EC Council CASE.NET_輸入驗證Lab5_Protecting Applications from Path Traversal Attack
aspx檔案內容
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320 321 322 323 324 325 326 327 328 329 330 331 332 333 334 335 336 337 338 339 340 341 342 343 344 345 346 347 348 349 350 351 352 353 354 355 356 357 358 359 360 361 362 363 364 365 366 367 368 369 370 371 372 373 374 375 376 377 378 379 380 381 382 383 384 385 386 387 388 389 390 391 392 393 394 395 396 397 398 399 400 401 402 403 404 405 406 407 408 409 410 411 412 413 414 415 416 417 418 419 420 421 422 423 424 425 426 427 428 429 430 431 432 433 434 435 436 437 438 439 440 441 442 443 444 445 446 447 448 449 450 451 452 | <%@ Page Language="C#" AutoEventWireup="true" CodeFile="Index.aspx.cs" Inherits="Labs.M1lab5.Index" %> <!DOCTYPE html> <html xmlns="http://www.w3.org/1999/xhtml"> <head runat="server"> <meta charset="utf-8"/> <title>Corporate training</title> <meta content="width=device-width, initial-scale=1.0" name="viewport"/> <meta content="corporate training, courses, training" name="keywords"/> <meta content="Corporate training" name="description"/> <meta name="author" content="ec-council" /> <!-- Favicons --> <link href="img/favicon.png" rel="icon"/> <link href="img/apple-touch-icon.png" rel="apple-touch-icon"/> <!-- Bootstrap CSS File --> <link href="lib/bootstrap/css/bootstrap.min.css" rel="stylesheet"/> <!-- Libraries CSS Files --> <link href="lib/font-awesome/css/font-awesome.min.css" rel="stylesheet"/> <link href="lib/ionicons/css/ionicons.min.css" rel="stylesheet"/> <link href="lib/magnific-popup/magnific-popup.css" rel="stylesheet"/> <!-- Main Stylesheet File --> <link href="css/style.css" rel="stylesheet"/> </head> <body> <header id="header"> <div class="container"> <div id="logo" class="pull-left"> <h1><a href="#intro" class="scrollto">Corporate training</a></h1> <!-- Uncomment below if you prefer to use an image logo --> <!-- <a href="#intro"><img src="img/logo.png" alt="" title=""></a> --> </div> <nav id="nav-menu-container"> <ul class="nav-menu"> <li class="menu-active"><a href="#intro">HOME</a></li> <li><a href="#about">WORK WITH US</a></li> <li><a href="#features">RESOURCES</a></li> <li><a href="#team">ABOUT</a></li> <li><a href="#contact">CONTACT US</a></li> </ul> </nav><!-- #nav-menu-container --> </div> </header><!-- #header --> <section id="intro"> <div class="intro-text"> <h2 style="padding-top:1.5rem;">Welcome to Corporate training</h2> <p>We bring the world of innovative and scalable digital learning to the class, onto the web and into the field. </p> <a href="#about" class="btn-get-started scrollto">Get Started</a> </div> <div class="product-screens"> <div class="product-screen-1 wow"> <img src="img/1.jpg" alt=""> </div> <div class="product-screen-2 wow"> <img src="img/2.jpg" alt=""> </div> <div class="product-screen-3 wow"> <img src="img/3.jpg" alt=""> </div> </div> </section><!-- #intro --> <main id="main"> <section id="about" class="section-bg"> <div class="container-fluid"> <div class="section-header"> <h3 class="section-title">WORK WITH US</h3> <span class="section-divider"></span> <p class="section-description"> Working with us means you participate in a collaborative journey that is thorough and efficient,<br/> and gets to the heart of your training challenges faster than with any other company. </p> </div> <div class="row"> <div class="col-lg-6 about-img wow"> <img src="img/about-img.jpg" alt=""> </div> <div class="col-lg-6 content wow"> <h2>STEPS TO SUCCEED </h2> <h3>We are looking for people who belive in themselves</h3> <p> Current Openings </p> <ul> <li><i class="ion-android-checkmark-circle"></i> Senior Trainer</li> <li><i class="ion-android-checkmark-circle"></i> Assistant Manager</li> <li><i class="ion-android-checkmark-circle"></i>Call center executive</li> </ul> <p> </p> </div> </div> </div> </section><!