最新FCKEditor ASP上传绕过漏洞

admin

exploiut-db：

) S7 {) v' q+ @* C# RFCKEditor ASP Version 2.6.8 File Upload Protection Bypass
; A& @% o, b2 }, I
- Title: FCKEditor 2.6.8 ASP Version File Upload Protection bypass
- Credit goes to: Mostafa Azizi, Soroush Dalili
# P! H* i# }" r' A% l, n# ]6 A- Link:http://sourceforge.net/projects/fckeditor/files/FCKeditor/
- Description:
There is no validation on the extensions when FCKEditor 2.6.8 ASP version is
; n9 j1 X% N% D5 Udealing with the duplicate files. As a result, it is possible to bypass
! o3 n) V& \3 U7 X* V. Q1 Nthe protection and upload a file with any extension.
- Reference: http://soroush.secproject.com/blog/2012/11/file-in-the-hole/
- Solution: Please check the provided reference or the vendor website.
- PoC:http://www.youtube.com/v/1VpxlJ5 ... ;rel=0&vq=hd720
2 H$ A' n1 q+ k"
Note: Quick patch for FCKEditor 2.6.8 File Upload Bypass:
& y/ p5 ]) a$ p5 ?$ W. ZIn “config.asp”, wherever you have:
      ConfigAllowedExtensions.Add    “File”,”Extensions Here”
% \0 T/ \# s# ~& ]+ p  VChange it to:
, o3 O. z# ?) X' q      ConfigAllowedExtensions.Add    “File”,”^(Extensions Here)$”
; M. j$ P* ^5 G( K% h
% ^, n3 k9 Y. q) d  g5 k

, O& l( U8 S$ A! V
- d1 o4 e0 J  }. B3 l" |. `
php测试无效
asp/aspx测试成功：
7 `  T5 N7 b2 H, d: A! \来到/FCKeditor/editor/filemanager/connectors/test.html
' l/ U/ g, |' H* E6 N  c因为结合了之前二次上传的漏洞，所以先上传任意内容的文件：asd.asp.txt
6 a' p* S: }" F; ^7 {& ~$ t* G+ K
( r* s2 ?: K0 x+ @+ b. Mburpsuite上传包并修改，repeater
名字改为asd.asp%00txt    然后把%00专为URL编码上传后得到asd(1).asp

如图，webshell为：http://localhost/userfiles/file/asd(1).asp

1 G$ P% z+ @1 y+ h* M& H8 F