Using Executable Files
In this section we will review a file upload vulnerability
that enables us to upload files to be run by the web server.
As with Directory Traversal and File Inclusion vulnerabilities,
we should understand how to identify File Upload vulnerabilities.
Depending on the web application and its usage,
we can make educated guesses to locate upload mechanisms.
If the web application is a Content Management System,
we can often upload an avatar for our profile
or create blog posts and web pages with attached files.
If our target is a company website,
we can often find upload mechanisms in career sections
or company-specific use cases.
For example, if the target website belongs to a lawyer’s office,
there may be an upload mechanism for case files.
Sometimes the file upload mechanisms are not obvious to users,
so we should never skip the enumeration phase
when working with a web application.
In this example, we will abuse a file upload mechanism
to achieve code execution and obtain a reverse shell.
Let’s review the “Mountain Desserts” web application on the MOUNTAIN VM.
In the new version of the “Mountain Desserts” app,
the Admin link has been replaced by an upload form.
The text explains that we can upload a picture to win a contest.
The tab bar also shows an XAMPP icon displayed in the current tab,
indicating the web application is likely running the XAMPP stack.
The text explains that the company wanted to switch to Windows,
so we can assume that the web application is now running on a Windows system.
Let’s find out if we can upload a text file instead of an image.
Let’s upload the test file to the web application
via the upload form in the browser.
We successfully uploaded our text file,
so we know that the upload mechanism is not limited to images only.
Next, let’s attempt to upload the simple-backdoor.php webshell
used in the previous Learning Unit.
The web application blocked our upload,
stating that PHP files are not allowed
and files with PHP file extensions are blacklisted.
Since we don’t know exactly how the filter is implemented,
we’ll use a trial-and-error approach to find ways to bypass it.
One method to bypass this filter is to change the file extension
to a less-commonly used PHP file extension such as .phps or .php7.
This may allow us to bypass simple filters
that only check for the most common file extensions, .php and .phtml.
These alternative file extensions were mostly used
for older versions of PHP or specific use cases,
but are still supported for compatibility in modern PHP versions.
Another way we can bypass the filter
is by changing characters in the file extension to upper case.
The blacklist may be implemented
by comparing the file extension of the uploaded file
to a list of strings containing only lower-case PHP file extensions.
If so, we can update the uploaded file extension
with upper-case characters to bypass the filter.
Let’s try the second method, updating our backdoor file extension.
After renaming the file, we’ll upload it via the web form.
This small change allowed us to bypass the filter and upload the file.
Let’s confirm if we can use it to execute code as we did in the RFI section.
The output shows that our file was uploaded to the “uploads” directory.
The output confirms we can now execute commands on the target system.
Although this bypass was quick and basic,
these kinds of bypasses are often highly effective.
Let’s wrap up this section by obtaining a reverse shell from the target machine.
We’ll start a Netcat listener in a new terminal
to catch the incoming reverse shell on port 80.
Let’s use a PowerShell one-liner for our reverse shell.
Since there are several special characters in the reverse shell one-liner,
we’ll encode the string with base64.
We’ll use PowerShell on our Kali machine to do the encoding.
First, let’s create the variable $Text,
which will be used for storing the reverse shell one-liner as a string.
Then, we can use the convert method
and the Unicode property from the Encoding class
to encode the contents of the $Text variable.
The $EncodedText variable contains the encoded reverse shell one-liner.
Let’s use curl to execute the encoded one-liner via the uploaded backdoor.
We can add the base64 encoded string for the powershell command
using the -enc parameter.
We’ll also need to use URL encoding for the spaces.
After executing the command,
we should receive an incoming reverse shell
in the terminal where Netcat is listening.
We received a reverse shell through the base64 encoded reverse shell one-liner.
Great!
In this section, we have demonstrated
how to abuse a file upload mechanism in a PHP web application.
We achieved code execution by uploading a web shell from our Kali system.