Right so now that we managed to upload a file to the target computer using the low security level let's
see if we can do it if we increase the security of the Target Web site.
So I'm going to exit out of this and I'm going to go to my burnable Web.
Let's go to the security settings and add this before it was set to load.
So I set it there to medium.
Then click on submit and now the security level is medium.
So let's go back to our file upload and try to upload our show right here the same shot that we uploaded
before.
And I'm going to click on upload the exact same way.
And as you can see it say your image was not uploaded and it's complaining about the headers.
Let's see if we can upload an image so let's just make sure that the program didn't break and we can
still upload images.
So I'm just going to upload the same image again the camera image and I'm going to upload.
And as you can see you we can upload images but we cannot upload BHP files.
So obviously now the target is more secure.
And now we're approaching this from a black box point of view so we don't have the source code to see
what's happening.
So there's a number of ways that you can filter the files uploaded.
One method is to check if the file is an image to check the file type.
If it's an image then upload it.
Otherwise don't do that.
If that's the way that they're doing it then we can bypass that.
So let's see how we can do that first.
The file is being uploaded using a post method so to modify the post for amateurs we're going to use
virtus.
I'm going to click on purpose with your.
So we're going to go on the proxy site and proxy up and before we can use this we just need to set up
our browser to use purposes.
I'm going to click OK.
And now everything I do on this browser right here will be sent through verb proxy.
So we're going to do is we're going to modify our file right here the shadows BHB.
And because we can upload Jaypee images I'm going to rename this file and I'm going to call a shell
that GBG.
Now obviously if I upload this file this way it's not going to work because it has AJP and not a PH
B extension.
So the target's computer or the target server.
When I try to run it it's all just right around as an image and I want to be able to execute the code
that I want to so we're going to upload that as an image first and then we're going to intercept it
in burp soothe and convert its extension to BHB to bypass the filter.
Let me do it and it'll become more clear.
So I'm going to click on that UPDF upload it.
Now this uploads has been intercepted in here.
And let's see what happens.
So you can see that the file is being uploaded.
The content type is trying to be image that jpeg and the image of the GBG.
Now what we're going to do is we're going to modify that and said this to Peachtree and we're going
to leave the Content-Type to image.
This will allow us to bypass the filter and it will store our file as Shellback ph.
We now just to make sure that this is not going to overwrite the old shell and you'll think that nothing
got uploaded.
I'm going to call it Scheldt to do it.
BHB.
So that's it.
I'm going to forward this packet.
And as you can see now we get a message Salian.
Now the file has been uploaded and it's called shell to those BHB.
Now if we go back to our terminal and use the same as you are using before because it's the same shell
same password I'm just going to call a shell to the THP and try to communicate with it.
I'm going to hit enter and as you can see now I managed to connect to the target computer or to the
target server and I managed to upload my show by intercepting the packet and changing the file name
from J.P. g to PH B.