OK, so the next vulnerability that we're going to get into for Web applications is actually malicious,
followable vulnerabilities.
So when an application accepts file uploads, it may allow us to remotely execute code on that server.
So depending on what checks the application actually does, we may be able to upload a malicious payload,
which is just malicious code that does that excuse commands for us and probably connects back to our
computer or something.
We'll be able to actually up that, upload that to the server and then execute it by browsing through
Internet browsing so we can use this, for example, to create a way to execute shell commands remotely.
So let's go ahead and try to check out how we can potentially take advantage of malicious volleyball's.
OK, so what?
The file, upload screen.
So just in Devoir, click on upload.
So it says choose an image to upload, then we can click on here and we can browse and find a file.
Then we clicked the upload button.
So let's actually look at the source code just so we can have an idea of, you know, what's going on.
So it makes a post request and it's looking for this upload to be set and you're OK.
So right here, this sets where the file is going to get uploaded to.
So we know that is going to be in the root directory for the database server and then it's going to
be in this hackable folder.
And then also this uploads folder.
That's where the files will be at.
And then whatever the name that's passed in with, the files are going to be set at the name and pretty
much what to saying right here.
This is what is going to say.
Look at the file was unable to be uploaded there, attending.
That is the image.
But we're not really going to upload an image.
And then also right here, this is what we're going to see if we actually successfully upload.
So let's go ahead and exit back out and start to think about what we can do.
So the source code doesn't really look to see if an image file is being uploaded so we can upload everyone.
We know that PSP is operating on the back of the server so we can make a script.
So what we can do is actually clear this out.
So what we can do I have a file that I created is called It Showed Up.
So we get showed.
There we go.
So it's a very, very simple script.
And this is it's just going to be one thing.
It's just going to grab, you know, a command line, pretty much going to grab a show.
So this prescript start, as you've seen since we've been looking at source code for Vista, it starts
with the less than Arrow questionmark and ends with the question mark.
Any greater than symbol are you?
Code goes in between.
So all we're doing is the system we're call the system function and then it's going to get which actually
this will spawn a shell and then it's going to do it and get request and look for what's set ACMD.
So what we can do is actually upload this file and then browse to it in a browser because we know where
it's being uploaded to and then we can actually pass in, you know, a command for CNBC.
So let's go ahead and try that out so we can go over here.
So let's just say Browse already have the shell files.
So get so there we go.
So I can upload.
Now it says, OK, it's uploaded successfully.
So what we can do is actually browse to it.
So let's just do it right here.
So do back out right here.
Where is the directory as we know from the source code and then it's going to be hackable slash uploads
and then slash and get shell PSP.
If we just hit enter is just saying, like I cannot execute a blank command.
So we know that is actually, you know, looking for a come in.
So what we can do is try to pass in a command.
So the way that we're going to do that, as you've seen with the URLs, will have to be followed.
And I have a question mark and then we can start to pass in, you know, different variables and such.
So we're going to do ACMD.
Let's do however, as you see right here.
So can you hear me?
And then it's always with a W w dash data user.
So what we can also do is just different stuff we can do.
Who am I?
We could do you know, let's see what's in this folder right now.
We do a present working directory, so we have pretty much access to whatever we want on this system
because not doing the.
Correct checks, so now let's go back and since we know how to do that, you can imagine what we can
do with that vulnerability right there.
So let's crank it up to medium and actually medium difficulty and actually see what we can do.
So we're going to go over to divi security, the medium we're going to hit submit, and then we'll go
back over here and let's try this out, OK?
So for the medium difficulty, follow upload winnability.
What we can do is let's look at the source code and see what's different.
So this time is looking for a name, is looking for and type in a size.
And it's saying, hey, the type of father we upload is is an image or a jpeg and upload size less than
this amount.
We're going to allow it to be uploaded.
Otherwise it's going to give this message.
An image was not uploaded.
So what we need to do is tricky into thinking that our profile is an image and we can do that with berp.
So let's go ahead and try that out.
So let's get out of here.
Let's turn on our proxy.
Let's go over to Bird, make sure that interceptor is on.
So on the proxy intercept intercept is on.
So now all we need to do one more thing that I did just to show that we're doing something different.
So I made another file, which is a copy of the same file.
It's called Get Another Shot, the same exact stuff, same exact just one line of people.
So we're going to use that file.
So let's go ahead and browse.
Let's just get the shot at P and let's hit upload.
So now it pulls up over and burped so we can modify this before it's enough.
So instead of modifying up here, we're going to modify actually down here where this constant site
application.
So we're going to change this to image slash jpeg.
And now what this is wants to do is make the request.
Crewmembers say, hey, this is an image file and it's not really doing a check to make sure that it
is.
So we have forward that allows the request to go.
We go back to the Web browser, hey, successfully upload it so now we can browse to so divi w a slash
hackable.
I don't want to send a proxy offers to us.
It's going to stop it.
Solice slash hackable slash uploads slash get another show hp.
So the see it gives the same blank command issue.
So let's do questionmark.
CFD equals ellis' you know.
So there we go.
Now we see what now we, we see that we have a shell and we can see the different actually files that
are in the directory right now is pretty neat.
And that's how you would circumvent, you know, like a check for like just the filicide.
OK, so let's take this up one more level.
So let's go to security, bump it up to high hit submit and let's go back over to upload to see how
the code is changed and see what we're going to have to do to circumvent it now.
So the difference pretty much here is that it's going to be looking for a file extension.
So it's going to look for something like jpeg jpg, any form of J-P jpg or JPEG in the same upload size.
So we don't have an issue with upload size part, we just have an issue with the extension because let's
go back and if we try to just upload our shell file upload, it's not going to upload.
Your image is not uploaded because it does not the image based on, you know, the extension.
So this was actually pretty simple.
And you can see actually I've already done it in my directory.
You can do it as well.
Let's go to the camera during the quake.
So let's just make a copy of get show up and let's just call it show that that jpg.
So just by doing this is going to make the application think that is a JPEG file, but it's still going
to execute as a PDF file when we browse to it.
So let's go ahead and try to upload this browse, you see, get show speed jpg.
So let's go ahead and try to get this in here, upload a successfully upload it because it's passed
the extension check.
So now it is actually browse through it and let's test to see if it works so hackable.
Did you do the.
Slash uploads, slash, get show that p g and let's just do this right here, Sandy Exubera and as you
can see, it actually went ahead and executed.
So even though it has that jpg extension on it, it's still thinks it's a free file.
So that's the way that you can also bypass, you know, if it's doing an extension check.