DotNetNuke (DNN)
Last updated
Last updated
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
If you enter as administrator in DNN it's easy to obtain RCE.
A SQL console is accessible under the Settings page where you can enable xp_cmdshell and run operating system commands.
Use these lines to enable xp_cmdshell:
And press "Run Script" to run that sQL sentences.
Then, use something like the following to run OS commands:
In Settings -> Security -> More -> More Security Settings you can add new allowed extensions under Allowable File Extensions, and then clicking the Save button.
Add asp or aspx and then in /admin/file-management upload an asp webshell called shell.asp for example.
Then access to /Portals/0/shell.asp to access your webshell.
You can escalate privileges using the Potatoes or PrintSpoofer for example.
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
