[VipVince]

This is a simple method, it is not a 0day method so I take no credit for actually discovering it.

Big shout out to Acid Burn™ who worked on this method with me.

Admin access has been achieved and upon finding little options to upload a shell directly we noticed that FCKEditor was present and is highly vulnerable to exploitation.

First go to:

http://www.vulnsite.com/admin/fckeditor/...onnectors/

You should see this:

[img]http://#/xgAnIj.jpg[/img]

Select uploadtest.html and you will be faced with this:

[img]http://#/xqFg7k.jpg[/img]

Now create a text file and put your malicious script into it, for example your favorite web shell. For this I just included a shitty but still effective uploader script that I quickly found.

[img]http://#/r3QBFL.jpg[/img]

We need to intercept this request via a web proxy and modify the data to trick the server into granting our .php extension. Download "burpsuite" and configure port 8080 to go with your Firefox. I will not get too into this. But be sure to have your burp running with intercept turned to on.

Now go back to the FCKEditor and send this file to server.

[img]http://#/u2sLSE.jpg[/img]

This will trigger your burp and you will see all the POST data in front of you.

[img]http://#/jdDEUh.jpg[/img]

This is what we need to modify. Where it says &CurrentFolder=/ you need to change this to your desired file name with your .php extension. A null byte is also required in order to bypass.

[img]http://#/CPplFx.jpg[/img]

I called mine uploader.php%00. If your following that is the simple upload script I previously found. Click 'forward' on burp and this will send your modified POST data to the server. Wait a second and you should see:

[img]http://#/RTwtpl.jpg[/img]

Upload seems to have been successful. It shows that it is saved in /uploads/uploader.php. Browse to it:

[img]http://#/HGm7nx.jpg[/img]

Success now upload any file of our preference, for POC purposes I am just using another pretty crappy web shell. Now upload:

[img]http://#/KC3LGc.jpg[/img]

And Voila!

[img]http://#/ooczZf.jpg[/img]

We now have shell access. What you do from here is down to you. So there we go one relatively easy way to exploit websites running FCKEditor. Hope you enjoyed. VV.

[HaxOr❤]

For what versions this works?
And thanks this is totally new (I think)

[puremindd]

Good job, you know how to release public information, +1. And what in the actual fuck is that shell...

[Dyme]

For what versions this works?
And thanks this is totally new (I think)

^This

I know a million sites that use FCKEditor and would really like to know what version this will work with.

[‌Hycca]

This is pretty old, but none the less thanks for the tutorial. I never thought about using Burp Suite for file uploading either. :)

[VipVince]

This will work with 2.6.4 versions and lower.

[Cyber Criminal]

Thanks for making the tutorial I was going to make it but you bet me too it, thanks for the help with this.

[VipVince]

Thanks for making the tutorial I was going to make it but you bet me too it, thanks for the help with this.

No problem, it was fun 😝

[ademin]

hmm.. very nice. let me try first. thanks for sharing.
btw can i use tamper data addons ?

---

i got Error on file upload. Error number: 102

http://ec12.1bina.my/1bina/plugins/apost...dtest.html

[VipVince]

hmm.. very nice. let me try first. thanks for sharing.
btw can i use tamper data addons ?

---

i got Error on file upload. Error number: 102

http://ec12.1bina.my/1bina/plugins/apost...dtest.html

May simply be not vulnerable, check the version.

[HIGH PAID FELLA]

I doesn't get that site.
Maybe it's patched, I doesn't no.

[p0pc0rn]

hmmm..your 1st simple webshell quite familiar :P
nice tutorial VipVince.might try this one if found any of my client;s website using fckeditor

[king225]

I try this . But something goes wrong, shit happens :(

[supracontra]

Did you write that yourself? The UI looks fkn horrible.

Also, this has nothing to do with WYSIWYG editors, this is a file upload vuln where you force a diff mime type.

Unless you can give me a software and vuln version I wouldn't regard it as a PoC.

I also don't understand why you want to make it easy for retards to shell boxes?

[VipVince]

Did you write that yourself? The UI looks fkn horrible.

Also, this has nothing to do with WYSIWYG editors, this is a file upload vuln where you force a diff mime type.

Unless you can give me a software and vuln version I wouldn't regard it as a PoC.

I also don't understand why you want to make it easy for retards to shell boxes?

Yes I wrote it myself.

Correct, and a upload vuln in FCKEditor, this POST data modification exploit will work with the lower versions of FCKEditor. I displayed this in the tutorial.

Why would I give you a vuln version? My print screens prove they exist, and you can ask ๖ۣۜΗ α x O r ❤ as I let him try it for himself on the site I demonstrated here.

It cannot be that easy if your asking me for a vuln version, if 'retards' happen to stumble upon this and have the appropriate version of FCKEditor then they can have fun with their web-shell. I could care less really.

Cheer up a little.