感谢生生不息在freebuf社区”分享团”里给出线索,才有了本文
9 P6 X* Q& ~; P- z
& E+ o% |8 }# s原帖:http://club.freebuf.com/?/question/129#reply12$ W5 y$ W2 d4 [* M4 D: Q# M3 }
/ k9 t, c+ s( R7 g
FCKEditor 2.6.8文件上传漏洞$ o4 t1 o6 M; n- }0 [
) v' `, ^. F# \9 ^
Exploit-db上原文如下:/ m+ N; Y8 ?; y, {$ K
' J( \2 C( y! n. F: l1 y- p- Title: FCKEditor 2.6.8 ASP Version File Upload Protection bypass
0 I2 w, l) V3 X6 W) L8 L4 _. r \# h- Credit goes to: Mostafa Azizi, Soroush Dalili7 z1 T! y) x0 C: J* O, q8 e
- Link:http://sourceforge.net/projects/fckeditor/files/FCKeditor/
* w- T9 l3 W# K0 ~* ]- Description:
( @: N: G; U. y% b( OThere is no validation on the extensions when FCKEditor 2.6.8 ASP version is) U/ H5 i# B$ Q% P. v
dealing with the duplicate files. As a result, it is possible to bypass6 w, q* z- O3 X8 w7 O' [; [
the protection and upload a file with any extension.! i3 J# `$ ~) f# V3 n8 h
- Reference: http://soroush.secproject.com/blog/2012/11/file-in-the-hole/1 f2 i* B* x" W/ W
- Solution: Please check the provided reference or the vendor website.
; q# Q: n; i3 ~/ L- h! J& P( ~( `, q$ t
- PoC:http://www.youtube.com/v/1VpxlJ5 ... ;rel=0&vq=hd720
( S+ Y' V! c, n& _- Y; M"
0 v ] E: h" B' ENote: Quick patch for FCKEditor 2.6.8 File Upload Bypass:6 y- h* p; ^; V% c3 C% I
0 q# i4 h" K) A5 g
In “config.asp”, wherever you have:& d2 Z' c& k/ x/ a& D* N% w
ConfigAllowedExtensions.Add “File”,”Extensions Here”
% M+ Q4 G; Y# u6 ?6 D! PChange it to:
9 K3 K% R; Z, x1 i/ e* f ConfigAllowedExtensions.Add “File”,”^(Extensions Here)$”在视频(需翻墙)里,我们可以看的很清楚:" _- C) X1 d8 `# `
" t( q7 q- ?* F1.首先,aspx是禁止上传的
* t& a+ ~, ^5 T% Q2.使用%00截断(url decode),第一次上传文件名会被转成_符号" s/ r, m8 j# q2 h6 r; ^
% y" {4 @6 d$ n5 W3 x) c5 S2 K3 a5 J
. Z4 k- B' o# S; J3 E) p: K) v% m% U5 u4 K0 {. J
接下来,我们进行第二次上传时,奇迹就发生了
. o8 u( i# N8 g% d7 @ X% @# `1 q& u+ w& E. x' a
' K5 A% Q8 W2 J S" f+ I' E) |5 B8 ?$ W
代码层面分析可以看下http://lanu.sinaapp.com/ASPVBvbscript/121.html5 ]$ S: v: d& Y3 g! z) [
1 o) }+ a- B5 G# k8 ?: ]' K3 s - M1 k) {1 U& p
5 E; v0 x- y0 a1 [; kCKFinder/FCKEditor DoS漏洞
$ c! ]. P! [1 ]% o8 ~& U& r# a
' N6 _3 Z' O' {4 h1 N( t相比上个上传bug,下面这个漏洞个人觉得更有意思5 I0 g$ ?* W* y2 S9 G Q
/ E. i) k8 o* V! R" e
# |' Q- O) E! w! ~
. I4 O& [8 Q' [6 _' ]% c2 MCKFinder是一个强大而易于使用的Web浏览器的Ajax文件管理器。 其简单的界面使得它直观,快速学习的各类用户,从高级人才到互联网初学者。 + n7 c8 ?$ U% Y: a# o0 @. }1 H
) u# e" m$ e+ e
CKFinder ASP版本是这样处理上传文件的:
, X! _- K' n5 Y; k9 o1 D" Z
! h5 u9 c8 v3 A( c; t1 a( o当上传文件名已存在时,会进行迭代重命名,比如file(1).ext存在了,会尝试重命名为file(2).ext……直到不重复为止。$ o- d: v$ \: s- ~$ w
2 Z8 p& K* [, n* W- S3 n那么现在有趣的事情来了——windows是禁止”con”作为文件名的(关于这个问题我印象中很久以前,win也有过con文件名漏洞,有兴趣可以确认下)
5 L A4 Y9 M6 S; u
! D1 _% |3 K* E6 K9 hdos方法也应运而生!
5 d( \; W$ c. Z; }
9 `1 y8 p/ i3 R( { |6 O + Z: ?- @+ f- B# y) C1 W2 S* Y, q6 {+ ~
) x+ r$ O4 i4 q' j3 A( S5 L1.上传Con.pdf.txt* w" Z5 p" ~5 }) O7 F* p. w2 y
2.CKFinder认为“Con.pdf.txt” 已被占用,于是开始尝试Con.pdf(1).txt,Con.pdf(2).txt……Con.pdf(MaxInt).txt从而对服务器形成致命dos。
8 O8 w" t. r' H: A, t, y
, j5 m# V0 H4 I8 m |