WooYun.org

public void Page_Init(object sender, EventArgs e)
{
    base.mustLogin = false; //无需登录
    base.Page_Init(sender, e);
}

public void Page_Load(object sender, EventArgs e)
{
    this.method_1();
}
private void method_1()
{
    string str = string.Format("upload/{0}/", DateTime.Now.ToString("yyyy-MM"));
    string s = string.Empty;
    if (!string.IsNullOrEmpty(base.Request.QueryString["file"]))//file可自由控制
    {
        str = string.Format("{0}/{1}", str, base.Request.QueryString["file"]);
    }
    bool flag = false;
    HttpPostedFile file = base.Request.Files["Filedata"];
    string str5 = Path.GetExtension(file.FileName).ToLower();
    string[] strArray = new string[] { ".gif", ".png", ".jpeg", ".jpg" };
    for (int i = 0; i < strArray.Length; i++)
    {
        if (str5 == strArray[i])
        {
            flag = true;
        }
    }
    if (flag)
    {
        if (!Directory.Exists(base.Server.MapPath(str)))
 //这里判断目录是否存在不存在就创建目录 由于file我们可以自己控制 如果目录为1.asp 那么等下上传图片就可以跟进解析漏洞获取webshell了
        {
            Directory.CreateDirectory(base.Server.MapPath(str));
        }
        Random random = new Random();
        string str6 = DateTime.Now.ToString("yyyyMMddHHmm") + random.Next(0x2710).ToString();
        str = string.Format("{0}{1}{2}", str, str6, str5);
        s = str;
        file.SaveAs(base.Server.MapPath(str)); //保存
        FileInfo info = new FileInfo(base.Server.MapPath(str));
        if (info.Length < 0x7d000L)
        {
            string input = WbIO.ReadFile(base.Server.MapPath(str));
            string str3 = str5.TrimStart(new char[] { '.' });
            if ((((str3 != "html") && (str3 != "txt")) && ((str3 != "htm") && (str3 != "asp"))) && (((str3 != "aspx") && (str3 != "php")) && Regex.IsMatch(input, "<html|<script|<object", RegexOptions.Singleline | RegexOptions.Compiled | RegexOptions.IgnoreCase)))
            {
                File.Delete(base.Server.MapPath(str));
                return;
            }
        }
        info = null;
    }
    base.Response.StatusCode = 200;
    base.Response.Write(s);
}