FCKeditor/editor/filemanager/browser/default/browser.html?Type=Image&Connector=connectors/jsp/connector.jsp 常用的上传地址B FCKeditor/editor/filemanager/browser/default/connectors/test.html FCKeditor/editor/filemanager/upload/test.html FCKeditor/editor/filemanager/connectors/test.html FCKeditor/editor/filemanag...
fckeditor是不允许直接上传后缀为.asp的文件的,但是可以通过修改后缀为.asp;jpg来绕过上传一句话木马。 上传成功 加上iis6的解析机制漏洞,该文件就会被认为是asp文件执行,查看上传url 上传路径为/userfiles/file/cmd.asp;jpg,上菜刀拿key