中国网络渗透测试联盟

标题: 最新FCKEditor ASP上传绕过漏洞 [打印本页]
作者: admin    时间: 2012-12-10 10:18
标题: 最新FCKEditor ASP上传绕过漏洞
exploiut-db：
1 J; T3 y" d8 r# C/ D' p- Z) V, x" C( ~' Q1 r" ~3 y
FCKEditor ASP Version 2.6.8 File Upload Protection Bypass1 l) u+ V. L: K& D' v1 p  ~

0 H8 p8 @5 N- b5 g6 ]4 j* L- Title: FCKEditor 2.6.8 ASP Version File Upload Protection bypass! ^5 B, r. t2 D! `# W+ }' i
- Credit goes to: Mostafa Azizi, Soroush Dalili& O, w* z# j' l0 v9 P
- Link:http://sourceforge.net/projects/fckeditor/files/FCKeditor/* o& Y$ U4 A8 }
- Description:
6 E$ t  z  ~9 \  ~. L0 g" R6 {There is no validation on the extensions when FCKEditor 2.6.8 ASP version is/ D$ }$ F% w+ \$ [# e, c& Y
dealing with the duplicate files. As a result, it is possible to bypass
) O5 v, y7 ?7 F: w  p4 \& u1 C3 Rthe protection and upload a file with any extension.7 _; X) M& L# u* h2 n
- Reference: http://soroush.secproject.com/blog/2012/11/file-in-the-hole// n( }; I5 I( ~& B8 z9 Y. ~& p
- Solution: Please check the provided reference or the vendor website.
: F+ {- V  H: a- c$ t1 F- PoC:http://www.youtube.com/v/1VpxlJ5 ... ;rel=0&vq=hd7208 ?# W8 R! N% L% t" D8 p
"* A9 u# ^  y, i
Note: Quick patch for FCKEditor 2.6.8 File Upload Bypass:
1 W+ b% C2 g: F" `0 X4 w; eIn “config.asp”, wherever you have:
+ U2 Q0 {; p0 I6 ^      ConfigAllowedExtensions.Add    “File”,”Extensions Here”
+ j4 R9 g! W, l$ c1 DChange it to:& f3 |) x% b4 _! C' w) m( B
      ConfigAllowedExtensions.Add    “File”,”^(Extensions Here)$”1 q. x+ l0 [( |3 P, |
8 m. R+ c* V0 q" E1 R- ]
& [) ^7 @$ R" u% v
; u+ o! _$ |+ V2 k7 G

% K; O# ~+ C# r& r! M9 k
8 i5 Q, B8 c" _, gphp测试无效# \. {9 L, V1 z$ F* ^
asp/aspx测试成功：" E2 D9 g$ p; A; L2 h
来到/FCKeditor/editor/filemanager/connectors/test.html, ]$ K9 j0 d5 p
因为结合了之前二次上传的漏洞，所以先上传任意内容的文件：asd.asp.txt* b0 W' A% Q4 x4 U9 G4 b! i8 b

( p- X( i5 }" @! [4 ~- nburpsuite上传包并修改，repeater4 n. N$ v- b3 v
名字改为asd.asp%00txt    然后把%00专为URL编码上传后得到asd(1).asp6 ~: q- x/ _; i) G

& [2 @  J0 p" @) }" |/ p如图，webshell为：http://localhost/userfiles/file/asd(1).asp
7 v6 ^' L/ ^( o& ~
: r& a: _. R6 ], ~8 A



欢迎光临 中国网络渗透测试联盟 (https://cobjon.com/) Powered by Discuz! X3.2