最新FCKEditor ASP上传绕过漏洞

admin

exploiut-db：
* B) U, s- n1 \9 e
2 M- N1 K3 m5 [2 j; s4 tFCKEditor ASP Version 2.6.8 File Upload Protection Bypass

! e" q& F' {' r/ b8 x- Title: FCKEditor 2.6.8 ASP Version File Upload Protection bypass
5 e( @# R: B5 Q2 p/ K- Credit goes to: Mostafa Azizi, Soroush Dalili
  g0 p8 ~; H" o3 ]" q- Link:http://sourceforge.net/projects/fckeditor/files/FCKeditor/
- Description:
$ c; E3 R# I0 A' V' a0 a+ E5 d. YThere is no validation on the extensions when FCKEditor 2.6.8 ASP version is
dealing with the duplicate files. As a result, it is possible to bypass
the protection and upload a file with any extension.
8 c& W- Y3 g5 C: E0 \% m! \, z- Reference: http://soroush.secproject.com/blog/2012/11/file-in-the-hole/
- Solution: Please check the provided reference or the vendor website.
# j* h% b3 i6 H& t- q, y- PoC:http://www.youtube.com/v/1VpxlJ5 ... ;rel=0&vq=hd720
3 q4 ~$ M6 ]' R1 B5 Z"
0 O+ A( z, L4 q0 J: R: ]9 qNote: Quick patch for FCKEditor 2.6.8 File Upload Bypass:
7 R$ E' e& G1 I' L8 Y4 YIn “config.asp”, wherever you have:
      ConfigAllowedExtensions.Add    “File”,”Extensions Here”
Change it to:
      ConfigAllowedExtensions.Add    “File”,”^(Extensions Here)$”

: W  D7 W. r! v
! d  I  x( ?7 ]: B8 |: {
* m2 D7 q. _) r5 C: }* k

php测试无效
$ J1 ]; O  G( \  Q1 masp/aspx测试成功：
* J- ?7 i& q" w5 j! u来到/FCKeditor/editor/filemanager/connectors/test.html
, U& Q1 r0 ?/ v' K9 t因为结合了之前二次上传的漏洞，所以先上传任意内容的文件：asd.asp.txt
( n0 G( V- W) i2 C# H
1 T2 C7 Z' e+ V+ {% a! ~burpsuite上传包并修改，repeater
名字改为asd.asp%00txt    然后把%00专为URL编码上传后得到asd(1).asp
& ^5 C* R; f# I( y& J/ W
$ i: A: {' P% Z7 J$ b如图，webshell为：http://localhost/userfiles/file/asd(1).asp

4 M5 b2 w% W3 t+ d. F