DotNetNuke (DNN)

Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

• Check the subscription plans!

• Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.

• Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.

DotNetNuke (DNN)

Ako se prijavite kao administrator u DNN, lako je dobiti RCE.

RCE

Putem SQL-a

SQL konzola je dostupna na stranici Settings gde možete omogućiti xp_cmdshell i izvršiti komande operativnog sistema.

Koristite ove linije da omogućite xp_cmdshell:

EXEC sp_configure 'show advanced options', '1'
RECONFIGURE
EXEC sp_configure 'xp_cmdshell', '1'
RECONFIGURE

I pritisnite "Run Script" da pokrenete te sQL rečenice.

Zatim, koristite nešto poput sledećeg da pokrenete OS komande:

xp_cmdshell 'whoami'

Putem ASP webshell-a

U Settings -> Security -> More -> More Security Settings možete dodati nove dozvoljene ekstenzije pod Allowable File Extensions, a zatim kliknuti na dugme Save.

Dodajte asp ili aspx i zatim u /admin/file-management otpremite asp webshell nazvan shell.asp, na primer.

Zatim pristupite /Portals/0/shell.asp da biste pristupili svom webshell-u.

Eskalacija privilegija

Možete eskalirati privilegije koristeći Potatoes ili PrintSpoofer, na primer.

Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

• Check the subscription plans!

• Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.

• Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.