中国网络渗透测试联盟

标题: 最新FCKEditor ASP上传绕过漏洞 [打印本页]

---

作者: admin    时间: 2012-12-10 10:18
标题: 最新FCKEditor ASP上传绕过漏洞
exploiut-db：

) h" Y2 A& s3 \$ i( tFCKEditor ASP Version 2.6.8 File Upload Protection Bypass
- P4 N0 s: ~/ n$ ~8 c1 j5 }, L
- Title: FCKEditor 2.6.8 ASP Version File Upload Protection bypass
- Credit goes to: Mostafa Azizi, Soroush Dalili
- J7 J( x2 ~) i+ G- Link:http://sourceforge.net/projects/fckeditor/files/FCKeditor/
8 Q1 e! |* H% u; w$ N& q$ Y5 q- Description:
4 m8 F9 e+ G/ R0 ?. K. gThere is no validation on the extensions when FCKEditor 2.6.8 ASP version is
: D5 a( R/ H5 m5 v0 X# ~- cdealing with the duplicate files. As a result, it is possible to bypass
1 ^+ a& H+ d0 wthe protection and upload a file with any extension.
% h+ i: J: Z" k# }& D, U- Reference: http://soroush.secproject.com/blog/2012/11/file-in-the-hole/
2 X5 q) s7 D* Z3 Z! T1 u+ r% q- Solution: Please check the provided reference or the vendor website.
- PoC:http://www.youtube.com/v/1VpxlJ5 ... ;rel=0&vq=hd720
* z7 m+ ^# m$ L! s5 o  b"
5 I1 T+ L' R8 v( {Note: Quick patch for FCKEditor 2.6.8 File Upload Bypass:
6 C! L+ i4 |7 o+ k, AIn “config.asp”, wherever you have:
4 M' ^) S' j4 Y8 f) L, P' E      ConfigAllowedExtensions.Add    “File”,”Extensions Here”
Change it to:
      ConfigAllowedExtensions.Add    “File”,”^(Extensions Here)$”
8 T) j- e& h7 Z) S3 T6 N) i

" _( K  j) o) i# r, r) A


- D& o; L) o+ t+ W. hphp测试无效
asp/aspx测试成功：
来到/FCKeditor/editor/filemanager/connectors/test.html
# k  {6 f3 A8 Z' j8 `! @3 d3 _1 X6 X因为结合了之前二次上传的漏洞，所以先上传任意内容的文件：asd.asp.txt
- f& T! v$ X+ _8 e$ ]
burpsuite上传包并修改，repeater
4 o1 z$ G. g: q4 U0 r6 k; Y名字改为asd.asp%00txt    然后把%00专为URL编码上传后得到asd(1).asp
8 C" t+ c. O+ A$ x
) u7 l' Y. A! b2 f" ?8 N7 @如图，webshell为：http://localhost/userfiles/file/asd(1).asp

---

欢迎光临 中国网络渗透测试联盟 (https://cobjon.com/)

Powered by Discuz! X3.2