,sFilePath,sFileType,sFormValue,sFileName
 Dim iFindStart,iFindEnd
 Dim iFormStart,iFormEnd,sFormName
 ’代码开始56.If Request.TotalBytes <  Then ‘如果没有数据
 Err =
 Exit Sub
 End If
 Set Form = CreateObject (“Scripting.Dictionary”)
 Form.CompareMode =
 Set File = CreateObject (“Scripting.Dictionary”)
 File.CompareMode =
 Set tStream = CreateObject (“ADODB.Stream”)
 Set UpFileStream = CreateObject (“ADODB.Stream”)
 UpFileStream.Type =
 UpFileStream.Mode =
 UpFileStream.Open
 dim ReadedBytes,ChunkBytes
 ReadedBytes=
 ChunkBytes=* ’100K分块上传方案
 Do While ReadedBytes < Request.TotalBytes
 UpFileStream.Write Request.BinaryRead(ChunkBytes)
 ReadedBytesReadedBytes = ReadedBytes + ChunkBytes
 If ReadedBytes > Request.TotalBytes Then ReadedBytes = Reque
 Loop
 ’UpFileStream.Write (Request.BinaryRead(Request.TotalBytes))
 UpFileStream.Position =
 RequestBinData=UpFileStream.Read
 iFormEnd = UpFileStream.Size
 bCrLf = ChrB () & ChrB ()
 .’取得每个项目之间的分隔符84.sSpace=Mi
 RequestBinData,bCrLf)-) .iStart=LenB (sSpace)
 iFormStart = iStart+ .’分解项目
 Do
 iObjEnd=InStrB(iFormStart,RequestBinData,bCrLf & bCrLf)+
 tStream.Type =
 tStream.Mode =
 tStream.Open .UpFileStream.Position = iFormStart
 UpFileStream.CopyTo tStream,iObjEnd-iFormStart
 tStream.Position =
 tStream.Type =  .tStream.CharSet = “gb2312″
 sObj = tStream.ReadText
 ’取得表单项目名称100.iFormStart = InStrB (iObjEnd,RequestBinData,sSpace)-
 iFindStart = InStr (,sObj,”name=”"”,1)+6
 iFindEnd = InStr (iFindStart,sObj,”"”",)
 sFormName = Mid (sObj,iFindStart,iFindEnd-iFindStart)
 ’如果是文件105.If InStr (,sObj,”filename=”"”,1) > 0 Then 106.Set oFileObj = new  FileObj_Class
 ’取得文件属性
 iFindStart = InStr (iFindEnd,sObj,”filename=”"”,1)+10
 iFindEnd = InStr (iFindStart,sObj,”"”",)
 sFileName = Mid (sObj,iFindStart,iFindEnd-iFindStart)
 oFileObj.FileName = Mid (sFileName,InStrRev (sFileNam
 oFileObj.FilePath = Left (sFileName,InStrRev (sFileName,
 oFileObj.FileExt = Mid (sFileName,InStrRev (sFileName, “
 iFindStart = InStr (iFindEnd,sObj,”Content-Type: “,)+
 iFindEnd = InStr (iFindStart,sObj,vbCr)
 oFileObj.FileType = Mid (sObj,iFindStart,iFindEnd-iFindSt
 oFileObj.FileStart = iObjEnd
 oFileObj.FileSize = iFormStart -iObjEnd -
 oFileObj.FormName = sFormName
 File.add sFormName,oFileObj
 else
 ’如果是表单项目
 tStream.Close
 tStream.Type =
 tStream.Mode =
 tStream.Open
 UpFileStream.Position = iObjEnd
 UpFileStream.CopyTo tStream,iFormStart-iObjEnd-
 tStream.Position =
 tStream.Type =
 tStream.CharSet = “gb2312″
 sFormValue = tStream.ReadText
 If Form.Exists(sFormName)Then
 Form (sFormName) = Form (sFormName) & “, ” & sForm
 else
 form.Add sFormName,sFormValue
 End If
 End If
 tStream.Close
 iFormStartiFormStart = iFormStart+iStart+
 ’如果到文件尾了就退出
 Loop Until (iFormStart+) >= iFormEnd
 RequestBinData = “”
 Set tStream = Nothing
 Set KS=Nothing
 End Sub
 End Class
 ’—————————————————————
 ’文件属性类
 Class FileObj_Class
 Dim FormName,FileName,FilePath,FileSize,FileType,FileS
 ’保存文件方法154.Public Function SaveToFile (Path)
 ’On Error Resume Next
 Dim oFileStream
 Set oFileStream = CreateObject (“ADODB.Stream”)
 oFileStream.Type =
 oFileStream.Mode =
 oFileStream.Open
 UpFileStream.Position = FileStart
 UpFileStream.CopyTo oFileStream,FileSize
 oFileStream.SaveToFile Path,
 oFileStream.Close
 Set oFileStream = Nothing
 Set KS=Nothing
 End Function
 ’取得文件数据
 Public Function FileData
 UpFileStream.Position = FileStart
 FileData = UpFileStream.Read (FileSize)
 End Function
 End Class
 %>