最新FCKEditor ASP上传绕过漏洞

admin

exploiut-db：

FCKEditor ASP Version 2.6.8 File Upload Protection Bypass
+ _8 q% e% l; p) o
- Title: FCKEditor 2.6.8 ASP Version File Upload Protection bypass
( @( P9 f9 {4 O: c- Y- Credit goes to: Mostafa Azizi, Soroush Dalili
4 l8 @1 G; p3 C9 M3 t9 N# R# s- Link:http://sourceforge.net/projects/fckeditor/files/FCKeditor/
- Description:
There is no validation on the extensions when FCKEditor 2.6.8 ASP version is
dealing with the duplicate files. As a result, it is possible to bypass
the protection and upload a file with any extension.
* v* f( \# [2 L, N6 Y- Reference: http://soroush.secproject.com/blog/2012/11/file-in-the-hole/
- Solution: Please check the provided reference or the vendor website.
- PoC:http://www.youtube.com/v/1VpxlJ5 ... ;rel=0&vq=hd720
"
( f# \' S0 [% Z6 z/ Y: O$ mNote: Quick patch for FCKEditor 2.6.8 File Upload Bypass:
In “config.asp”, wherever you have:
      ConfigAllowedExtensions.Add    “File”,”Extensions Here”
- @5 t/ C, }3 K1 ~, tChange it to:
8 z# S( t1 V1 y5 A' K* v      ConfigAllowedExtensions.Add    “File”,”^(Extensions Here)$”
. H" _/ \, E' K) C6 t) e
4 h4 G! X. j( X" z( A

* V5 F- \5 b* ]8 o1 f; i
1 x& a  v$ m6 G9 @% T; U
1 |+ _7 j" a' ?/ lphp测试无效
asp/aspx测试成功：
来到/FCKeditor/editor/filemanager/connectors/test.html
因为结合了之前二次上传的漏洞，所以先上传任意内容的文件：asd.asp.txt
# T5 q0 u$ h1 ]5 P) m
burpsuite上传包并修改，repeater
2 y4 E% r/ ]5 J% }3 t; V' [7 y名字改为asd.asp%00txt    然后把%00专为URL编码上传后得到asd(1).asp
! {% _* g. }1 z. B7 k0 r8 L
! Y8 ^( ^# u$ v6 m如图，webshell为：http://localhost/userfiles/file/asd(1).asp
6 z! C6 }0 m' i- ]8 S( m