中国网络渗透测试联盟

标题: 最新FCKEditor ASP上传绕过漏洞 [打印本页]

---

作者: admin    时间: 2012-12-10 10:18
标题: 最新FCKEditor ASP上传绕过漏洞
exploiut-db：
# q: r; T2 ~& {! {; b
" @. E7 x; }2 a' u2 tFCKEditor ASP Version 2.6.8 File Upload Protection Bypass

- Title: FCKEditor 2.6.8 ASP Version File Upload Protection bypass
; e( {- k( u- ?9 a9 o- ^# L- Credit goes to: Mostafa Azizi, Soroush Dalili
( N4 Q' t  G& j6 N- Link:http://sourceforge.net/projects/fckeditor/files/FCKeditor/
' Z4 r" H6 y7 p- Description:
- e* K, j# ?) ^; n1 XThere is no validation on the extensions when FCKEditor 2.6.8 ASP version is
dealing with the duplicate files. As a result, it is possible to bypass
0 f& T9 C8 S: hthe protection and upload a file with any extension.
, Q: B9 e! ~% `! _  ]& |! P* ?; n- Reference: http://soroush.secproject.com/blog/2012/11/file-in-the-hole/
- Solution: Please check the provided reference or the vendor website.
- PoC:http://www.youtube.com/v/1VpxlJ5 ... ;rel=0&vq=hd720
  K6 x# N' u. b, v" m"
Note: Quick patch for FCKEditor 2.6.8 File Upload Bypass:
In “config.asp”, wherever you have:
      ConfigAllowedExtensions.Add    “File”,”Extensions Here”
Change it to:
      ConfigAllowedExtensions.Add    “File”,”^(Extensions Here)$”
% T& J2 c/ M) R9 p' {


2 X$ D, y2 i$ E; p
% w( V) T. L( V8 S' p. o! D
php测试无效
; `& y% u4 p- O3 Jasp/aspx测试成功：
1 }. C# A# N5 \$ O来到/FCKeditor/editor/filemanager/connectors/test.html
因为结合了之前二次上传的漏洞，所以先上传任意内容的文件：asd.asp.txt
5 U: N3 S4 h# x0 v5 k7 i
! j+ {& Z6 |/ C3 B$ e- U" ^burpsuite上传包并修改，repeater
3 ~: C+ n; F! F' ]* v6 E) E! Y名字改为asd.asp%00txt    然后把%00专为URL编码上传后得到asd(1).asp
' M# G# `/ Y& W' V% S
如图，webshell为：http://localhost/userfiles/file/asd(1).asp

---

欢迎光临 中国网络渗透测试联盟 (https://www.cobjon.com/)

Powered by Discuz! X3.2