最新FCKEditor ASP上传绕过漏洞

admin

exploiut-db：
' n; ~$ Q- p) N$ A5 y9 e
" T* K1 d" h2 K6 N* F; TFCKEditor ASP Version 2.6.8 File Upload Protection Bypass

- Title: FCKEditor 2.6.8 ASP Version File Upload Protection bypass
! c' a# y# k0 q! Y2 E# f- u, |) c- Credit goes to: Mostafa Azizi, Soroush Dalili
- Link:http://sourceforge.net/projects/fckeditor/files/FCKeditor/
8 a  G- u% T& d/ [+ l4 N9 s' L- Description:
There is no validation on the extensions when FCKEditor 2.6.8 ASP version is
- B5 o' r2 W1 n( J2 E2 |$ F/ S/ Odealing with the duplicate files. As a result, it is possible to bypass
: G7 W# N; g7 V) `7 x1 G4 }the protection and upload a file with any extension.
- Reference: http://soroush.secproject.com/blog/2012/11/file-in-the-hole/
  l% ?/ U8 w/ u+ ^- Solution: Please check the provided reference or the vendor website.
0 Z. {( G) U. w& \- PoC:http://www.youtube.com/v/1VpxlJ5 ... ;rel=0&vq=hd720
- d- E3 \7 K, I' `. K- n; ["
3 U# H% g  l: K7 n7 u, z, k- VNote: Quick patch for FCKEditor 2.6.8 File Upload Bypass:
In “config.asp”, wherever you have:
7 L. H6 j5 Q( F  z% S      ConfigAllowedExtensions.Add    “File”,”Extensions Here”
% ?! P6 h- c. _Change it to:
7 s2 @5 F" P7 ]$ @6 T; ]( C7 t      ConfigAllowedExtensions.Add    “File”,”^(Extensions Here)$”

. `. P6 w% Z2 N  W. s

$ g4 L% Z4 W" `+ H# R: K

php测试无效
asp/aspx测试成功：
来到/FCKeditor/editor/filemanager/connectors/test.html
因为结合了之前二次上传的漏洞，所以先上传任意内容的文件：asd.asp.txt

% O+ |. Q8 ^  ~$ X+ G1 G5 l% N/ fburpsuite上传包并修改，repeater
名字改为asd.asp%00txt    然后把%00专为URL编码上传后得到asd(1).asp
% G/ w4 t3 b% d0 O" @
% ^' C7 S3 Q. ~9 _如图，webshell为：http://localhost/userfiles/file/asd(1).asp
2 g/ P7 f4 {9 o! C' B% w2 v* a% x