On this page
Web Shell Upload via Path Traversal
Lab
Web shell upload via path traversal · Apprentice
Solution
Given
This lab contains a vulnerable image upload function. The server is configured
to prevent execution of user-supplied files, but this restriction can be
bypassed by exploiting a secondary vulnerability.
To solve the lab, upload a basic PHP web shell and use it to exfiltrate the
contents of the file /home/carlos/secret. Submit this secret using the button
provided in the lab banner.
You can log in to your own account using the following credentials: wiener:peter
Analysis and recon
Same idea as the previous lab. This time we need path traversal techniques to push the file into a directory where our shell will actually execute.
Upload a file via the site. Uploaded — open it, and it just shows up as plain text.
Okay, let's try uploading one level up:
Content-Disposition: form-data; name="avatar"; filename="../shell.php"
Server says it went to the previous location anyway. Right, let's try encoding:
Content-Disposition: form-data; name="avatar"; filename="%2e%2e%2fshell.php"
The file avatars/../shell.php has been uploaded
Worked!
FU2yHUj75eKOuqf4Zp5L9CLf6N96aTDH
Lab solved!
More in this category
Arbitrary Object Injection in PHP (PortSwigger Lab)
Recovering leaked source code and injecting a serialized CustomTemplate object whose __destruct deletes an arbitrary file.
Using Application Functionality to Exploit Insecure Deserialization (PortSwigger Lab)
Tampering with the `avatar_link` field in the session object to delete an arbitrary file via the account-delete feature.
Modifying Serialized Data Types (PortSwigger Lab)
Abusing PHP loose comparison by changing the `access_token` type to integer `0` to bypass authentication.