最新FCKEditor ASP上传绕过漏洞

admin

exploiut-db：
# |6 P7 ~4 ?9 F$ E2 K
FCKEditor ASP Version 2.6.8 File Upload Protection Bypass
- p8 P( L0 _4 Y+ b! f3 b6 Y: I
% g. {: J; t0 k! F! N6 }- Title: FCKEditor 2.6.8 ASP Version File Upload Protection bypass
  Y! I9 _1 ]% \( q, M- Credit goes to: Mostafa Azizi, Soroush Dalili
7 p6 @, x" u1 {9 B: w; e9 T4 T- Link:http://sourceforge.net/projects/fckeditor/files/FCKeditor/
; v# A' U9 i& c$ x- X4 v9 Y- m- Description:
There is no validation on the extensions when FCKEditor 2.6.8 ASP version is
dealing with the duplicate files. As a result, it is possible to bypass
" x7 ?; j8 s& _. Xthe protection and upload a file with any extension.
- Reference: http://soroush.secproject.com/blog/2012/11/file-in-the-hole/
- Solution: Please check the provided reference or the vendor website.
- PoC:http://www.youtube.com/v/1VpxlJ5 ... ;rel=0&vq=hd720
( G# b  Y$ a2 P' s& f% w1 x"
+ u4 R: {# y7 q7 o/ F' B- m# cNote: Quick patch for FCKEditor 2.6.8 File Upload Bypass:
' f" {1 D: G5 y4 T* ZIn “config.asp”, wherever you have:
      ConfigAllowedExtensions.Add    “File”,”Extensions Here”
Change it to:
! w! b+ r9 V8 o; X      ConfigAllowedExtensions.Add    “File”,”^(Extensions Here)$”


! W& R2 l' Y2 K$ r6 V) e) ?/ V" Q( p
( {0 [& e1 u$ L) r3 P: t

! g1 f$ o9 k/ \9 g! e+ q) O% Gphp测试无效
asp/aspx测试成功：
来到/FCKeditor/editor/filemanager/connectors/test.html
; F0 }: ?9 i) ?1 m8 R因为结合了之前二次上传的漏洞，所以先上传任意内容的文件：asd.asp.txt
7 r: G+ R8 `/ b: w/ Y6 |: u
+ s! T! j+ e- W+ ~$ {- h' Wburpsuite上传包并修改，repeater
名字改为asd.asp%00txt    然后把%00专为URL编码上传后得到asd(1).asp
1 [; O2 U8 f( L; W
3 l1 Y5 x! u3 X, ]1 n' ^# E如图，webshell为：http://localhost/userfiles/file/asd(1).asp