exploiut-db：$ R( A$ _- F2 g8 N$ o3 z
# t5 |; f+ r P; D& M
FCKEditor ASP Version 2.6.8 File Upload Protection Bypass) J' Q+ a/ c, K) u H
$ Q; T! }" ^. R9 M
- Title: FCKEditor 2.6.8 ASP Version File Upload Protection bypass4 V4 i3 S: l' U6 }' }( K
- Credit goes to: Mostafa Azizi, Soroush Dalili
/ Y' h4 ^( z% [& g) U, r- Link:http://sourceforge.net/projects/fckeditor/files/FCKeditor/# c* w& P! X8 E& S
- Description:
; F1 p2 k- S" Y& E& c! eThere is no validation on the extensions when FCKEditor 2.6.8 ASP version is8 P. X1 R; H T) O
dealing with the duplicate files. As a result, it is possible to bypass0 l8 `$ @$ k3 K# \
the protection and upload a file with any extension.% W( ~" r4 s/ D& Z6 }8 G- f; a F
- Reference: http://soroush.secproject.com/blog/2012/11/file-in-the-hole/
2 o" i( @, I2 S: j+ T- Solution: Please check the provided reference or the vendor website.
5 [0 e$ g- n. Q5 s* D& X: K5 P- PoC:http://www.youtube.com/v/1VpxlJ5 ... ;rel=0&vq=hd720
* V4 r" X6 s1 Q"
1 {: q% Q* Q: {) S3 y3 r/ eNote: Quick patch for FCKEditor 2.6.8 File Upload Bypass:
/ S9 i8 g. j' T& g pIn “config.asp”, wherever you have:
! p( J/ x$ o/ D7 Z( m ConfigAllowedExtensions.Add “File”,”Extensions Here”+ j+ w" D1 W+ y, L8 d
Change it to:
C& B4 g4 y: E$ w: ~# i6 \ ConfigAllowedExtensions.Add “File”,”^(Extensions Here)$”
# y( u9 l- f7 s6 O7 B% E6 `2 @1 j" h) T9 w: T1 e( h' p
4 H. m2 C5 F* f* {3 W8 ]
! e( C+ M4 U$ T) N* t # f' l# s; \- }* G! u1 }
8 r$ J# B8 H+ k9 ]php测试无效
5 }/ z, W3 R$ K$ h* iasp/aspx测试成功：; Q( s* n* l/ g) ?
来到/FCKeditor/editor/filemanager/connectors/test.html* F" s# F C4 ~
因为结合了之前二次上传的漏洞，所以先上传任意内容的文件：asd.asp.txt
* P) c7 D9 v4 r5 q6 W: Y/ o& L/ @5 H- y5 \
burpsuite上传包并修改，repeater% d# u9 N4 c5 m' H# V
名字改为asd.asp%00txt 然后把%00专为URL编码上传后得到asd(1).asp# Y$ S0 I9 v5 T" }
) d/ {0 q6 y- R a- j
如图，webshell为：http://localhost/userfiles/file/asd(1).asp
: i9 G* o9 A& F, p8 k3 L# r
+ L1 Y7 _, `! N1 h6 S v |
发表于 2012-12-10 10:18:50
收藏
支持
反对