最新FCKEditor ASP上传绕过漏洞

admin

exploiut-db：

) g3 m& v. B3 |$ JFCKEditor ASP Version 2.6.8 File Upload Protection Bypass
, _" r) h( Y* L& x2 |
3 _4 [  ]0 ^6 z6 Z; e/ M- H- Title: FCKEditor 2.6.8 ASP Version File Upload Protection bypass
1 k6 i4 x" F+ A; z* `2 i# V- Credit goes to: Mostafa Azizi, Soroush Dalili
- Link:http://sourceforge.net/projects/fckeditor/files/FCKeditor/
- Description:
There is no validation on the extensions when FCKEditor 2.6.8 ASP version is
dealing with the duplicate files. As a result, it is possible to bypass
the protection and upload a file with any extension.
- Reference: http://soroush.secproject.com/blog/2012/11/file-in-the-hole/
, t3 W( p" i7 Z. ^! R! J3 l- Solution: Please check the provided reference or the vendor website.
* t, \3 ~) E; ]" X! n- PoC:http://www.youtube.com/v/1VpxlJ5 ... ;rel=0&vq=hd720
8 \2 O) J' h' ]( W, N" _' t"
" {; R& R- }. }/ W" vNote: Quick patch for FCKEditor 2.6.8 File Upload Bypass:
In “config.asp”, wherever you have:
: ^' h2 J* t. h2 q3 O      ConfigAllowedExtensions.Add    “File”,”Extensions Here”
" f# N: y' V9 kChange it to:
; ]/ \$ |# P: l+ r      ConfigAllowedExtensions.Add    “File”,”^(Extensions Here)$”
* a6 ?3 C; b2 `8 k


: s& k- c* p/ _4 f2 k

php测试无效
2 o7 x# g  I' l. e$ Rasp/aspx测试成功：
来到/FCKeditor/editor/filemanager/connectors/test.html
因为结合了之前二次上传的漏洞，所以先上传任意内容的文件：asd.asp.txt

+ X5 U  ?+ W* Q8 x$ t) tburpsuite上传包并修改，repeater
/ ^; L: [4 c' n名字改为asd.asp%00txt    然后把%00专为URL编码上传后得到asd(1).asp

如图，webshell为：http://localhost/userfiles/file/asd(1).asp
1 x  H: a* M+ c; j8 @