最新FCKEditor ASP上传绕过漏洞

admin

exploiut-db：
6 x& f6 J8 B% j! N6 C- e
# W, J/ O. Q' o$ o2 jFCKEditor ASP Version 2.6.8 File Upload Protection Bypass

- Title: FCKEditor 2.6.8 ASP Version File Upload Protection bypass
- Credit goes to: Mostafa Azizi, Soroush Dalili
; [! z* ^2 [' H- Link:http://sourceforge.net/projects/fckeditor/files/FCKeditor/
- Description:
There is no validation on the extensions when FCKEditor 2.6.8 ASP version is
; x# j0 f! u: N! W* `dealing with the duplicate files. As a result, it is possible to bypass
) g7 [4 L& ^4 |7 B) p  o) Cthe protection and upload a file with any extension.
( A* e7 \* q  d/ w2 H7 t) b& K- Reference: http://soroush.secproject.com/blog/2012/11/file-in-the-hole/
$ N8 Z1 @: `1 `3 X8 F  N7 z- Solution: Please check the provided reference or the vendor website.
- PoC:http://www.youtube.com/v/1VpxlJ5 ... ;rel=0&vq=hd720
6 T" H0 }, t* ^% t( v- f; R; h"
Note: Quick patch for FCKEditor 2.6.8 File Upload Bypass:
In “config.asp”, wherever you have:
6 U; `  A3 Y8 p* S0 T! `) S      ConfigAllowedExtensions.Add    “File”,”Extensions Here”
( }/ d. U; ~0 Z8 z8 \, FChange it to:
; r7 c. q/ k" h9 V0 M      ConfigAllowedExtensions.Add    “File”,”^(Extensions Here)$”
- E3 ^3 B  r$ b+ ?( R. _4 E


# {. j4 C' |2 y) A
. P* l: [9 _* i$ s, H; N
php测试无效
7 N: S# U4 M) B5 }asp/aspx测试成功：
来到/FCKeditor/editor/filemanager/connectors/test.html
因为结合了之前二次上传的漏洞，所以先上传任意内容的文件：asd.asp.txt
6 H$ Y# Q' h" Q/ N
burpsuite上传包并修改，repeater
名字改为asd.asp%00txt    然后把%00专为URL编码上传后得到asd(1).asp
+ z# X) L8 y4 |2 z' A8 f
如图，webshell为：http://localhost/userfiles/file/asd(1).asp

8 ~+ J0 s8 P! ~/ D% \- C