最新FCKEditor ASP上传绕过漏洞

admin

exploiut-db：

" b9 n8 j& M8 \7 J) Z# }/ fFCKEditor ASP Version 2.6.8 File Upload Protection Bypass

- Title: FCKEditor 2.6.8 ASP Version File Upload Protection bypass
- Credit goes to: Mostafa Azizi, Soroush Dalili
- Link:http://sourceforge.net/projects/fckeditor/files/FCKeditor/
5 n+ t- m) @( _1 T- Description:
1 L* u0 V1 B- oThere is no validation on the extensions when FCKEditor 2.6.8 ASP version is
: o" G' R8 O& r# ?# P9 |0 A" wdealing with the duplicate files. As a result, it is possible to bypass
the protection and upload a file with any extension.
- Reference: http://soroush.secproject.com/blog/2012/11/file-in-the-hole/
# p, C( O- N* ?; @; I% r' Y- Solution: Please check the provided reference or the vendor website.
- PoC:http://www.youtube.com/v/1VpxlJ5 ... ;rel=0&vq=hd720
- }; L7 o6 B5 X! n  J/ |$ ~"
8 z% g5 T" g8 t  R- r1 iNote: Quick patch for FCKEditor 2.6.8 File Upload Bypass:
9 X$ c$ j0 g6 {3 C; EIn “config.asp”, wherever you have:
      ConfigAllowedExtensions.Add    “File”,”Extensions Here”
Change it to:
      ConfigAllowedExtensions.Add    “File”,”^(Extensions Here)$”

5 ~# E2 T/ u9 j" l+ k
4 g; {! W/ _& e0 z. U/ e. R; Q( |
( r6 R0 Z) T2 S5 w$ g
4 `0 m8 r: l8 G; k' z& \% V
php测试无效
asp/aspx测试成功：
来到/FCKeditor/editor/filemanager/connectors/test.html
因为结合了之前二次上传的漏洞，所以先上传任意内容的文件：asd.asp.txt
& I' y' U! l: P
& @+ N7 J6 V* e9 Q3 K- Dburpsuite上传包并修改，repeater
$ B5 ]- H' o3 b/ B# ]& o名字改为asd.asp%00txt    然后把%00专为URL编码上传后得到asd(1).asp

9 \. O2 I0 w9 a. M% C9 o如图，webshell为：http://localhost/userfiles/file/asd(1).asp

9 y7 Z& V! k4 X2 B