最新消息：
    你的位置：jinglingshu的博客 > 渗透 > ckeditor漏洞

    ckeditor漏洞

    渗透 admin 57437浏览 0评论

    ckeditor漏洞

    1、ckfinder上传漏洞

    ckfinder是一个AJAX的文件管理工具，配合ckeditor用于网站上传、管理文件。
    但是ckfinder/ckfinder.html页面，访问不需特别权限。
    利用在IIS6.0的环境下的解析漏洞可拿webshell。

     

    2、ckeditor上传漏洞

    http://www.netknight.in/manage/ckfinder/ckfinder.html
    上传1.gif后再右击重命名成1.asp;.gif

     

    3、ClanSphere 2011.0集成了ckeditor编辑器（注：ckeditor是fckeditor的3.0版本）

    谷歌关键词：

    inurl:/mods/ckeditor/filemanager/

    或者inurl:index.php?mod=clansphere

    漏洞测试：
    http://www.netknight.in/mods/ckeditor/filemanager/connectors/test.html
    http://www.netknight.in/mods/ckeditor/filemanager/connectors/uploadtest.html
    http://www.netknight.in/mods/ckeditor/filemanager/browser/default/browser.html
    http://www.netknight.in/mods/ckeditor/filemanager/browser/default/frmupload.html

    ClanSphere CKEditor组件

    http://www.netknight.in/mods/ckeditor/filemanager/connectors/php/upload.php允许上传任意控制名的文件，可造成任意文件上传和执行任意PHP代码

    ckeditor编辑器在IIS7.5下的上传漏洞测试

    点下图片上传按钮跳出了上传页面，浏览——看到了目录。一片空白，没有前人来过啊。

    果断的尝试直接上马，类型错误=失败，建了个asp目录才想起来是iis7.5的（蒙了），传了个图片测试，被重命名了。有点操蛋，跳到test.Html上传页面，发现aspx上传页面被干掉了，试了试asp的，还在传文件，传图片，各种传，NND，无果。

    继续跳回文件浏览页，明知道IIS7.5解析漏洞木有，还是把一个马命名为1.asp;.jpg传了下，正常上传。但是有点操蛋

    图

    文件扩展名后面没有了，留下个；号。记得以前没见过这样的啊。百度找了下，也没见有啊。

    首先想到的是有洞，继续改文件名测试。一次、两次、三次、。。。。

    基本都要在后面加个；号，测试了几十种配法。。各种替换各种来，最后有点接近了。。。看那个.;a的文件，稍微改了下，改成 了  a.aspx.a;.a.aspx.jpg..jpg  终于出现了我想要的效果，就是上图最后那个aspx的文件，兴奋的打开，看见看我可爱的小马儿。

    转自：http://www.backlion.com/ckeditor%E7%BC%96%E8%BE%91%E5%99%A8%E5%9C%A8iis7-5%E4%B8%8B%E7%9A%84%E4%B8%8A%E4%BC%A0%E6%BC%8F%E6%B4%9E%E6%B5%8B%E8%AF%95/

     

     

    转载请注明：jinglingshu的博客 » ckeditor漏洞

    与本文相关的文章

    发表我的评论
    取消评论

    表情

    Hi，您需要填写昵称和邮箱！

    • 昵称 (必填)
    • 邮箱 (必填)
    • 网址

    网友最新评论 (11)

