最新FCKEditor ASP上传绕过漏洞

admin

exploiut-db：

FCKEditor ASP Version 2.6.8 File Upload Protection Bypass
  M" R# J4 f+ ~- b+ A
; H; }+ A$ x2 ?: c  @6 l$ k- Title: FCKEditor 2.6.8 ASP Version File Upload Protection bypass
9 d: v# u0 x* b: E2 e! D  E- Credit goes to: Mostafa Azizi, Soroush Dalili
- Link:http://sourceforge.net/projects/fckeditor/files/FCKeditor/
, Q8 G; I  V4 c) K) ]- Description:
  N2 t- v6 q0 p5 d% C1 A! Z2 dThere is no validation on the extensions when FCKEditor 2.6.8 ASP version is
* Y0 O. B6 ^# j7 D  q/ hdealing with the duplicate files. As a result, it is possible to bypass
; k# U: z, X4 }( M2 e2 ethe protection and upload a file with any extension.
/ f5 }2 n" ^3 m. S/ t- Reference: http://soroush.secproject.com/blog/2012/11/file-in-the-hole/
- Solution: Please check the provided reference or the vendor website.
' E; k- [6 B* p# r( V( ?3 k0 m  |- PoC:http://www.youtube.com/v/1VpxlJ5 ... ;rel=0&vq=hd720
"
Note: Quick patch for FCKEditor 2.6.8 File Upload Bypass:
2 W$ y# S4 d0 S3 I9 i0 W4 M% PIn “config.asp”, wherever you have:
1 M0 h8 }5 Q' ~7 ]1 o; u6 S  J3 o      ConfigAllowedExtensions.Add    “File”,”Extensions Here”
8 V/ z: a, a3 }Change it to:
2 B7 f2 w# E8 m) F      ConfigAllowedExtensions.Add    “File”,”^(Extensions Here)$”
$ p; R8 }4 {! [, z. \4 J5 g' x3 A
7 w# B; t# I# ]) k" K
0 L$ {% Y6 b8 A, P! A

/ i+ o# y1 i: Z) E6 U4 b& d
php测试无效
  ~+ H; H' }- E9 v2 Zasp/aspx测试成功：
6 ?' g( B# s, x' m$ m来到/FCKeditor/editor/filemanager/connectors/test.html
/ d0 o+ F/ ~9 z$ ]4 E因为结合了之前二次上传的漏洞，所以先上传任意内容的文件：asd.asp.txt

, S0 I) x1 h6 H# X0 l- _burpsuite上传包并修改，repeater
* G- L' V8 R1 F- _- j) I0 S8 U名字改为asd.asp%00txt    然后把%00专为URL编码上传后得到asd(1).asp
" V- z8 F! P- J7 ^: R- O
9 F. M' E) O/ F7 w. O. P如图，webshell为：http://localhost/userfiles/file/asd(1).asp
  k: I8 \: Y) m8 d! M6 F5 U( m
6 ?* u: w! `8 D' ?