exploiut-db：
% B* z' `9 j! o5 v
# o" c- @! M6 i5 [4 ]( ]FCKEditor ASP Version 2.6.8 File Upload Protection Bypass9 u7 y2 V3 k# @! p7 L
! m: `2 i/ F4 o$ G# d6 ?! }
- Title: FCKEditor 2.6.8 ASP Version File Upload Protection bypass, e( ^$ s9 w1 _6 _3 o
- Credit goes to: Mostafa Azizi, Soroush Dalili
5 q; V; K: E f, f- Link:http://sourceforge.net/projects/fckeditor/files/FCKeditor/
$ t4 G4 \( f/ V6 W1 u+ M- Description:
6 K% [( h; W1 P; R1 IThere is no validation on the extensions when FCKEditor 2.6.8 ASP version is4 S/ i# r* c" G' ?
dealing with the duplicate files. As a result, it is possible to bypass6 B* a" x3 A% d; k% P) m( O
the protection and upload a file with any extension.0 |) t; ^! Y) a' U
- Reference: http://soroush.secproject.com/blog/2012/11/file-in-the-hole/( t$ p% `: J( n; ^# v0 J7 f
- Solution: Please check the provided reference or the vendor website.
9 @" O7 ?% ^ }$ j- PoC:http://www.youtube.com/v/1VpxlJ5 ... ;rel=0&vq=hd7203 }7 P8 K: d* n$ u
"' o, u. p" I# w' ]- A: J
Note: Quick patch for FCKEditor 2.6.8 File Upload Bypass:. G; t1 T, n' f4 j5 F0 t$ M
In “config.asp”, wherever you have:
- `, a( m5 a( K g& y: k$ P; V7 R ConfigAllowedExtensions.Add “File”,”Extensions Here”
+ p5 |9 ]2 G4 Y1 i) k \& kChange it to:
* h& E% C6 S7 J% M7 T ConfigAllowedExtensions.Add “File”,”^(Extensions Here)$”. U% i0 S9 r: C# {7 @) ^+ |
9 v0 c @5 I% A' _3 p0 J6 f9 n
; M$ F9 d3 M9 C. V7 c* U
) q9 Q, Y A O |# Z/ g |1 H( N5 g0 d! E
& E5 G! \1 e9 l( U9 d8 Bphp测试无效8 s# T$ ]% u( g9 c; `! a- c- X
asp/aspx测试成功：" ^8 h8 E4 ?; u# }) X" P6 C" y
来到/FCKeditor/editor/filemanager/connectors/test.html$ G3 o& J4 A1 S2 O0 u
因为结合了之前二次上传的漏洞，所以先上传任意内容的文件：asd.asp.txt
/ ]: q+ L. B+ W/ A3 K
9 u! b; Y2 L' c4 a" mburpsuite上传包并修改，repeater; A8 }/ A+ i, t- v
名字改为asd.asp%00txt 然后把%00专为URL编码上传后得到asd(1).asp" ^; P! w4 }5 V$ j
: \4 @) A; _6 p6 t1 b
如图，webshell为：http://localhost/userfiles/file/asd(1).asp5 ^, d* D2 b0 |* F& m1 U8 i
" ?" ^; M; T; a/ Z; A |
发表于 2012-12-10 10:18:50
收藏
支持
反对