hessen 发表于 2022-9-19 15:45:50

IIS短文件名泄露漏洞修复

本帖最后由 hessen 于 2022-9-19 15:50 编辑

IIS短文件名泄露漏洞修复

为了兼容16位MS-DOS程序,Windows为文件名较长的文件(和文件夹)生成了对应的windows 8.3 短文件名,由于短文件名的长度固定(xxxxxx~xxxx),因此黑客可直接对短文件名进行暴力破解 ,从而访问对应的文件。

在服务器上快表的程序目录文件夹下 压住Shift键 点击鼠标右键,在右键菜单中选择,在此处打开命令提示符。
1、输入 dir /x可以查看是否存在短文件名。如下图中,ASPNET~1就是短文件名,他的文件名是后面显示的aspnet_client
2、输入fsutil 8dot3name query 可以查询是否开启了短文件名功能
3、输入fsutil 8dot3name set 1 为关闭该功能
4、复制KuaibiaoFree文件夹,并删除原来的KuaibiaoFree文件夹,最后将刚才复制的KuaibiaoFree 副本 文件夹改名为KuaibiaoFree
注:图中1是为了方便截图,将目录退到了上一级目录。以方便删除KuaibiaoFree文件夹。要不然会提示占用而不能删除。
5、输入 dir /x 查询可以看到,短文件名已经没了。
注:设置关闭后对新的文件起作用。所以刚才要复制删除。
























