exploiut-db：' Y4 |5 ]; |. s; v
; t1 b$ w+ V8 p6 C) }1 @5 d- w6 {
FCKEditor ASP Version 2.6.8 File Upload Protection Bypass
& ~, n; P3 b# ~9 H! Q$ m
8 i, ^& N! F" c5 R9 \8 o/ P9 l- Title: FCKEditor 2.6.8 ASP Version File Upload Protection bypass
6 H& T" N+ A$ |: V- ], @9 [- Credit goes to: Mostafa Azizi, Soroush Dalili9 K4 }$ ]/ n7 }- w( _
- Link:http://sourceforge.net/projects/fckeditor/files/FCKeditor/$ p+ A' E1 O, U5 D' h8 f7 f, _- B
- Description:2 b, a9 h/ U$ w# L3 [$ S2 p
There is no validation on the extensions when FCKEditor 2.6.8 ASP version is2 Z* L1 R, a5 h: I
dealing with the duplicate files. As a result, it is possible to bypass
: D* f6 E" w/ w [+ l6 Dthe protection and upload a file with any extension.
$ { U! p, B9 m, F3 G# t& `5 @- Reference: http://soroush.secproject.com/blog/2012/11/file-in-the-hole/, B2 n# K K5 |
- Solution: Please check the provided reference or the vendor website.
: I2 S" {; q" p- PoC:http://www.youtube.com/v/1VpxlJ5 ... ;rel=0&vq=hd720
1 m8 W0 a' H: E' U"5 r _+ b, X4 h4 u" t K
Note: Quick patch for FCKEditor 2.6.8 File Upload Bypass:
5 w0 G0 \7 W+ L. q: C; r+ |9 u1 f( \7 cIn “config.asp”, wherever you have:
6 C: M6 n: u ?# p' z; d6 V. \$ R* T ConfigAllowedExtensions.Add “File”,”Extensions Here”) u% D; b0 F5 n0 ^+ L7 H- d5 f1 w
Change it to:
, P" c. Q' [! _7 L% r ConfigAllowedExtensions.Add “File”,”^(Extensions Here)$”
- S4 h, ~* C0 w+ `6 K7 o
, n. d$ k5 L6 R! s4 u4 P
/ E+ D* `3 s6 \% Y
! K4 h: n8 ~/ X8 x0 K1 l: l( @" D" n# Z - x, W' K; g4 D/ V
. \9 {7 E0 }& e+ B3 ^php测试无效1 T s8 ^! ~4 p
asp/aspx测试成功：
3 d$ E5 I+ |5 M0 z7 a5 E% o来到/FCKeditor/editor/filemanager/connectors/test.html
8 u5 k" {7 X1 h E( K& O因为结合了之前二次上传的漏洞，所以先上传任意内容的文件：asd.asp.txt" W6 U- T9 |6 g- t
( |: n0 ^, x' Kburpsuite上传包并修改，repeater5 \; v8 t" S. p! i! N/ x
名字改为asd.asp%00txt 然后把%00专为URL编码上传后得到asd(1).asp
# A5 Q% l/ k2 G7 Y9 z& Q7 A
" z$ t. G) h- W如图，webshell为：http://localhost/userfiles/file/asd(1).asp2 S( F+ P4 x4 H6 ?$ p. J* G
9 J. k c# C% T" [% O8 }5 a1 Q# U9 R
|
发表于 2012-12-10 10:18:50
收藏
支持
反对