exploiut-db：
* j5 O a& D; |
& G6 l# m9 _4 g9 j" H- {0 e) CFCKEditor ASP Version 2.6.8 File Upload Protection Bypass' o0 i% X2 ^2 Q/ f: z- x7 x
! {, C$ N# o* v* k) z
- Title: FCKEditor 2.6.8 ASP Version File Upload Protection bypass3 M# X) L2 a3 @- o/ l1 [
- Credit goes to: Mostafa Azizi, Soroush Dalili* g& m( x# y# @1 c; O M) g7 W
- Link:http://sourceforge.net/projects/fckeditor/files/FCKeditor/
* ^: v; P( Q$ ]0 J- Description:
$ b! G& c& H" c7 x$ K9 y' @There is no validation on the extensions when FCKEditor 2.6.8 ASP version is" q3 X/ ?, N K# k; w
dealing with the duplicate files. As a result, it is possible to bypass/ r8 ~6 m4 y; X" `' R6 z2 D
the protection and upload a file with any extension.
' ?4 j+ L; {/ l9 a- Reference: http://soroush.secproject.com/blog/2012/11/file-in-the-hole/
% N5 X; O7 C: d" R% O- Solution: Please check the provided reference or the vendor website.) v$ |5 b9 p/ i" @7 J0 P
- PoC:http://www.youtube.com/v/1VpxlJ5 ... ;rel=0&vq=hd720
. B- {/ W4 @/ |"
: |9 _) [( ~; R7 c- l7 d1 QNote: Quick patch for FCKEditor 2.6.8 File Upload Bypass:6 `5 Y" l m Y) y K% O1 \- t
In “config.asp”, wherever you have:. v/ P( D1 ?+ R& i" K1 L5 Y/ r
ConfigAllowedExtensions.Add “File”,”Extensions Here”+ d' L: f! M3 c) h ]2 N
Change it to:" q; m: S% L# l# b
ConfigAllowedExtensions.Add “File”,”^(Extensions Here)$”3 O! v4 z+ M9 C
7 b x& D; N4 j$ b6 s
9 g u4 x: v7 \2 V- Z
U" ^! b( {0 P! l; x
0 B( r: N, ^3 ~* e# q0 U
4 b# K% A3 N* w) N9 t" F% o' zphp测试无效8 `+ b* U; p2 R; r& [1 q
asp/aspx测试成功：
' F+ Q9 ]3 v" _8 p5 K$ w' O( Q来到/FCKeditor/editor/filemanager/connectors/test.html+ G% k1 w3 B" {
因为结合了之前二次上传的漏洞，所以先上传任意内容的文件：asd.asp.txt
. o' z( S# B$ a* Q
6 ~9 @) x! c& O) C" @1 c8 pburpsuite上传包并修改，repeater
! d$ a9 Z% C' y& R- j名字改为asd.asp%00txt 然后把%00专为URL编码上传后得到asd(1).asp
9 G: C8 Y2 c. U
5 i8 B9 b7 p9 W如图，webshell为：http://localhost/userfiles/file/asd(1).asp
( t3 U' c2 w& p9 H$ R; I6 [
- U4 {$ J0 B4 j: a |
发表于 2012-12-10 10:18:50
收藏
支持
反对