最新FCKEditor ASP上传绕过漏洞

admin

exploiut-db：
2 R# G, h& m4 z. W6 |
7 K4 ]! l( X( l  ^8 \' ~& XFCKEditor ASP Version 2.6.8 File Upload Protection Bypass
9 b. S7 b5 d. @+ k: g9 }% J
1 G7 j" x4 i. \& g9 W9 P" y- Title: FCKEditor 2.6.8 ASP Version File Upload Protection bypass
3 |3 s: ]9 L. C5 Z1 v9 f3 {( D9 D- Credit goes to: Mostafa Azizi, Soroush Dalili
- Link:http://sourceforge.net/projects/fckeditor/files/FCKeditor/
- Description:
, M2 [9 f! Q8 W0 \) o: s2 xThere is no validation on the extensions when FCKEditor 2.6.8 ASP version is
dealing with the duplicate files. As a result, it is possible to bypass
/ N, S( Z# W& V# S1 t' w/ Pthe protection and upload a file with any extension.
- Reference: http://soroush.secproject.com/blog/2012/11/file-in-the-hole/
- Solution: Please check the provided reference or the vendor website.
) F4 M1 V! O9 s( X3 c' a) h7 W9 F- PoC:http://www.youtube.com/v/1VpxlJ5 ... ;rel=0&vq=hd720
"
9 c8 n  C: ]0 N3 SNote: Quick patch for FCKEditor 2.6.8 File Upload Bypass:
1 H- @9 I( K1 ]/ @In “config.asp”, wherever you have:
, t$ O; W+ k5 s- a      ConfigAllowedExtensions.Add    “File”,”Extensions Here”
3 X  F  y2 ?2 z" y- PChange it to:
. J& O2 A' B) s6 D7 @9 Z( g      ConfigAllowedExtensions.Add    “File”,”^(Extensions Here)$”

% D/ y* O) _9 ^7 B2 k" I
2 c* N7 T6 H7 I4 `2 L

; I" s" l: r7 |6 E
. @2 D) A" k$ j  ?* S' s/ I1 Nphp测试无效
asp/aspx测试成功：
来到/FCKeditor/editor/filemanager/connectors/test.html
' L, u2 |" z, L: D因为结合了之前二次上传的漏洞，所以先上传任意内容的文件：asd.asp.txt

burpsuite上传包并修改，repeater
3 [- O: q/ C$ a0 h名字改为asd.asp%00txt    然后把%00专为URL编码上传后得到asd(1).asp

! @) F2 E) ?# Y' Z/ \2 p- ~如图，webshell为：http://localhost/userfiles/file/asd(1).asp
" |. s1 l% v- \# Q; O' h" `( ^& i$ p
  s$ ?: z8 ?( ~* W* N4 e