exploiut-db：1 c2 K, ^, N1 R6 u6 Q$ n/ ]7 a
, D" @& T& q+ K7 a% CFCKEditor ASP Version 2.6.8 File Upload Protection Bypass0 C9 V( U) z7 z+ x$ Z
K5 ^/ j1 ^- O: _
- Title: FCKEditor 2.6.8 ASP Version File Upload Protection bypass, c& e8 p; j3 y# {: Z. q. x* H
- Credit goes to: Mostafa Azizi, Soroush Dalili$ ?% t- I2 q( ~
- Link:http://sourceforge.net/projects/fckeditor/files/FCKeditor/& r* N7 r, p9 M4 M# r9 E! }
- Description:* E8 K+ F c. Z* z6 u* G
There is no validation on the extensions when FCKEditor 2.6.8 ASP version is: Q1 g4 r- y2 Q% b; t
dealing with the duplicate files. As a result, it is possible to bypass
4 L6 l1 r" n- ~. b5 xthe protection and upload a file with any extension.) M' \+ k j1 W$ I/ }
- Reference: http://soroush.secproject.com/blog/2012/11/file-in-the-hole/
6 Q0 ~0 N5 K. Z$ G! }- Solution: Please check the provided reference or the vendor website.
8 f7 x* a, l; P; R5 Z- PoC:http://www.youtube.com/v/1VpxlJ5 ... ;rel=0&vq=hd720
7 A& @, F; u1 _1 j5 j u. n' s"* T9 s% o! k3 m( f$ V: t/ r
Note: Quick patch for FCKEditor 2.6.8 File Upload Bypass:
4 b1 _* U5 Q, |In “config.asp”, wherever you have: \1 W9 d- ?% R; W/ z( L
ConfigAllowedExtensions.Add “File”,”Extensions Here”
* }% d5 `: ]0 s0 q. D$ Q' F. N D7 T1 CChange it to:
# _$ B5 u# C2 w& s- D9 k* L ConfigAllowedExtensions.Add “File”,”^(Extensions Here)$”. q9 L1 s- A; T# M" K
% w( |2 z. c9 C' J$ ]2 C
% B+ t! Z3 `) }1 _
# q+ P" `& C# \8 B6 c" V/ \
7 F X5 Y/ b$ k2 P: R( v$ E$ G. n1 p& U" z0 T
php测试无效/ {/ J% K2 z" ]' d) }
asp/aspx测试成功：5 K( n Y0 u1 L3 H/ @
来到/FCKeditor/editor/filemanager/connectors/test.html) O0 `7 t l x7 i
因为结合了之前二次上传的漏洞，所以先上传任意内容的文件：asd.asp.txt2 `' c% ?& d. p2 A2 I. y0 x
3 w7 Y ~$ U& D f( m4 i2 f( Lburpsuite上传包并修改，repeater5 Y6 }% c0 o; y$ r8 g# m! b
名字改为asd.asp%00txt 然后把%00专为URL编码上传后得到asd(1).asp
8 u- _8 ?- E4 K. | ~ K9 u
* ?# }7 u+ q, K如图，webshell为：http://localhost/userfiles/file/asd(1).asp
3 W# ?; `* C; b2 N3 V* s/ W* W2 h b' O: H/ |$ |) W
|
发表于 2012-12-10 10:18:50
收藏
支持
反对