最新FCKEditor ASP上传绕过漏洞

admin

exploiut-db：
- t  v) l3 t: s
FCKEditor ASP Version 2.6.8 File Upload Protection Bypass
2 ^3 H1 \/ _9 [6 s+ S* G: C: }
- Title: FCKEditor 2.6.8 ASP Version File Upload Protection bypass
6 i" F* O6 L$ O6 f, }' ?- Credit goes to: Mostafa Azizi, Soroush Dalili
- Link:http://sourceforge.net/projects/fckeditor/files/FCKeditor/
- Description:
8 @3 z! s* {2 k0 O$ x4 j9 V" TThere is no validation on the extensions when FCKEditor 2.6.8 ASP version is
dealing with the duplicate files. As a result, it is possible to bypass
the protection and upload a file with any extension.
- Reference: http://soroush.secproject.com/blog/2012/11/file-in-the-hole/
- Solution: Please check the provided reference or the vendor website.
- PoC:http://www.youtube.com/v/1VpxlJ5 ... ;rel=0&vq=hd720
"
Note: Quick patch for FCKEditor 2.6.8 File Upload Bypass:
; [0 [( n  ~3 G  n6 RIn “config.asp”, wherever you have:
      ConfigAllowedExtensions.Add    “File”,”Extensions Here”
Change it to:
* B8 h7 ~5 A: t# l      ConfigAllowedExtensions.Add    “File”,”^(Extensions Here)$”

9 j3 `0 A9 i+ ~, A


3 N+ T  d5 O& W& {4 Y9 M2 m
/ G  M# M' \! }$ Aphp测试无效
# i, i2 P  w/ g: j% \asp/aspx测试成功：
来到/FCKeditor/editor/filemanager/connectors/test.html
. q8 _& m' n; J$ W因为结合了之前二次上传的漏洞，所以先上传任意内容的文件：asd.asp.txt

burpsuite上传包并修改，repeater
名字改为asd.asp%00txt    然后把%00专为URL编码上传后得到asd(1).asp

! L9 G$ l/ |# Z8 q. a3 {如图，webshell为：http://localhost/userfiles/file/asd(1).asp
5 m7 o, ], Q0 `* B( \, x7 m