ASP.NET代码审计硬编码（后门账号）

摸金校尉-马

已于 2025-05-01 19:27:41 修改

阅读量297

点赞数 2

CC 4.0 BY-SA版权

文章标签： asp.net 后端安全

于 2025-05-01 19:23:13 首次发布

本文链接：https://blog.csdn.net/2301_77012231/article/details/147654457

XX系统

打开代码分析，这里的登录接口有好几个

Account\VipLogin.cs代码

using System;
using System.Web.UI;
using System.Web.UI.HtmlControls;
using System.Web.UI.WebControls;
using Plat.Common;
using Plat.Security;

namespace Web.Account;

public class VipLogin : Page
{
	protected HtmlForm form1;

	protected HtmlTable tb;

	protected HtmlInputText txtUserName;

	protected HtmlInputPassword txtPassword;

	protected HtmlInputText txtVCode;

	protected Button Button1;

	protected HtmlGenericControl btxt;

	protected void Page_Load(object sender, EventArgs e)
	{
	}

	private void login()
	{
		string userName = txtUserName.Value;
		string password = txtPassword.Value;
		if (WebContext.GetValidateCode() != txtVCode.Value.ToUpper())
		{
			WebMessage.Show(this, "您填写的验证码有误！请检查后重新输入！");
			return;
		}
		if (userName != "Vip")
		{
			WebMessage.Show(this, "用户名错误！");
			return;
		}
		if (password != "Vip123456")
		{
			WebMessage.Show(this, "密码错误！");
			return;
		}
		Session["AdminName"] = "Vip用户";
		Session["DistrictId"] = "1";
		Session["DistrictSn"] = "01";
		Session["DistrictCnName"] = "Vip用户";
		Session["OrganizationName"] = "中华人民共和国农业部渔业局";
		base.Response.Redirect("/Home/mainVip.aspx");
	}

	protected void Button1_Click(object sender, EventArgs e)
	{
		login();
	}
}

关键代码