1

I'm able to upload any file to an ASP webapp/IIS server. My first though is to upload an ASP shell but I don't know where the file has been uploaded.

I have written a Python script that beggining with the URLs dumped by ZAP, makes requests to any known folder looking for my ASP file. For example, if I have the following URLs /dashboard and /images and my shell is called myshell.asp my script requests for:

/dashboard/myshell.asp /dashboard/files/myshell.asp /dashboard/downloads/myshell.asp /images/myshall.asp /images/files/myshall.asp /images/downloads/myshell.asp

But I was unable to find the file.

I know that there exist certain special files that if present in a subdirectory have special meaning like: .htdocs. But if I don't know the path I don't know how to exploit this.

Is this scenario exploitable? How?

Improve this question

2 Answers 2

Reset to default
2

A few things to try:

  • Brute force a bit harder for directory names, perhaps using Dirbuster
  • Try to force an error message; this may reveal the path
  • Is there any way for the user to view an uploaded file? Look at that functionality in detail

If the files are stored outside the web root then this may be non-exploitable. However...

One other thing to look for is local file inclusion. This is where you upload a malicious script, then trick a legitimate script into including your malicious script. This is quite widely seen with PHP sites, but it also works with ASP.

Improve this answer
1

It really all depends on the configuration of the system you are trying to attack. The fact that you are allowed to upload a file of any type or size (as indicated in your question) is promising. Most file upload vulnerabilities are stopped at the validation level. The most straightforward way is what you are doing right now, to see if you can access the file you uploaded, but there may be other unknown attack vectors present. For example, maybe the uploaded files are accessed by staff, or the owner of the web server and you can upload something that will help exploit when ran. For the time being, I recommend you keep trying directory busting to discover a possible directory where you can find your uploaded file. You can use tools such as Burp Suite's intruder or Dirbuster. To directly answer your question if it is exploitable or not is not possible. Stay vigilant and get creative with your exploits. Good luck!

Improve this answer
1
  • 1
    What if you uploaded 'index.asp' or 'default.asp'? Then at least 'something' would break if it's being placed in any web-accessible dir. Or staff could possibly hit your file unintentionally when browsing uploaded files. :-)
    – Ryan Griggs
    May 27, 2014 at 10:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .