[Tutorial] Exploiting an Arbitrary File Upload Vulnerability [Pics/Video]

[Tutorial] Exploiting an Arbitrary File Upload Vulnerability [Pics/Video] - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: [Tutorial] Exploiting an Arbitrary File Upload Vulnerability [Pics/Video] (/showthread.php?tid=2105707)

Pages: Pages 1 2 3 4

[Tutorial] Exploiting an Arbitrary File Upload Vulnerability [Pics/Video] - -DownFall - Jan 13, 2012

Exploiting An Arbitrary File Upload Vulnerability

An arbitrary file upload vulnerability, is a vulnerability that can be exploited by malicious users to comprimise a system. In this case, it's incorrectly validating the file extension on any uploaded file. Well....that pretty much speaks for itself. If used correctly, it can lead to shelling, executing remote code..all that good stuff.

First off, since I've been getting tons of PMs about the FireFox Add on and Theme I'm using, I'd figure I should just link them here.

FTDeepDark Theme
HackBar

Requirements
Now for this tutorial, you're going to need FireFox, and an add on called Tamper Data.

You can download it here

Once you got it installed, restart FireFox and you can get started.

Finding Vulnerabilities
Now what you're going to want to do is find a vulnerable upload form. How do you find these? A pretty common method known around here, using google dorks.

Here's the example I'll be using in this tutorial.

Code 
inurl:/upload.php intext:Image Upload

Now you can create your own, find your own, and use your own dorks.

Once you've found your site, you should be at an upload form.
It should look something like this.
Spoiler (Click to View)

Testing The Upload Form
Now try and upload your shell in regular format, to see if you'll need to continue.

Spoiler (Click to View)

Code 
Unrecognized image type

Now try and upload it in image format.
Spoiler (Click to View)
Spoiler (Click to View)

Modifying The POST Content
It worked, now we're going to go back, re upload, and modify the POST content.
Go back to your upload form, select your shell in image format, and go to Tools > Options > Tamper Data.

It should look something like this..
Spoiler (Click to View)

Now click start tamper, and upload your file.
A popup will come up and ask you if you want to continue tampering. If it's sending information about the upload form, click continue tampering and click tamper.

Spoiler (Click to View)

Now a whole new form should come up, it looks like this.
Spoiler (Click to View)

Everything on the right is where we change our file extension. That is the POST data.

Now find your filename and remove your nullbyte and spoofed extension. Here's an example of what it should be changed to.

Code 
WSO.php%00.jpg

Code 
WSO.php

Spoiler (Click to View)
Spoiler (Click to View)

Now click OK, and your file should upload. Now all you have to do is find your shell, sometimes you can right click it (if it's a broken image), other times it'll be in the page source. This will work with several different upload forms, inside administrator panels, and other things as well. Hope you guys understand, good luck and happy hacking. Shoutout to Zer0Lulz!

Resources

Test Site - This site will get raped by everyone anyways....
Shell Pack (Image Format) || Virus Scan
Tamper Data

Video

Sorry, I had to re-do the video around 5 times, and it got annoying, so I skipped the text in notepad and just showed you what happens in action. It's here if you want to read it. My Camtasia studio ran out too, that explains the quality.

Code 
Today I'm gonna be showing you how to get your shell uploaded via exploting an arbitrary file upload vulnerability. Once you found your vulnerable form, try uploading your shell in PHP format..

"Unrecognized image type".

As you can see, it filters PHP image uploads. That doesn't mean we cant shell it though :3

Now we want to try and upload it in it's image format.

No error this time, it worked fine! Of course the shell won't work like this, but we're only 1 step away.

Go back to your upload form, and go to tools > options > tamper data.

Now select your shell in image format again. Now start tamper, and upload your shell.

this is where we change our file extension, in the POST_DATA field.

Remove your nullbyte and file extension, and leave .php on there.

Click OK, and let it do it's work.

Uploaded our shell, just like that. Lets check if it worked...

