最新FCKEditor ASP上传绕过漏洞

admin

exploiut-db：
/ f3 I) U2 [) _
FCKEditor ASP Version 2.6.8 File Upload Protection Bypass

- Title: FCKEditor 2.6.8 ASP Version File Upload Protection bypass
) q$ ~- l$ h  {- Credit goes to: Mostafa Azizi, Soroush Dalili
- Link:http://sourceforge.net/projects/fckeditor/files/FCKeditor/
! n; a+ ^6 w7 n- Description:
There is no validation on the extensions when FCKEditor 2.6.8 ASP version is
0 k- b2 {$ `; f' O; Sdealing with the duplicate files. As a result, it is possible to bypass
the protection and upload a file with any extension.
- Reference: http://soroush.secproject.com/blog/2012/11/file-in-the-hole/
* Q: v, M) g- u' q) ]- Solution: Please check the provided reference or the vendor website.
! A) r5 I. d- b7 S- PoC:http://www.youtube.com/v/1VpxlJ5 ... ;rel=0&vq=hd720
"
6 a+ ?1 G2 h% A- Q& H$ ]Note: Quick patch for FCKEditor 2.6.8 File Upload Bypass:
In “config.asp”, wherever you have:
* K7 w' N6 q3 m4 C+ ^3 y+ c# [      ConfigAllowedExtensions.Add    “File”,”Extensions Here”
5 Q5 W) X9 {' n0 v- Q( z( yChange it to:
      ConfigAllowedExtensions.Add    “File”,”^(Extensions Here)$”
! O' Y$ v0 I7 n* Y2 G
5 E' Y" A- a' J


! r5 D' G: x, I; F1 W9 g  i4 a: S
8 \- Y5 p' D; _; Nphp测试无效
5 u- w% P2 u6 Basp/aspx测试成功：
来到/FCKeditor/editor/filemanager/connectors/test.html
因为结合了之前二次上传的漏洞，所以先上传任意内容的文件：asd.asp.txt

1 k9 N! J+ x( jburpsuite上传包并修改，repeater
名字改为asd.asp%00txt    然后把%00专为URL编码上传后得到asd(1).asp
; b5 x& h( t. Q% k
# B% V1 E# @; S3 }8 H- n# Y如图，webshell为：http://localhost/userfiles/file/asd(1).asp