    1. I liҝe what you guys ɑre up too. Such intｅlligent worк and rеporting! Carry on the superb works guys I've incorporated you guys to my blogroⅼl. I think іt'll improve the value of my web site :).
      thuoc genk6年前 (2018-12-20)回复
    2. When someone writes an post he/she maintains the idea of a user in his/her brain that how a user can be aware of it. Thus that's why this piece of writing is outstdanding. Thanks!
      Multi Spindle Head5年前 (2020-01-15)回复
    3. Hello everyone, it's my first visit at this web site, and piece of writing is actually fruitful designed for me, keep up posting such articles or reviews.
      http4年前 (2021-10-23)回复
    4. Really cool thing defi you just gave me a good bot to enjoy the world cup and i hope it gets live soon... Defi defending our broke ass funds
      Situs Judi Bola Online2年前 (2022-12-02)回复
    5. I requested them to put in writing my law essay for me and their writer did it for me in just in the future.
      Brodie2年前 (2023-01-23)回复
    6. The Greatest Free Films On YouTube Right Now (February 2023) Jan 29, 2023. Do go to Hulu in the present day and start having fun with preemium films and TELEVISION sequence. Since you'll be able to stream the films free of charge with none subscription, the service supports itself byy working brief pre-roll and mid-roll adverts now and again. Disney Plus is a subscription-based OTT streaming service launched by the medxia conglomerate, Disney. Movie4k to is a Free Motion pictures streaming website with zero adverts. Many online streaming websites on the web are deceiving in nature, and so they juust try to inject malware into your system. You may as well watch movies totally free on the video streaming big. Free streaming web sites, which aren't legal content providers, are at all times important due to knowledge breaches and privateness invasion issues. Additionally, if your IP deal with is blocked by any of thuese stteaming providers because of your nation of residence, a superb VPN can get you unblocked. You can now watch movies anywhere! It may take 2-three attempts to click on a film thumbnail and 5-6 makes an attempt to get the film streaming. Kanopy: One of thhe crucial person-pleasant websites providing free TELEVISION reveals and movies streaming. Youu can watch free motion pictures on-line via numerous streaming service websites and apps. There are no advertisements on HiMovies. Go to a website that gives free motion pictures. However you can ttoo get new and fashionable movies that are free to observe.Presently it hosts a lot of well-liked titles from the Marvel Cinematic Universe, Pixar Studios, Star Wars Franchise, Traditional Disney films, Animations, and Disney+ Originals.
      Porn2年前 (2023-04-28)回复
    7. I just could not depart your ebsite before suggesting that I reallky enjoyed the usual information a person provide foor your visitors? Is gonna be again continuously in order to check out new posts Feel free too visit mmy homepage my blog
      my blog2年前 (2023-06-28)回复
    8. See for yourself and get fapping with the most effective Www Xxx Com 2022 intercourse videos. The movie set a record by winning eleven AVN Awards (see section below). For fun I figured it can be fascinating to see what kind of testing you could carry out with minimal primitives. Reynolds and his crew go attempting to find Stagnetti, who tries to discover a map that leads to a powerful secret on an island somewhere within the Caribbean Sea. After the crew escapes the spawn of darkness summoned by Stagnetti, their ship engages Stagnetti's in battle, ending Stagnetti's reign as a pirate. The second movie was released on September 26, 2008, below the title Pirates II: Stagnetti's Revenge. RogReviews called it "probably the most talked about grownup movie of the yr". Both Blu-ray editions embody "Command Control" interactive viewing mode, permitting audiences to expertise the movie with image-in-picture featurettes, storyboard comparisons and Battle Points throughout the context of the movie. Battle in Heaven Film directed by Carlos Reygadas, that includes an opening scene of unsimulated fellatio between Anapola Mushkadiz and Marcos Hernández. The Angel and the Woman 1977 This movie by Gilles Carle comprises some explicitly unsimulated sexual exercise between its stars. Once they save a young woman named Isabella from drowning, she tells them that her husband's ship has been destroyed by the feared Captain Victor Stagnetti and his crew of cutthroat pirates.
      xxx2年前 (2023-07-27)回复
    9. Whereas that earnings was sufficient for the fundamentals - rent, meals, and so forth. -, she additionally accrued a variety of debt: a combined $40,000 of bank card and pupil loan debt. Others are old sufficient to be the mothers, and even the grandmothers of these teenagers, proving but once more that nudity and age can, and certainly should, go hand in hand. Are there free OnlyFans accounts I can subscribe to? Yes, there are. Some OnlyFans creators waive their basic subscription payment for basic content material totally, identical to the perfect free hookup sites. She additionally doesn’t discriminate with regards to offering her OF subscribers with this type of high quality: each her common followers and exclusive content patrons get the same kind of topnotch manufacturing values from whatever she creates. You could find these both as occasional common content material that she posts or as pre-recorded unique movies that you may buy individually from her account. From her demeanor proper right down to her trend sense, you possibly can easily inform that Emmy is the sort of OnlyFans account that manages to perfectly balance the candy and sexy attraction of Ladies Subsequent Door with extra mature themes.
      onlyfansleak.org2年前 (2023-08-16)回复
    10. obviously like your website however you need to take a look at the spelling on several of your posts. A number of them are rife with spelling problems and I to find it very bothersome to inform the truth however I will certainly come again again.
      view it2年前 (2023-08-20)回复
    11. Газорезчик должен быть одет в теплоотражательный костюм.
      Лауретсульфат натрия SLES 702年前 (2023-10-23)回复