Woot!

If you liked the video, comment/rate/sub!

Peace.

* - ProN0ob - Jan 13, 2012

Good job.

A little question : Can this work on any forum/website with image uploader or just using the specified dork?

Thanks

* - BeggFoMercy - Jan 13, 2012

nice TUT mate keep up the good work ... xD!

* - -DownFall - Jan 13, 2012

(Jan 13, 2012 01:55 AM)ProN0ob Wrote: Good job.

A little question : Can this work on any forum/website with image uploader or just using the specified dork?

Thanks

It all depends. I've came across about 10 forums with that dork and it never worked. There's really no signs that tell you if you'll be successful or not, you just try it out and see how it works for you.

* - .Satan - Jan 13, 2012

I love your tutorials! keep up the amazing work bro, forums usally have protection against that kind of stuff but some stuff like free image upload scripts im pretty sure wouldnt

* - -DownFall - Jan 13, 2012

(Jan 13, 2012 02:03 AM)Snow Wrote: I love your tutorials! keep up the amazing work bro, forums usally have protection against that kind of stuff but some stuff like free image upload scripts im pretty sure wouldnt

Thanks for the feedback, it's the appreciative users like you that I make tuts for. Odds are of this working on a forum are small. Though I DID shell around 8 sites in an hour doing this, with that dork alone. Sorry about the video quality, I tried about 5 screen recorders before I gave up and used that crappy one. Added this to my mega-thread too, and fixed the images.
Anything else I should add?

* - Dead_Code - Jan 13, 2012

nice and good work for you .... (^_^)/

* - .Satan - Jan 13, 2012

Here are some more dorks for everyone, Downfall you can add these to the main post if you would like

"Powered By JAKCMS"
inurl:"wp-content/plugins/1-flash-gallery"
inurl:"user/auth/forgot"
"Powered By Digitalus cms"

There are alot more but i dont want to search through every Exploit
http://www.exploit-db.com/search/?action=search&filter_page=1&filter_description=&filter_exploit_text=Arbitrary+File+Upload&filter_author=&filter_platform=0&filter_type=0&filter_lang_id=0&filter_port=&filter_osvdb=&filter_cve=

* - -DownFall - Jan 13, 2012

(Jan 13, 2012 02:30 AM)Snow Wrote: Here are some more dorks for everyone, Downfall you can add these to the main post if you would like

"Powered By JAKCMS"
inurl:"wp-content/plugins/1-flash-gallery"
inurl:"user/auth/forgot"
"Powered By Digitalus cms"

There are alot more but i dont want to search through every Exploit
http://www.exploit-db.com/search/?action=search&filter_page=1&filter_description=&filter_exploit_text=Arbitrary+File+Upload&filter_author=&filter_platform=0&filter_type=0&filter_lang_id=0&filter_port=&filter_osvdb=&filter_cve=

Thanks, these are just a few examples, there's no limit to creativity :3

* - HaxOr❤ - Jan 13, 2012

I always jizz on your tutorials.
Nice job mate. :)

* - Sql Ruined My life - Jan 13, 2012

<3 you DOWNFALL ,,Great As always.. Your tutorials are SO great And awesome. I had a Newfolder in my PC "DOWNFALL'S TUTORIALS" where all your tutorials are saved 😝 ,,loved each and every tutorial of yours ✌

* - Prominent - Jan 13, 2012

I jizzed a hundred times more than haxor on this one.

* - NaKitiMijasiด้้้้้็็็็็้้ - Jan 13, 2012

nice TUT mate keep up the good work ... xD!

* - Hooded Robin - Jan 13, 2012

Another nice tutroial DownFall, great share!

PS - My camtasia died too, but im working on finding a way to wipe registry clean so we can re-install will let you know if I get it working properly...

* - -DownFall - Jan 13, 2012

Thanks for all the feedback everyone! If you find a way to get our trials working again hit me up ^^