File Upload

• A file upload vulnerability occurs when a web application lets users upload files without properly checking them. This can allow malicious files, like malware or scripts, to be uploaded and executed on the server, potentially compromising the system.

1. LOW

• Lets view the source code

• As we can see in the code, when the Upload button is clicked, the uploaded file is moved to the target path without any security checks or validation, leaving the system open to file upload vulnerabilities .

We have created a reverse shell PHP script that will provide us with remote shell access.

• Now, we’ll upload it .

As you can see, our upload was successful and the file is now in place.

• Now, Navigate to /hackable/uploads/shell.php. once the Netcat listener is set up, we should receive a shell connection .

• Once the Netcat listener is set up, we should receive a shell connection .

• We have just received a reverse shell

2. MEDIUM

• Lets view the source code

• After analyzing the code, I noticed a validation check where the uploaded file must be either a JPEG or PNG image format and must also be smaller than 100000 bytes.
• When we tried to upload our reverse shell file, the message shown below appeared, confirming that our analysis was correct.

• After some thinking, I decided to intercept the request with Burp Suite and change the Content-Type to an image/png.

And it worked, as shown below.

• Now, let us navigate to the shell.php file and open it in the browser.

• With the listener running, we successfully received a shell.

3.HIGH

• Lets view the source code

• While reviewing the code, I noticed a condition using the substr function that checks the file extension. This ensures the uploaded file is genuinely a JPEG, JPG, or PNG.
• I also noticed the use of the getimagesize function in the code, which checks if the file is a valid image by retrieving its dimensions and type.
• This means that files created with tools like touch or nano won’t have image dimensions and are therefore ruled out .
• So, we’ll use exiftool to generate detailed file information, allowing us to craft files that look like images but aren’t .

We’ll start by downloading a JPEG image from the browser .

• Now, with the help of this Github link, we will be able to inject a custom payload into the image file using exiftool .

php-cmd-exec-webshell/exiftool code at master · F1uffyGoat/php-cmd-exec-webshell

• Now its time to upload the image

The upload was successful, as you can see below .

• If we try to open it, we’ll be prompted with an image.

• To use the injected payload, we will use the command injection challenge we already completed to rename it to image.php .

The command I used is :

Get Trevor Gaturuku’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

127.0.0.1|mv ../../hackable/uploads/image.jpeg ../../hackable/uploads/image.php

• Now, it’s time to open image.php in the browser.

• Now, we will use image.php to run the ls command and list all files.

• We have just used image.php to display files within the directory.