2

However an exercise I do not manage to resolve, I have to bypass a check of extension of a form in PHP.

It turns out that just the extension is verified, but certain special characters are replaced what makes that even by trying the following combinations, it does not work.

test.php%00.png
test.php:.png
test.php$.png

I specify, these names of files bypass well and truly the check of files. But as this one is then renamed, he returns to the state of PNG. For example, with one of the examples higher, the file is going to be renamed as follows: 556112012015test.php-.png

The purpose is relatively simple... I am supposed to send on the server a executable file PHP. But I have to admit that I do not find. I have a part of sources to use, here is :

// Censored.

This line clearly indicates that any characters other than letters, numbers and points will be replaced by a dash.

$name_file = preg_replace('/([^.a-z0-9]+)/i', '-', $name_file);

As it is an exercise, there is necessarily a way to exploit it. But I do not find..

Thanks,

Improve this question

1 Answer 1

Reset to default
0

I shouldn't really answer homework, but your upload script needs to have a very specific filename. Take a closer look at what happens if you upload a filename that already exists.

Improve this answer
1
  • Thank you , actually sent to the server that fact before inclusion, which allows us to exploit this.
    – Izidor
    Commented Jan 12, 2015 at 9:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .