感谢生生不息在freebuf社区”分享团”里给出线索,才有了本文
- r& u( L( Y3 E w
( ?/ K# I8 R+ y; K- h" g+ m原帖:http://club.freebuf.com/?/question/129#reply12( h5 N/ p" L" `8 J1 `
" t( w7 g9 S7 u8 l3 mFCKEditor 2.6.8文件上传漏洞
4 P3 v, C/ M) a! A) m2 d4 L9 z& l( E/ O0 j+ R0 x( ^3 b n
Exploit-db上原文如下:( c* c$ f. Z, d l/ F6 e
. ~; }( H+ O: |9 u- S- Title: FCKEditor 2.6.8 ASP Version File Upload Protection bypass
# Q* J: c, k F) o9 u. \- Credit goes to: Mostafa Azizi, Soroush Dalili
! A$ g* _- c3 h- Link:http://sourceforge.net/projects/fckeditor/files/FCKeditor/0 h2 ~; O) Z) k
- Description:
6 p: s; o. m6 O, A/ Y b0 DThere is no validation on the extensions when FCKEditor 2.6.8 ASP version is7 T* r9 n( R8 x6 {4 t, f0 a
dealing with the duplicate files. As a result, it is possible to bypass
# j7 T, C- Q" o% N( l4 sthe protection and upload a file with any extension.
6 O3 F9 y# H% v# \' b& r8 ~- Reference: http://soroush.secproject.com/blog/2012/11/file-in-the-hole/+ I. I+ c' s+ R+ P+ V& {* Q7 K/ [
- Solution: Please check the provided reference or the vendor website.
' P5 | G# L! Q. b; u' p2 o5 }8 d+ y
1 ~ J5 |- w2 Z S/ ?2 H' z- PoC:http://www.youtube.com/v/1VpxlJ5 ... ;rel=0&vq=hd720( U* z6 Z7 a5 v4 ~8 @
"5 r$ d8 o7 v/ y2 d) v' c% v
Note: Quick patch for FCKEditor 2.6.8 File Upload Bypass:! J$ l9 R, [. T3 m9 e/ D/ u
% S6 P" P5 E2 M4 P' x7 yIn “config.asp”, wherever you have:
: R4 {" |0 }. p* ~7 J ConfigAllowedExtensions.Add “File”,”Extensions Here”! v, [8 M# k7 G& o2 s# C: W/ u+ P6 n
Change it to:, `7 d* s3 ^, }: E c
ConfigAllowedExtensions.Add “File”,”^(Extensions Here)$”在视频(需翻墙)里,我们可以看的很清楚:
+ F6 P9 k0 D& s/ a3 l
$ y& C% Y, p2 E( N1.首先,aspx是禁止上传的- h) Z! R" B) P8 K. v
2.使用%00截断(url decode),第一次上传文件名会被转成_符号5 Z/ U+ U6 d" |" p8 ]
/ x9 E/ [8 g: X; p: v( Y; a
4 _ f) B9 n( Z8 ~" C \% @0 A9 }
* T \" f( V7 H" M& u2 o8 y接下来,我们进行第二次上传时,奇迹就发生了
4 J/ U& U8 o1 z( ~2 v# }! F
* S; Z/ V2 j H5 N/ p3 N' ?6 I- r) ]% A2 A
4 e% g2 d0 T* a3 I ]+ o代码层面分析可以看下http://lanu.sinaapp.com/ASPVBvbscript/121.html
3 U4 C; u- {" Q+ e& N! q7 c C
8 @- b$ v# v; ?5 n1 s
- K+ ^; U( v4 U# A6 o4 _% U2 b& H- P# q; `
CKFinder/FCKEditor DoS漏洞
, B' Y9 ?# A9 |& B0 W( B3 a
* K6 V$ d* y3 r" B0 b) g2 }相比上个上传bug,下面这个漏洞个人觉得更有意思. `$ I: t! B/ W/ u7 G/ x, J& a
" V$ Q, h x4 \ 9 r. g0 ]; b' I& V% c9 R
# K' h& R5 d+ Z1 \' A2 k
CKFinder是一个强大而易于使用的Web浏览器的Ajax文件管理器。 其简单的界面使得它直观,快速学习的各类用户,从高级人才到互联网初学者。
/ N5 F' Z9 v* a1 S# h9 D9 {4 M' d. ^
5 X: m% V. l. K8 I x) ^* F4 VCKFinder ASP版本是这样处理上传文件的:2 K; t6 ]& x8 w
; c% _! @1 {) {1 p5 t, e
当上传文件名已存在时,会进行迭代重命名,比如file(1).ext存在了,会尝试重命名为file(2).ext……直到不重复为止。: d/ C4 c9 ~* z& t$ y
2 U, p7 G" k3 s/ B0 Y" m4 w: h那么现在有趣的事情来了——windows是禁止”con”作为文件名的(关于这个问题我印象中很久以前,win也有过con文件名漏洞,有兴趣可以确认下)" p, C4 B. H" A% @4 D* C( g) o
; d3 @% A* k+ ]3 ?9 k
dos方法也应运而生!
) w- y0 T1 N% ~4 G% Z7 ^9 d/ T8 h- p9 r2 c
% M; h4 {' y2 ~! j% E
! t1 F% `7 k! k2 d, L3 _) H1 t
1.上传Con.pdf.txt
! v# P- |- I( \% k; a1 D' ? ?+ ~2.CKFinder认为“Con.pdf.txt” 已被占用,于是开始尝试Con.pdf(1).txt,Con.pdf(2).txt……Con.pdf(MaxInt).txt从而对服务器形成致命dos。
( m: N1 _& P" i$ J- E5 [4 Z; W4 G/ }; I1 w7 [* s# y
|