exploiut-db：
5 H0 i' g8 v+ I" }( c
; I% e D+ S- ^2 p" F4 KFCKEditor ASP Version 2.6.8 File Upload Protection Bypass% `! C+ n* V. u w3 N4 N6 I
# D2 Z3 \2 m5 ^8 J" e
- Title: FCKEditor 2.6.8 ASP Version File Upload Protection bypass
' O) {. o, x* Y* s# @: F: {5 m- Credit goes to: Mostafa Azizi, Soroush Dalili
8 Q- _$ W! K7 W' z1 E. N( m- Link:http://sourceforge.net/projects/fckeditor/files/FCKeditor/; X$ X4 J& _' @# Q. v
- Description:$ O9 J0 g. ~" A
There is no validation on the extensions when FCKEditor 2.6.8 ASP version is: |+ q! E7 I0 p- d; `
dealing with the duplicate files. As a result, it is possible to bypass
8 Y- D" }2 k! l. [! y+ Mthe protection and upload a file with any extension.
! A5 i; l( i. R3 X- Reference: http://soroush.secproject.com/blog/2012/11/file-in-the-hole/5 ^0 o( I' z# [3 o6 _
- Solution: Please check the provided reference or the vendor website.
" `4 _5 F0 ?5 E' F- PoC:http://www.youtube.com/v/1VpxlJ5 ... ;rel=0&vq=hd720
# ~, g# s. q( d& }5 B! r' U"% ~' k8 f2 E5 B. i
Note: Quick patch for FCKEditor 2.6.8 File Upload Bypass:" ?+ S2 Y& u& }" c; h# T5 b/ C
In “config.asp”, wherever you have:
4 j5 t0 \: |$ b8 j ConfigAllowedExtensions.Add “File”,”Extensions Here”% M; t" `! _$ U% K
Change it to:; W M2 q7 i" T) o8 T% ^% @
ConfigAllowedExtensions.Add “File”,”^(Extensions Here)$”9 X; @1 _- q: h/ C& ]- O) d+ ^
2 B+ B3 o) z9 v4 c
, j) T3 R4 L3 \8 g+ k
, s& a1 \* e _' s9 }( u 7 G9 t! K! D K0 V4 T$ T4 o
, q5 e# b d' o9 Iphp测试无效3 N' Q2 H" t. L) P: C) ?" {8 t, @
asp/aspx测试成功：
# Y# m5 h4 |) E* W; V( I来到/FCKeditor/editor/filemanager/connectors/test.html" b4 o2 f0 k4 ~
因为结合了之前二次上传的漏洞，所以先上传任意内容的文件：asd.asp.txt. r2 h) P* S1 I" e6 S% s
0 W0 ~' b* ~/ H9 T) ~
burpsuite上传包并修改，repeater9 M8 j% j i* e1 Y
名字改为asd.asp%00txt 然后把%00专为URL编码上传后得到asd(1).asp7 V6 f, @* M+ h+ a- h9 u! g
3 w+ P2 X! \9 q" O( K如图，webshell为：http://localhost/userfiles/file/asd(1).asp) a [( {% P( ?/ J; U' o
- C# a3 z, [/ D X3 z& F# }
|
发表于 2012-12-10 10:18:50
收藏
支持
反对