最新FCKEditor ASP上传绕过漏洞

admin

exploiut-db：
# \  j( N# K6 W4 u- d6 z% t* Q! W
  q9 X% y8 K5 b1 R& y. |FCKEditor ASP Version 2.6.8 File Upload Protection Bypass

( ?! T' k, R: f. U( l- Title: FCKEditor 2.6.8 ASP Version File Upload Protection bypass
" |: i' \7 ~. B+ _" w6 K- Credit goes to: Mostafa Azizi, Soroush Dalili
- Link:http://sourceforge.net/projects/fckeditor/files/FCKeditor/
- Description:
There is no validation on the extensions when FCKEditor 2.6.8 ASP version is
dealing with the duplicate files. As a result, it is possible to bypass
the protection and upload a file with any extension.
- Reference: http://soroush.secproject.com/blog/2012/11/file-in-the-hole/
, @) B5 f8 c* v0 ?& J3 @8 [+ F+ V- Solution: Please check the provided reference or the vendor website.
- PoC:http://www.youtube.com/v/1VpxlJ5 ... ;rel=0&vq=hd720
4 O0 l: k: i& C; r9 r"
! i2 r6 Z6 R; M2 }# N1 d& r6 FNote: Quick patch for FCKEditor 2.6.8 File Upload Bypass:
In “config.asp”, wherever you have:
4 q% T& G+ @3 v7 s0 k      ConfigAllowedExtensions.Add    “File”,”Extensions Here”
Change it to:
      ConfigAllowedExtensions.Add    “File”,”^(Extensions Here)$”
: @: L, [5 H, j# _+ l
" j8 B4 A/ K% B7 N% F+ P2 c


/ D  ?* V1 s$ A$ K
php测试无效
) m* l, G; E* U+ {; R7 u) D& easp/aspx测试成功：
来到/FCKeditor/editor/filemanager/connectors/test.html
因为结合了之前二次上传的漏洞，所以先上传任意内容的文件：asd.asp.txt

) o( ~" E4 ]3 @5 H  |7 V+ M& _4 Jburpsuite上传包并修改，repeater
+ y  \/ I' }6 F( [5 c8 e名字改为asd.asp%00txt    然后把%00专为URL编码上传后得到asd(1).asp
& R; ~+ c# ]+ @' n
如图，webshell为：http://localhost/userfiles/file/asd(1).asp