Imagine a scenario that we are able to upload a PHP file on the server. However, we are not aware of the uploading path. I simply mean that, we are able to upload the file but we don't know where it would be stored after uploading. Is it possible to get the file path after the PHP script is uploaded? Somehow making the uploaded script to inform us about its location? I know the question sounds weird. But I was thinking of a capability in PHP in which makes the script to run automatically right after it has been uploaded so for example it can send us an email letting us know about the upload path. Another form of asking such question would be, is it possible to find out about the uploaded file path at all by just uploading PHP or Python script? Although I prefer PHP, there might be solutions in other languages which are supported by server side.
P.S.
If none of the above ideas work, is not it possible to know the upload destination path by any means?
-
The script would only be able to run automatically right after it has been uploaded if the server contains a remote file inclusion vulnerability that you can exploit. Normally, the server should not try to run uploaded files.– tlng05Commented May 29, 2015 at 17:19
-
@user54791 So it is not possible to know the upload destination path by any means?– FreeMindCommented May 29, 2015 at 17:21
-
There may be other ways I'm not aware of, but assuming that the website does not have any exploitable vulnerabilities and the server is properly secured, there should be no way for regular users to know for sure where the files are being stored. If users can access files after uploading through a URL, the URL may provide some hints, but it can also mislead you if the website uses URL rewrite rules.– tlng05Commented May 29, 2015 at 17:26
-
@user54791 No, my whole problem is I don't know where the PHP file will be stored after that scenario. If I had known that I wouldn't have asked this question, since it's the point of the topic.– FreeMindCommented May 29, 2015 at 17:38
-
In that case I'd say no - there is no guaranteed way to know where a file is stored after uploading.– tlng05Commented May 29, 2015 at 17:43
2 Answers
The destination a file is saved to is completely dependent on the application. Even if you could guarantee that a file you uploaded was executed, the file could be stored in a chroot environment and not know its actual location. That said, you may be able to determine the path for a particular application.
- The server will often tell you the path it uploaded to. For example, if you upload an image, find a webpage that contains that new image and find its url. It may be RESTful and not a direct file reference, but its a good place to start.
- Look at the source code of the application. If you are looking at an open source application, go look up its source code to see where it stores files. For example, wordpress typically stores files in
./wp-includes/uploads/<date>/file. Determining this for one wordpress site can tip you off too multiple sites. - Try to create error messages. If you can crash the app and force an error message, you may be given information about where files are stored. Some things to help with this would be to include filenames either too long or contain invalid characters for a particular filesystem.
- Attempt directory traversal attacks. If you can find a base reference to a known file such as /etc/passwd, you can start guessing other filenames and paths. This is made very easy if the application allows globs for filenames.
- Check the robots.txt file. Some applications tend to restrict robots from crawling user uploaded content, so be sure to check the
/robots.txtfile for unusual entries. - Try a program like dirbuster. Note: dirbuster is super noisy and process intensive for the server.
- Reference an image on a webserver you control, and check referrer headers. This can leak the URL of the page being executed. Note: for HTTPS sites, you'll need a HTTPS website.
this all depends on the handler at the server end. This handler will normally receive details about the file uploaded - usually a filename, path to the temporary file location where the server has placed the file and the number of bytes in the file. The handler will then use this information to process the file in some way. for example, it might move the file to a specific location, modify access permissions etc.
This handler also normally returns something to the client to let it know the upload has succeeded or not. It can add other information as well, such as the final location of the file. So, in principal, yes, you can do what your asking. The response from the server could include details of the file location, the handler could send an email to someone informing them of the file upload etc. However, there are a few things which may complicate matters.
The server might be running in a chroot environment where the file paths etc are relative to that environment, the server may have restricitons on what handlers are allowed to do with files or the level of interaction allowed at the OS/Filesystem level etc.
The idea of allowing a client to upload a file which the handler accepts and installs so that it is now served by the web server as new content is a high risk proposition. You would need a lot of controls in place to protect the system. Many of these controls could already be in place, which may make implementation more difficult than you first anticipate.
