3.3 KiB
DotNetNuke (DNN)
{% hint style="success" %}
Learn & practice AWS Hacking:
HackTricks Training AWS Red Team Expert (ARTE)
Learn & practice GCP Hacking: 
HackTricks Training GCP Red Team Expert (GRTE)
Support HackTricks
- Check the subscription plans!
- Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.
- Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.
DotNetNuke (DNN)
Ako se prijavite kao administrator u DNN, lako je dobiti RCE.
RCE
Putem SQL-a
SQL konzola je dostupna na stranici Settings gde možete omogućiti xp_cmdshell i izvršiti komande operativnog sistema.
Koristite ove linije da omogućite xp_cmdshell:
EXEC sp_configure 'show advanced options', '1'
RECONFIGURE
EXEC sp_configure 'xp_cmdshell', '1'
RECONFIGURE
I pritisnite "Run Script" da pokrenete te sQL rečenice.
Zatim, koristite nešto poput sledećeg da pokrenete OS komande:
xp_cmdshell 'whoami'
Via ASP webshell
U Settings -> Security -> More -> More Security Settings možete dodati nove dozvoljene ekstenzije pod Allowable File Extensions, a zatim kliknite na dugme Save.
Dodajte asp ili aspx i zatim u /admin/file-management otpremite asp webshell nazvan shell.asp, na primer.
Zatim pristupite /Portals/0/shell.asp da biste pristupili svom webshell-u.
Privilege Escalation
Možete povećati privilegije koristeći Potatoes ili PrintSpoofer, na primer.
{% hint style="success" %}
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
Support HackTricks
- Check the subscription plans!
- Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.
- Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.