-- #about --> <section id="features"> <div class="container"> <div class="row"> <div class="col-lg-8 offset-lg-4"> <div class="section-header wow fadeIn" data-wow-duration="1s"> <h3 class="section-title">RESOURCES</h3> <span class="section-divider"></span> </div> </div> <div class="col-lg-4 col-md-5 features-img"> <img src="img/product-features.png" alt="" class="wow fadeInLeft"> </div> <div class="col-lg-8 col-md-7 "> <div class="row"> <div class="col-lg-6 col-md-6 box wow"> <div class="icon"><i class="ion-ios-speedometer-outline"></i></div> <h4 class="title"><a href="">Anouncements</a></h4> <p class="description">Deadly DDoS Attacks are on the Rise – Are You Prepared?</p> </div> <div class="col-lg-6 col-md-6 box wow" data-wow-delay="0.1s"> <div class="icon"><i class="ion-ios-flask-outline"></i></div> <h4 class="title"><a href="">Webinars</a></h4> <p class="description">A company which certifies individuals in various e-business and security skills.</p> </div> <!-- <div class="col-lg-6 col-md-6 box wow fadeInRight" data-wow-delay="0.2s"> <div class="icon"><i class="ion-social-buffer-outline"></i></div> <h4 class="title"><a href="">Sed ut perspiciatis</a></h4> <p class="description">Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur teleca starter sinode park ledo.</p> </div> <div class="col-lg-6 col-md-6 box wow fadeInRight" data-wow-delay="0.3s"> <div class="icon"><i class="ion-ios-analytics-outline"></i></div> <h4 class="title"><a href="">Magni Dolores</a></h4> <p class="description">Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum dinoun trade capsule.</p> </div> --> </div> </div> </div> </div> </section><!-- #features --> <section id="advanced-features"> <div class="features-row section-bg"> <div class="container"> <div class="row"> <div class="col-12"> <img class="advanced-feature-img-right wow" src="img/advanced-feature-1.jpg" alt=""> <div class="wow fadeInLeft"> <h2>Team Building</h2> <h3>The most important aspect Team work, is difficult. </h3> </div> </div> </div> </div> </div> <div class="features-row"> <div class="container"> <div class="row"> <div class="col-12"> <img class="advanced-feature-img-left" src="img/advanced-feature-2.jpg" alt=""> <div class="wow"> <h2>Personality Development Training</h2> <i class="ion-ios-paper-outline wow fadeInRight" data-wow-duration="0.5s"></i> <p class="wow fadeInRight" data-wow-duration="0.5s">Time Management</p> <i class="ion-ios-color-filter-outline wow fadeInRight" data-wow-delay="0.2s" data-wow-duration="0.5s"></i> <p class="wow fadeInRight" data-wow-delay="0.2s" data-wow-duration="0.5s">Stress Management</p> <i class="ion-ios-barcode-outline wow fadeInRight" data-wow-delay="0.4" data-wow-duration="0.5s"></i> <p class="wow fadeInRight" data-wow-delay="0.4s" data-wow-duration="0.5s">Interpersonal Relationship</p> </div> </div> </div> </div> </div> <div class="features-row section-bg"> <div class="container"> <div class="row"> <div class="col-12"> <img class="advanced-feature-img-right wow fadeInRight" src="img/advanced-feature-3.jpg" alt=""> <div class="wow"> <h2>Leadership Development</h2> <h3>The Leadership development programs consits activities that enhance the capacity of an individual or organization to lead well.</h3> <p>To develop Leadership and Managerial Skills we conduct a combination of Outdoor Leadership Training, Management Games, Business Simulations and Team Building Activities.</p> <i class="ion-ios-albums-outline"></i> <!--<p>Quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum.</p>--> </div> </div> </div> </div> </div> </section><!-- #advanced-features --> <!--========================== Call To Action Section ============================--> <section id="call-to-action"> <div class="container"> <div class="row"> <div class="col-lg-9 text-center text-lg-left"> <h3 class="cta-title">Resources</h3> <p class="cta-text"> Access the available Resources</p> </div> <div class="col-lg-3 cta-btn-container text-center"> <a class="cta-btn align-middle" href="#">Resources</a> </div> </div> </div> </section><!