最新FCKEditor ASP上传绕过漏洞

admin

exploiut-db：

FCKEditor ASP Version 2.6.8 File Upload Protection Bypass

- Title: FCKEditor 2.6.8 ASP Version File Upload Protection bypass
' j7 N6 [* q5 ]5 U9 h) t3 ^- Credit goes to: Mostafa Azizi, Soroush Dalili
7 L. \  h# \5 m, O- Link:http://sourceforge.net/projects/fckeditor/files/FCKeditor/
1 ]4 {- m- ^$ e! C4 R5 Z, I$ [3 T- Description:
2 M# @6 z% ?  x9 D7 O1 YThere is no validation on the extensions when FCKEditor 2.6.8 ASP version is
dealing with the duplicate files. As a result, it is possible to bypass
the protection and upload a file with any extension.
- Reference: http://soroush.secproject.com/blog/2012/11/file-in-the-hole/
- Solution: Please check the provided reference or the vendor website.
$ I* F* Q$ @! p! p- PoC:http://www.youtube.com/v/1VpxlJ5 ... ;rel=0&vq=hd720
4 l$ i% f' y& a; k8 y7 m"
. N" U& r6 G0 J) |9 mNote: Quick patch for FCKEditor 2.6.8 File Upload Bypass:
In “config.asp”, wherever you have:
3 W( g3 b, V9 V) Y7 s1 [' L      ConfigAllowedExtensions.Add    “File”,”Extensions Here”
Change it to:
. u- s* M7 L) Y; C3 y3 [      ConfigAllowedExtensions.Add    “File”,”^(Extensions Here)$”

' ]" C! c# I; B& X
9 V- c  h  s" B" b
% v) H4 Y  B' g% e
) c. i/ G2 S& Y& r
php测试无效
asp/aspx测试成功：
来到/FCKeditor/editor/filemanager/connectors/test.html
因为结合了之前二次上传的漏洞，所以先上传任意内容的文件：asd.asp.txt

! ]3 t  c. w" R3 E7 xburpsuite上传包并修改，repeater
名字改为asd.asp%00txt    然后把%00专为URL编码上传后得到asd(1).asp

& i8 p) O& @! }# O: v3 \' P如图，webshell为：http://localhost/userfiles/file/asd(1).asp
) j: ?2 c: p3 ~, m, E