最新FCKEditor ASP上传绕过漏洞

admin

exploiut-db：

, ?- z) K3 y, W7 i) {FCKEditor ASP Version 2.6.8 File Upload Protection Bypass

* P5 C8 A2 _4 e* D- Title: FCKEditor 2.6.8 ASP Version File Upload Protection bypass
4 M7 n2 n: N$ b- Credit goes to: Mostafa Azizi, Soroush Dalili
$ U. q4 v( R; t5 D0 q/ Z2 h2 I% k- Link:http://sourceforge.net/projects/fckeditor/files/FCKeditor/
- Description:
There is no validation on the extensions when FCKEditor 2.6.8 ASP version is
1 x( |# V2 ~- z' g, n! h6 idealing with the duplicate files. As a result, it is possible to bypass
; z) K# A1 d* {" k! p6 Zthe protection and upload a file with any extension.
$ L2 b/ o" d+ r$ S: K0 T- Reference: http://soroush.secproject.com/blog/2012/11/file-in-the-hole/
( m* j, v$ Z7 ]* w- Solution: Please check the provided reference or the vendor website.
- e2 w2 y( [  w  S! {2 a$ o- PoC:http://www.youtube.com/v/1VpxlJ5 ... ;rel=0&vq=hd720
6 {+ m2 N8 w$ {! x( e"
Note: Quick patch for FCKEditor 2.6.8 File Upload Bypass:
In “config.asp”, wherever you have:
; M- ^- Y& Q1 j4 L! d, c5 B% U      ConfigAllowedExtensions.Add    “File”,”Extensions Here”
% n9 l% v# p% t( RChange it to:
9 m+ b3 Y: ?9 B! w      ConfigAllowedExtensions.Add    “File”,”^(Extensions Here)$”

8 i7 u7 h( \# y1 O


3 e: f. ~/ c  v" G- u1 f
php测试无效
/ R) E) n8 C1 _* c1 `* easp/aspx测试成功：
来到/FCKeditor/editor/filemanager/connectors/test.html
" e+ M- k. M: ^& g1 x% q因为结合了之前二次上传的漏洞，所以先上传任意内容的文件：asd.asp.txt
" y* q8 r7 O9 T3 R& B, C
burpsuite上传包并修改，repeater
$ t' a0 h3 M" G/ B' e名字改为asd.asp%00txt    然后把%00专为URL编码上传后得到asd(1).asp

0 A7 |' I9 J: d0 H% K! q如图，webshell为：http://localhost/userfiles/file/asd(1).asp