woalbb 发表于 2022-10-10 09:43:31

data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAdYAAABDCAYAAAAhxiQeAAAIXElEQVR4nO3dO5ITOxSA4YaagOAugG2QentEbMwhAQnbYAdzg1tN9ehK56Wjh+3/q6Lw2G5JrVbrtB4Dn75+//3+58e3A4i43+/H7XYzf9fqmuZ5XPne7XZr5l87ZjRPXZD/XiztSXtfS8OTn6fM2M/b6gLgtVg6gjIA147ROqXZHc7qTu7V8+8VCarncZY0PPnh8X1ixAoAQJ7PqwsAAMAzIbACAJCIwAoAQCICKwAAiQisAAAkIrACAJCIwAoAQCICKwAAiQisAAAkIrACAJCIwAoAQCICKwAAiQisAAAkIrACAJCIwAoAQCICKwAAiQisCLvf70+ZFwD0SAusdHyv5X6/H7fbbVp+t9tNbGO0PwC7+PT1++/3Pz++HcdR75w8nWers211ejM75pWs539+T6qX2QEtswxlPUhtpZW+lLel/ZUBOrMuLddv5PFauqUzH0v73KHdaUbfP5b2O9Lq/GH3dr6oNbisUcDZmdXSf4XGkXH+jz4is5z/9efMtlHWf+t6jDIqYFpp7c/SPj11tvp8a3rvH+/9m10Hr9x/PiLWWBdo3XRnJ1cjfTbTqJu5TFeqhxGdZIbWNbLmNesaW2YFap9b6r4M1tmkNHe6f7JGxXhMn4+j3dG0ptWkqSMaBlbxdPyI8dzj1HMe6vKxvOlfGc+6BqatMbTWiCPpS/lKZZBYN9+MWgPqXUO35n2t49ZUonU9NFOr/msjNOm9Wtms5W6NBi3Ha9+JXH/P59d0a9P45Wvv/SnVv5b+yHZzLafUfr31662/Mq2ybrT9A739W8Yab1lW6/WX8tf699p5j24vx9fvv99//vr5/uWfLyl/Wmn9/PXzf39a36ml1fp+6/Pe9KWftXJp9SIdo6Un1a83z8h1t5ZdaweW9z3naj0mq/68ZZPaXiRda3uPtIVIm46cV6R9Ru8P77lJx0fKmnl+kfunt3/L6D/KdHvbZO0com0++0/6Gqs0VXSuc2hrIbXXmeXTXr/KdHZ2/Z7XXhqNSutvGeXRpiqjyxUZ7aNsb550dmufGVPqjza9OXr92CJ6/6xuP9Y9FL2k/r2cFRjZ/raYCs6gTYNYtKZUso26oN6AMrNjq91Yj7beOat9jM5fq3Pt88h1W93+eu3WfiP597af1Q90q/P3eDuO/F+HWdHoevN7tE6+xtth9nSQq+rKkrdWxmintLJ9jMhfSzOzTziOnPb3qnbo31Zfq4zyW9avMzSngqXpvB2fHK7TkL1l3PH8ImobIkbnF50qWzm9VmPdaBZNs6ejW1VPM8ts+f5O7aWUUbZR55eVrncpw9MfPfr1b/7LS9rORM90kXc3o/V75bpB64nYm375ZNPaZWZ9AvLUa6uMlnOw7jrUymJR1rdlZ6JlKlDb1Wgts9T+LOWrXVvpuluun9RePNe3lU6rfqU9D5bPr+VvyW6/lrrypJ/R/rX2a20/Wv7WNiL1r9J70f4tYyq/TC9y/0nnqpVt1izJh8CabeZUT/a0FXSrr++IYwDMseL+nJXn025eOt/DODPrl2sJPI+zr54V6GatrZ5MI9bdN6tYjomeww6bBnYirb2vqF9PPl67XbfeNc7INHpG3sCr+TBibd08nl2U1nnwZ9thOTLdVTznY20jlrU6z/qIZ31FWjOU1ntGk/LyPMQ82gMw8Kw+BFapc/TcNJHFZqlzsWyu8NAWzqP5ex5AdjfqPKQ60vJsHRu9jtrPM13vDcumolY9ZF03yz16zeeZ2j7Qq7nGaulkMm+i3l1cvTf16l1kGbJmBaKzE1oZrp9pr7PrfPfru3LELJVDe/+K4Ar85+04Pt405d+n3W8Y703tCdbZ6Y4wcl2sNrJrtRPpuIzy9TwseD+bvTmr3NDhnSKW3gcwj/gvL83W6kgiv4NmnW62jGQs9ePtuFfXdYtlqrU1lS79PLOs5e/DXf+2pLGKZYli5F4Fz1S5FNh3qlNgha1+3aZ3Q0a55hNNpxY8tA7Du8lEyruV3k4s04JXnoemMo1aMPFeCym/HTbWtabGLQ8rI8vvbb8ALoG1tnnCSnqynb2W1qMsUyu4Xr+zi5nlaU1VSiNza4DQNs5d6z8yVap9tiJo9I70M9ZmPdcUgEwcsVqnoVodg+V1LV2tHLUyWNOS0tc69evPngC7Yo12xHRc7cGjlpeUtzbS9NZVa23Zch6ZetZpI1OuHtpegchMDIA28fdYZ62ZSTd7dArXk5Y2gvEeUx43e90pOy/rKNGSjmWk2VN+6+5V6fiInvr2jOZHtKPdRvDAo/u7K3gnWlBqjXhHjPYs+e9kRcdrecgo05FGQp4p90iw2a29l7JHrD2yR6y7LqUAmf7uCj6OPTqc1jqd9MTeO3V45puRTiutGR1JRlCNTsdKx0bK5JkRkN7zpr3iHhgRSCMb8LSyefLVPtv54RTotdWuYGmqMDoNlhVsyvSk9b2e/KJP9CPKYtXbWXpnBGpLFt4lg51ogcgbHDOvO2usgN+UwGrpCI5D/5UVzxRhy8j1ztVP4VkdXnRkE63byCi5J+8dR6zarIyH9KCzsv1n3L/AI6gG1lbn0hpJXj+XppW9G4GkaUXLDSrlJ01LaRtsauW2jiIsnU/EiHVV69RdxkatSFAt20Cr465tZpPsssYpTa1r95J0DSxLGbXXte94ZysIqHgFaf/RuXXtMrrZxVsWy/FZT+7WdFaPaHt5No1ZZylaojMcnu/sIrru37tfYOXyAfDM0gIrAAA4js+rCwAAwDMhsAIAkIjACgBAIgIrAACJCKwAACQisAIAkIjACgBAIgIrAACJCKwAACQisAIAkIjACgBAIgIrAACJCKwAACQisAIAkIjACgBAIgIrAACJ/gUgCR4g18509gAAAABJRU5ErkJggg==

hessen 发表于 2023-6-28 15:31:12

windows2003中 可使用
C:\Program Files\KuaibiaoEE>fsutil behavior query disable8dot3
disable8dot3 = 0

C:\Program Files\KuaibiaoEE>fsutil behavior set disable8dot3 1

C:\Program Files\KuaibiaoEE>fsutil behavior query disable8dot3
disable8dot3 = 1
页: [1]
查看完整版本: IIS短文件名泄露漏洞修复