Database backup takes webshell simple record

Database backup to take webshell the main premise is to enter the application system background, and database backup function (a bit of nonsense)!

When we try to enter a system background, we thought we would find a place to upload a webshell, but the upload point is extremely limited, high-intensity whitelist restrictions, all kinds of bypass are not successful, coincidentally, there is a database backup function in the system background, at this time we can get webshell through database backup!

First of all, we upload a picture horse and get the path of the picture!

Second, let's go to the database backup function and replace the current database path with the path of the image horse (if the page cannot be modified, we can use the review element to modify the HTML code)!

Finally, we modify the database backup name to the file type of webshell (such as 123.asp). If the name is automatically repeated at the time of submission, we can use 00 truncation or burpsuit to make corresponding packet changes!

After completing the above operation, we click backup, and then we will get the backup webshell path, and then use the kitchen knife to connect!