[BreShiE]

This post is leaked from the premium section of "Legion" on the competing hack forum. There will be 5 new leaks a day. There may be some format problems due to UTF8 character encoding.

This is a simple method, it is not a 0day method so I take no credit for actually discovering it.

Big shout out to Acid Burnâ„¢ who worked on this method with me.

Admin access has been achieved and upon finding little options to upload a shell directly we noticed that FCKEditor was present and is highly vulnerable to exploitation.

First go to:


You should see this:



Select uploadtest.html and you will be faced with this:



Now create a text file and put your malicious script into it, for example your favorite web shell. For this I just included a shitty but still effective uploader script that I quickly found.



We need to intercept this request via a web proxy and modify the data to trick the server into granting our .php extension. Download "burpsuite" and configure port 8080 to go with your Firefox. I will not get too into this. But be sure to have your burp running with intercept turned to on.

Now go back to the FCKEditor and send this file to server.



This will trigger your burp and you will see all the POST data in front of you.



This is what we need to modify. Where it says &CurrentFolder=/ you need to change this to your desired file name with your .php extension. A null byte is also required in order to bypass.



I called mine uploader.php%00. If your following that is the simple upload script I previously found. Click 'forward' on burp and this will send your modified POST data to the server. Wait a second and you should see:



Upload seems to have been successful. It shows that it is saved in /uploads/uploader.php. Browse to it:



Success now upload any file of our preference, for POC purposes I am just using another pretty crappy web shell. Now upload:



And Voila!



We now have shell access. What you do from here is down to you. So there we go one relatively easy way to exploit websites running FCKEditor. Hope you enjoyed. VV.