最新FCKEditor ASP上传绕过漏洞

admin

exploiut-db：

FCKEditor ASP Version 2.6.8 File Upload Protection Bypass
& U9 N5 U6 W. R& K9 V6 J1 E
- Title: FCKEditor 2.6.8 ASP Version File Upload Protection bypass
) y  F8 D3 x0 {7 u; j- Credit goes to: Mostafa Azizi, Soroush Dalili
' l: {' @% D, }6 n) w9 h* H- Link:http://sourceforge.net/projects/fckeditor/files/FCKeditor/
; d8 A  l  N: o; Y- Description:
! h9 o# r8 T  r5 {. j; U6 ^There is no validation on the extensions when FCKEditor 2.6.8 ASP version is
dealing with the duplicate files. As a result, it is possible to bypass
' Y: c- ^3 b, x+ |) Ethe protection and upload a file with any extension.
- Reference: http://soroush.secproject.com/blog/2012/11/file-in-the-hole/
- Solution: Please check the provided reference or the vendor website.
- PoC:http://www.youtube.com/v/1VpxlJ5 ... ;rel=0&vq=hd720
6 |: O' _+ Z7 a( R( _0 E8 H"
% |) r! q) i3 C# l) p8 w, |Note: Quick patch for FCKEditor 2.6.8 File Upload Bypass:
In “config.asp”, wherever you have:
      ConfigAllowedExtensions.Add    “File”,”Extensions Here”
) m# A5 J% [2 J, zChange it to:
* U" `, L6 ~4 ~1 C      ConfigAllowedExtensions.Add    “File”,”^(Extensions Here)$”

1 s: b+ @3 B2 V# @



php测试无效
asp/aspx测试成功：
# o; l* Q5 l% R0 A# h来到/FCKeditor/editor/filemanager/connectors/test.html
# q" ~- r! J' U; o3 i& R& f* f因为结合了之前二次上传的漏洞，所以先上传任意内容的文件：asd.asp.txt

0 [0 I! r+ H$ pburpsuite上传包并修改，repeater
名字改为asd.asp%00txt    然后把%00专为URL编码上传后得到asd(1).asp

如图，webshell为：http://localhost/userfiles/file/asd(1).asp
; D3 j8 N9 Q& _+ s) N) B
+ k4 r9 a: |9 a" O5 R) C6 U