最新FCKEditor ASP上传绕过漏洞

admin

exploiut-db：

FCKEditor ASP Version 2.6.8 File Upload Protection Bypass
1 H: E7 r* [  O) w7 u$ f
- Title: FCKEditor 2.6.8 ASP Version File Upload Protection bypass
* {6 H  B8 q% b+ n( g2 A/ g$ M3 @/ R  Y- Credit goes to: Mostafa Azizi, Soroush Dalili
. {  T: q* U4 {* n  M: L- Link:http://sourceforge.net/projects/fckeditor/files/FCKeditor/
( W% r- Q# A3 h. [) Z* u" g- Description:
There is no validation on the extensions when FCKEditor 2.6.8 ASP version is
0 [; w5 r. A, a8 ~, L# W: c+ Sdealing with the duplicate files. As a result, it is possible to bypass
the protection and upload a file with any extension.
- Reference: http://soroush.secproject.com/blog/2012/11/file-in-the-hole/
- Solution: Please check the provided reference or the vendor website.
" O5 `* N4 J) {4 |& h3 [$ L- PoC:http://www.youtube.com/v/1VpxlJ5 ... ;rel=0&vq=hd720
"
0 j# l1 Q  t- A) a8 I* Z3 E; yNote: Quick patch for FCKEditor 2.6.8 File Upload Bypass:
In “config.asp”, wherever you have:
8 I% ?0 n: `/ i8 O( s9 X: y/ l      ConfigAllowedExtensions.Add    “File”,”Extensions Here”
Change it to:
- t1 _" _8 A9 l8 X      ConfigAllowedExtensions.Add    “File”,”^(Extensions Here)$”
6 E+ R  M9 |( a' c1 ?( x$ ]
- g; L4 f( A3 i/ |# c; ?

7 D* p  R1 }7 u$ \5 G/ t1 z
8 d1 v- z- R5 C4 ?: z+ C* l
+ X  c6 ~6 w, ophp测试无效
asp/aspx测试成功：
7 t- L' C# L. f' K8 Z$ L! [0 h来到/FCKeditor/editor/filemanager/connectors/test.html
因为结合了之前二次上传的漏洞，所以先上传任意内容的文件：asd.asp.txt
, j3 ?' [5 w: G7 C; ?* N3 w3 q
burpsuite上传包并修改，repeater
# r8 p4 E# _  p! A- J, F) z6 C5 V) {- ^名字改为asd.asp%00txt    然后把%00专为URL编码上传后得到asd(1).asp
  @* h4 L3 P5 H( u# r  V0 O/ J. K
如图，webshell为：http://localhost/userfiles/file/asd(1).asp