Web shell upload via path traversal
This lab contains a vulnerable image upload function. The server is configured to prevent execution of user-supplied files, but this restriction can be bypassed by exploiting a secondary vulnerability.
Upon logging in, I decided to explore the image upload functionality. After successfully uploading an image as my avatar, I observed in Burp's Proxy > HTTP history that the image was fetched using a GET request to /files/avatars/<YOUR-IMAGE>. I sent this request to Burp Repeater for further examination.
Next, I created a PHP script named exploit.php on my system, designed to fetch the contents of Carlos's secret:
Surprisingly, the website allowed the upload of PHP files as avatars. In Burp Repeater, I replaced the image file name with exploit.php in the GET request to /files/avatars/<YOUR-IMAGE>. However, the server returned the PHP file's contents as plain text instead of executing the script.
To bypass this limitation, I located the POST /my-account/avatar request responsible for the file upload in Burp's proxy history. In the request body, under the Content-Disposition header, I changed the filename to include a directory traversal sequence:
Although the server seemed to strip the directory traversal sequence, I obfuscated it by URL encoding the forward slash (/) character:
Sending the request confirmed that the server was URL decoding the file name, as the response now indicated: "The file avatars/../exploit.php has been uploaded."
Returning to my account page, I revisited Burp's proxy history to find the GET /files/avatars/..%2fexploit.php request. It revealed Carlos's secret in the response, indicating that the file was uploaded to a higher directory in the filesystem hierarchy (/files) and executed by the server. Additionally, this meant I could request the file using GET /files/exploit.php.
Finally, I submitted Carlos's secret to successfully solve the lab.
Last updated