-- #call-to-action --> <!--========================== Frequently Asked Questions Section ============================--> <section id="faq"> <div class="container"> <div class="section-header"> <h3 class="section-title">Frequently Asked Questions</h3> <span class="section-divider"></span> <p class="section-description"></p> </div> <ul id="faq-list" class="wow fadeInUp"> <li> <a data-toggle="collapse" class="collapsed" href="#faq1">What do I receive when I purchase a product from Corporate Training Resource?<i class="ion-android-remove"></i></a> <div id="faq1" class="collapse" data-parent="#faq-list"> <p> A printed course material. </p> </div> </li> <li> <a data-toggle="collapse" href="#faq2" class="collapsed">Can I get a DVD? <i class="ion-android-remove"></i></a> <div id="faq2" class="collapse" data-parent="#faq-list"> <p> Downloadable Presentations. </p> </div> </li> <li> <a data-toggle="collapse" href="#faq3" class="collapsed">Are there time limits or restrictions on usage for the audio presentations?<i class="ion-android-remove"></i></a> <div id="faq3" class="collapse" data-parent="#faq-list"> <p> Unless specicified there are no restrictions. </p> </div> </li> </ul> </div> </section><!-- #faq --> <!--========================== Our Team Section ============================--> <section id="team" class="section-bg"> <div class="container"> <div class="section-header"> <h3 class="section-title">About Corporate Training</h3> <span class="section-divider"></span> <p class="section-description">We have the largest in-house staff of state-of-the-art instructional designers and performance consultants, agency-level creatives, and innovative technologists to produce effective and award winning training solutions. We combine science and street smarts to ensure you and your Learning and Development team produce solutions that exceed even the most challenging requirements. <br /><br /><a id="CourseDetails" href="download.aspx?filename=./PdfFiles/CourseDetails.pdf" style="background: linear-gradient(45deg, #1de099, #1dc8cd);border: 0;border-radius: 20px;padding: 8px 30px;color: #fff;" title="Download">Download Course Details</a> </p> </div> <div class="row wow fadeInUp"> <div> <h2>What We Do</h2> <p>We invent. We tinker. We experiment with new technologies. We share snippets of our life experiences with each other. It helps influence the way we think and the way we work. And leadership creates new ways to get inspired.</p> </div> </div> </div> </section><!-- #team --> <!--========================== Contact Section ============================--> <section id="contact"> <div class="container"> <div class="row wow fadeInUp"> <div class="col-lg-4 col-md-4"> <div class="contact-about"> <h3>Corporate Training</h3> <p>world of innovative and scalable digital learning. It's corporate training on your terms.</p> <div class="social-links"> <a href="#" class="twitter"><i class="fa fa-twitter"></i></a> <a href="#" class="facebook"><i class="fa fa-facebook"></i></a> <a href="#" class="instagram"><i class="fa fa-instagram"></i></a> <a href="#" class="google-plus"><i class="fa fa-google-plus"></i></a> <a href="#" class="linkedin"><i class="fa fa-linkedin"></i></a> </div> </div> </div> <div class="col-lg-3 col-md-4"> <div class="info"> <div> <i class="ion-ios-location-outline"></i> <p>A108 Adam Street<br>New York, NY 535022</p> </div> <div> <i class="ion-ios-email-outline"></i> <p>info@example.com</p> </div> <div> <i class="ion-ios-telephone-outline"></i> <p>+1 5589 55488 55s</p> </div> </div> </div> <div class="col-lg-5 col-md-8"> <div class="form"> <div id="sendmessage">Your message has been sent. Thank you!</div> <div id="errormessage"></div> <form action="" method="post" role="form" class="contactForm"> <div class="form-row"> <div class="form-group col-lg-6"> <input type="text" name="name" class="form-control" id="name" placeholder="Your Name" data-rule="minlen:4" data-msg="Please enter at least 4 chars" /> <div class="validation"></div> </div> <div class="form-group col-lg-6"> <input type="email" class="form-control" name="email" id="email" placeholder="Your Email" data-rule="email" data-msg="Please enter a valid email" /> <div class="validation"></div> </div> </div> <div class="form-group"> <input type="text" class="form-control" name="subject" id="subject" placeholder="Subject" data-rule="minlen:4" data-msg="Please enter at least 8 chars of subject" /> <div class="validation"></div> </div> <div class="form-group"> <textarea class="form-control" name="message" rows="5" data-rule="required" data-msg="Please write something for us" placeholder="Message"></textarea> <div class="validation"></div> </div> <div class="text-center"><button type="submit" title="Send Message">Send Message</button></div> </form> </div> </div> </div> </div> </section><!-- #contact --> </main> <!--========================== Footer ============================--> <footer id="footer"> <div class="container"> <div class="row"> <div class="col-lg-6 text-lg-left text-center"> <div class="copyright"> © Copyright <strong>Corporate Training</strong>. All Rights Reserved </div> </div> <div class="col-lg-6"> <nav class="footer-links text-lg-right text-center pt-2 pt-lg-0"> <a href="#intro" class="scrollto">Home</a> <a href="#about" class="scrollto">About</a> <a href="#">Privacy Policy</a> <a href="#">Terms of Use</a> </nav> </div> </div> </div> </footer><!-- #footer --> <a href="#" class="back-to-top"><i class="fa fa-chevron-up"></i></a> <!-- JavaScript Libraries --> <script src="lib/jquery/jquery.min.js"></script> <script src="lib/jquery/jquery-migrate.min.js"></script> <script src="lib/bootstrap/js/bootstrap.bundle.min.js"></script> <script src="lib/easing/easing.min.js"></script> <script src="lib/wow/wow.min.js"></script> <script src="lib/superfish/hoverIntent.js"></script> <script src="lib/superfish/superfish.min.js"></script> <script src="lib/magnific-popup/magnific-popup.min.js"></script> <!-- Contact Form JavaScript File --> <script src="contactform/contactform.js"></script> <!-- Template Main Javascript File --> <script src="js/main.js"></script> </body> </html> |
通常這類風險駭客最常會從檔案下載途徑來進行攻擊突破
當它已經知道目前網站應用採用技術是.net 系列
就可能會想竊取web.config
可以看到在308行
href="download.aspx?filename=./PdfFiles/CourseDetails.pdf"
是直接連到另一個aspx做檔案下載
download.aspx.cs 程式內容
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 | using System; using System.Collections.Generic; using System.IO; using System.Linq; using System.Web; using System.Web.UI; using System.Web.UI.WebControls; namespace Labs.M1lab5 { public partial class download : System.Web.UI.Page { protected void Page_Load(object sender, EventArgs e) { if (Request.QueryString["filename"] != null) { try { string filename = Request.QueryString["filename"]; if (filename != null) { String downloadfilename = Server.MapPath(filename); string Filenamestr = filename.Substring(filename.LastIndexOf("/") + 1); if (File.Exists(downloadfilename)) { Response.ContentType = "application/pdf"; Response.AppendHeader("Content-Disposition", "attachment; filename=" + Filenamestr); Response.TransmitFile(downloadfilename); Response.End(); } else { ScriptManager.RegisterClientScriptBlock(this, GetType(), "none", "<Script>alert('File Not Found!');</Script>", false); } } } catch (Exception ex) { } finally { } } } } } |
這邊只要有心人士在client端瀏覽器編輯一下html內容
href="download.aspx?filename=./PdfFiles/CourseDetails.pdf"
改成
href="download.aspx?filename=~/web.config"
web.config裡面一些敏感資訊
包含資料庫連線帳密都會一清二楚
之所以可以直接把這個站台檔案資料直接載下來就是因為
1.client端暴露出站台相對的路徑
href="download.aspx?filename=./PdfFiles/CourseDetails.pdf"2.直接用Server.MapPath
String downloadfilename = Server.MapPath(filename);而且很信賴來自client發過來的路徑字串
通常建議在client端不要直接暴露完整站台相對路徑
因此直接改為只有檔案名稱即可
href="download.aspx?filename=CourseDetails.pdf"
再來這邊可透過Path.Combine來避免重組路徑字串的風險
String downloadfilename = Server.MapPath(Path.Combine("PdfFiles", filename));
./PdfFiles/CourseDetails.pdf
留言
張貼留言