中国网络渗透测试联盟

标题: 最新FCKEditor ASP上传绕过漏洞 [打印本页]

---

作者: admin    时间: 2012-12-10 10:18
标题: 最新FCKEditor ASP上传绕过漏洞
exploiut-db：

FCKEditor ASP Version 2.6.8 File Upload Protection Bypass

- Title: FCKEditor 2.6.8 ASP Version File Upload Protection bypass
, i- }5 O; z& q' f7 l  Y9 \1 L! a- Credit goes to: Mostafa Azizi, Soroush Dalili
- Link:http://sourceforge.net/projects/fckeditor/files/FCKeditor/
! p) }4 l1 e9 i- Description:
. p) T9 c( C/ n4 }There is no validation on the extensions when FCKEditor 2.6.8 ASP version is
dealing with the duplicate files. As a result, it is possible to bypass
/ a1 |1 p, e+ {5 ]! Wthe protection and upload a file with any extension.
- Reference: http://soroush.secproject.com/blog/2012/11/file-in-the-hole/
- Solution: Please check the provided reference or the vendor website.
0 B  K4 C, U' \" a) s: f  @- E( A- PoC:http://www.youtube.com/v/1VpxlJ5 ... ;rel=0&vq=hd720
"
/ F3 Z1 e$ {2 C, |4 p, p, ]Note: Quick patch for FCKEditor 2.6.8 File Upload Bypass:
In “config.asp”, wherever you have:
      ConfigAllowedExtensions.Add    “File”,”Extensions Here”
% R* _1 }0 n" ~Change it to:
      ConfigAllowedExtensions.Add    “File”,”^(Extensions Here)$”


) J5 s. U2 `! w) f. m! u


* Q! _, R- X0 S2 nphp测试无效
* i+ `  \+ G. E3 wasp/aspx测试成功：
来到/FCKeditor/editor/filemanager/connectors/test.html
7 E8 \8 Z) N8 {因为结合了之前二次上传的漏洞，所以先上传任意内容的文件：asd.asp.txt
2 Z2 B6 k: o7 Y0 r6 V
5 M: e. l2 B& R4 \5 `- Iburpsuite上传包并修改，repeater
名字改为asd.asp%00txt    然后把%00专为URL编码上传后得到asd(1).asp
  _  a8 S, H4 o8 u( H( g/ |
如图，webshell为：http://localhost/userfiles/file/asd(1).asp

. J2 `/ k0 d5 Z* ^' S4 |5 i  r

---

欢迎光临 中国网络渗透测试联盟 (https://www.cobjon.com/)

Powered by Discuz! X3.2