Use the FCKeditor vulnerability to get webshell

Huar 3ast.com.cn

Today, I am a simple tutorial on using the FCKeditor vulnerability to get webshell. There are many posts on the Internet with the FCKeditor vulnerability, but most of them are like copying

In the same way, most of them use the webshell constructed by the method. Today, I directly call FCKeditor to get webshell in the background.

Vulnerability exploitation: File Parsing path vulnerability in Windows 2003 IIS6 and FCKeditor Vulnerability

First, I met a site with an injection point and guessed the Administrator account and password through the hacker injection tool.

Go back to the background address

 

Then you successfully log on to the website background.


I found that the background function is very simple. When I browsed the directory in the background, I found that the background actually called the FCKeditor editor.

We upload a jpg horse.

View the path of the uploaded Trojan


Hey, ''' the pony is uploaded successfully.


Next we will upload the trojan, and finally obtain the webshell.