最新FCKEditor ASP上传绕过漏洞

admin

exploiut-db：

/ y: V0 o. j% M1 h! RFCKEditor ASP Version 2.6.8 File Upload Protection Bypass
( ~2 Z) W. ]3 n4 R
- G- U7 J8 q# n- Title: FCKEditor 2.6.8 ASP Version File Upload Protection bypass
- Credit goes to: Mostafa Azizi, Soroush Dalili
- Link:http://sourceforge.net/projects/fckeditor/files/FCKeditor/
- Description:
: l0 I8 }' ~% ]) l0 f" D" uThere is no validation on the extensions when FCKEditor 2.6.8 ASP version is
' _) N& c. q8 b+ E2 ^. x. v! Zdealing with the duplicate files. As a result, it is possible to bypass
8 y) J0 b! \& {# C6 x8 dthe protection and upload a file with any extension.
" k( d0 i' i% V: C3 A- Reference: http://soroush.secproject.com/blog/2012/11/file-in-the-hole/
- Solution: Please check the provided reference or the vendor website.
- PoC:http://www.youtube.com/v/1VpxlJ5 ... ;rel=0&vq=hd720
6 a" a1 ~- [" r1 n"
; I" \. D" R' h/ o2 ]Note: Quick patch for FCKEditor 2.6.8 File Upload Bypass:
! r% R4 @1 i1 QIn “config.asp”, wherever you have:
      ConfigAllowedExtensions.Add    “File”,”Extensions Here”
Change it to:
  d+ V* Y5 x+ _, P  L% J+ U      ConfigAllowedExtensions.Add    “File”,”^(Extensions Here)$”
) j. Z6 \: B* W2 W! d
5 G6 r! [0 f; J( _( F0 G" q

3 Y# N( r( U* n' ~0 `% m  K
. x" p; c" `- |8 F3 ?3 n% N/ s
! u$ E. v" R  h$ _: y$ b. j. ?5 Sphp测试无效
, r. {" {5 J8 D* X6 W; o5 T% Jasp/aspx测试成功：
; Y$ m0 u$ i0 W( J来到/FCKeditor/editor/filemanager/connectors/test.html
6 d9 H+ d$ m# r. Y( `: ^+ r' y因为结合了之前二次上传的漏洞，所以先上传任意内容的文件：asd.asp.txt

burpsuite上传包并修改，repeater
名字改为asd.asp%00txt    然后把%00专为URL编码上传后得到asd(1).asp
9 j  D; J, }" X1 a9 i8 a0 {
2 q' C7 J' ]9 x" ]  c6 V- R9 R如图，webshell为：http://localhost/userfiles/file/asd(1).asp

. j/ E  U6 b: A) S" g# C% k$ E