Web shell upload via obfuscated file extension

This lab contains a vulnerable image upload function. Certain file extensions are blacklisted, but this defense can be bypassed using a classic obfuscation technique.

Upon logging in, I initiated the lab by uploading an image as my avatar and returned to my account page. Leveraging Burp, I observed that the image was fetched through a GET request to /files/avatars/<YOUR-IMAGE>. I directed this request to Burp Repeater for further analysis.

Next, I created a file named exploit.php, housing a script to fetch the contents of Carlos's secret:

<?php echo file_get_contents('/home/carlos/secret'); ?>

Attempting to upload this script as my avatar proved unsuccessful, as the platform only allowed JPG and PNG files. I then located the POST /my-account/avatar request in Burp's proxy history and transferred it to Burp Repeater.

In Burp Repeater, within the POST /my-account/avatar tab, I modified the Content-Disposition header. I changed the filename parameter to include a URL-encoded null byte followed by the .jpg extension:

filename="exploit.php%00.jpg"

Upon sending the request, I confirmed the successful upload, noticing that the message referred to the file as exploit.php, indicating the removal of the null byte and .jpg extension.

Switching to the other Repeater tab, featuring the GET /files/avatars/<YOUR-IMAGE> request, I replaced the image file name with exploit.php. This action resulted in the retrieval of Carlos's secret in the response.

To complete the lab, I submitted Carlos's secret.