1

I'm testing a particular vulnerability box since yesterday and I came with one rather strange problem that I didn't expect. Lets say a vulnerable web-application offer image file upload.

The image actually doesn't have to be image, the back-end accept any file exstension. The problem is, same back-end always returns *.jpg so instead of uploaded evil.php script, you come up with random_number.jpg.

Of course, the first thing I've tried is getting the served response, which in this case is base64-encoded image data.

Looking further, I've found that the application returns binary/octet-stream as a Content-type response header which means when I try to access the URL http://localhost/vulnbox/uploaded/random_num.jpg, the browser opens file download message. The actual file is returned as binary, ready to be downloaded, yet looking into the file, I see that the code stays in.

Is there a way I can force response of Content-type to any other and get actual evil script ran?

Improve this question
3
  • You can set the Accept header to text/html as part of the content negotiation. Whether the server will actually reply differently depends on its configuration, though.
    – Arminius
    Jan 16, 2016 at 0:52
  • Additionally, some kinds of data retrieval requests let you specify a content type. This is usually done for data that can be represented in multiple ways - as JSON or XML, for example - and your web app may not even have a parameter like that anywhere, but it's worth looking for one. It'll usually be a URL query string parameter, something like format=xml or similar. If that works, you can probably XSS the site by uploading HTML and then requesting it with the parameter set to give it to you as XML.
    – CBHacking
    Jan 16, 2016 at 8:15
  • Oooh, another possibility: Flash applets! Flashplayer has a number of questionable security decisions in it. Among these: an applet has privileged access to the site it was loaded from (it can make requests to that domain, with cookies, and see responses, without a crossdomain.xml or similar). Also, you can make Flashplayer ignore the Content-Type header of the server response, so long as the server doesn't also set Content-Type-Options: nosniff (maybe X- prefixed). Upload a malicious SWF, load another site with <object type="application/x-shockwave-flash" data="*uploadurl*" />
    – CBHacking
    Jan 16, 2016 at 8:21

1 Answer 1

Reset to default
2

I assume you want to know if there is a way to execute the uploaded PHP file. Short Answer: No

Long Anwser: As long as the web server is configured correctly only .php files gets executed as PHP. Most web servers will return as content type always the mime type derived from the file extension. The content itself of the HTTP response is typically the content of the file. For example Apache2 will return you the content type 'image/jpg' and the plain text of the PHP file.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .