exploiut-db：
8 R' m( M/ X# u( A @) R3 i* D$ c* Y; R- `7 D# i
FCKEditor ASP Version 2.6.8 File Upload Protection Bypass
8 K( o" }* Z$ L6 D, P6 T3 a7 M z7 \. x+ y! M6 T4 N1 p
- Title: FCKEditor 2.6.8 ASP Version File Upload Protection bypass
* [. b3 k9 u9 B8 L- Credit goes to: Mostafa Azizi, Soroush Dalili' M* V3 K/ ^ G/ s
- Link:http://sourceforge.net/projects/fckeditor/files/FCKeditor/5 z, S; F U) Y- U' _, u
- Description:) h, |5 J/ G/ z" n" m
There is no validation on the extensions when FCKEditor 2.6.8 ASP version is0 }% e$ V, D! `9 }* ~
dealing with the duplicate files. As a result, it is possible to bypass
. i9 z. z& L$ cthe protection and upload a file with any extension.' d8 f- C4 l' a6 ~* A
- Reference: http://soroush.secproject.com/blog/2012/11/file-in-the-hole/
' p( _" X% Z: \- Solution: Please check the provided reference or the vendor website.
# B1 o2 Z( _& c; I$ Y: h5 J: N/ Q- PoC:http://www.youtube.com/v/1VpxlJ5 ... ;rel=0&vq=hd720# b- b8 d6 X6 Z( x* g# a% q/ I
"
6 s* d; l% `' y3 q9 zNote: Quick patch for FCKEditor 2.6.8 File Upload Bypass:
% s/ ^5 K: a \, E! E5 E1 uIn “config.asp”, wherever you have:
$ ^- B( n0 f* N' I5 F$ a p1 c ConfigAllowedExtensions.Add “File”,”Extensions Here”- A3 A9 l9 v2 z2 q0 q0 C" q
Change it to:
: a/ T) L- [8 \ ConfigAllowedExtensions.Add “File”,”^(Extensions Here)$”
! @7 @) E& X$ }% H$ N) l& _" A8 A8 B' R
" Z2 C1 h: \6 E" L9 e7 U
' i2 H+ _' v8 |- U4 }9 D
4 I0 T5 d4 m _5 I! M1 k! U, N; I8 @6 X3 M
php测试无效
, r1 q; R, `- M/ i9 [$ `; gasp/aspx测试成功：
. H! u5 s; P! ~, W' c来到/FCKeditor/editor/filemanager/connectors/test.html
* Y j* I+ a# |, f5 V因为结合了之前二次上传的漏洞，所以先上传任意内容的文件：asd.asp.txt
. V1 q; ?. j* F8 X5 C1 a, c! s! ?: o4 ]
burpsuite上传包并修改，repeater
S4 G* {0 [) [& p2 m V名字改为asd.asp%00txt 然后把%00专为URL编码上传后得到asd(1).asp
. @ Z' n/ v7 }! T4 Z& ^, A: n1 c, z0 N3 }
如图，webshell为：http://localhost/userfiles/file/asd(1).asp
) M% U3 p) x6 u* k) b1 K" J) u; R6 N
|
发表于 2012-12-10 10:18:50
收藏
支持
反对