中国网络渗透测试联盟

标题: 最新FCKEditor ASP上传绕过漏洞 [打印本页]

---

作者: admin    时间: 2012-12-10 10:18
标题: 最新FCKEditor ASP上传绕过漏洞
exploiut-db：

5 T( D5 z9 C* T; d" X5 LFCKEditor ASP Version 2.6.8 File Upload Protection Bypass

& |, w% ]2 h, ]6 K- r2 x& E- Title: FCKEditor 2.6.8 ASP Version File Upload Protection bypass
1 ^8 V6 ^9 P- d( l7 ^- Credit goes to: Mostafa Azizi, Soroush Dalili
9 G! G  _5 U/ N  X0 M& E& F% O: U- Link:http://sourceforge.net/projects/fckeditor/files/FCKeditor/
* T% q, d+ m( ?- o% L& Z/ {: w- Description:
There is no validation on the extensions when FCKEditor 2.6.8 ASP version is
" Y" v7 l6 N. Z) ]dealing with the duplicate files. As a result, it is possible to bypass
# C0 A* `: ^4 s( P" E# u9 othe protection and upload a file with any extension.
* ~) e4 |& ~- X$ o2 b5 N) M$ S5 ?+ s- Reference: http://soroush.secproject.com/blog/2012/11/file-in-the-hole/
+ L( p8 Y( _1 ^2 d/ o  N- Solution: Please check the provided reference or the vendor website.
3 }, @& K7 A1 x4 Q- K# F- PoC:http://www.youtube.com/v/1VpxlJ5 ... ;rel=0&vq=hd720
"
Note: Quick patch for FCKEditor 2.6.8 File Upload Bypass:
In “config.asp”, wherever you have:
      ConfigAllowedExtensions.Add    “File”,”Extensions Here”
Change it to:
  `' j2 m4 L8 C  H      ConfigAllowedExtensions.Add    “File”,”^(Extensions Here)$”
6 x2 R& w9 L  X0 E: H, V5 S% @
' C: U; ^/ U6 j- l; F" o' f+ ]
* I, y9 X+ O8 f# [

/ Q2 G" Q, Q! M' q6 D! ]
* M4 y0 N5 T0 @. q" nphp测试无效
/ n* S- @& b  b$ `- nasp/aspx测试成功：
来到/FCKeditor/editor/filemanager/connectors/test.html
因为结合了之前二次上传的漏洞，所以先上传任意内容的文件：asd.asp.txt
9 f4 F5 p% M" {( j% {
burpsuite上传包并修改，repeater
名字改为asd.asp%00txt    然后把%00专为URL编码上传后得到asd(1).asp
; p' b$ @; b( P7 x7 ?
如图，webshell为：http://localhost/userfiles/file/asd(1).asp

0 H' ^  T; |( i% K3 R) j2 f

---

欢迎光临 中国网络渗透测试联盟 (https://www.cobjon.com/)

Powered by Discuz! X3.2