I am currently working on webapp pentest where I discovered a nice little Unrestricted File Upload
vulnerability. The only (and big) problem is that I am unable to escalate this to a fully working remote web shell yet.
Basically, I am able to upload whatever content I want on the server (using the change Avatar picture feature
). Important point, the uploaded file is stored at whatever.com/something/avatar/2
.
It appears that the underlying technology is an Apache server running on CentOS and a JBoss servlet.
I tried to upload a JSP reverse shell which did not work I then read that for JBoss servlets war files should be used to deploye webpages also war files should be put into a specific /deploy
folder. My issue here is that when I upload a file it always end up to be store at whatever.com/something/avatar/2
.
Anyone has some suggestions which could help me to get a reverse web shell?
EDIT1:
When uploading a file I have to set Content-type
to image/jpeg
but the extension of the file can be set to whatever I want, so obviously, the only check is done on the Content-type
.
EDIT2:
Request/response to upload a file:
POST /something/profile/upload HTTP/1.1
Host: HOST
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:50.0) Gecko/20100101 Firefox/50.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-GB,en;q=0.5
Referer: REFERER
Cookie: JSESSIONID=COOKIE
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Content-Type: multipart/form-data; boundary=---------------------------18769807824524
Content-Length: 1541
-----------------------------18769807824524
Content-Disposition: form-data; name="email"
[email protected]
-----------------------------18769807824524
Content-Disposition: form-data; name="avatarImageUpload"; filename="cmd.war"
Content-Type: image/jpeg
Hello world
HTTP/1.1 200 OK
Date: Mon, 16 Jan 2017 17:26:12 GMT
Content-Type: text/html;charset=ISO-8859-1
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Length: 54
{"success":true,"fileUrl":"/something/profile/avatar/2"}
Request/response when accessing the uploaded file -- to properly display the response in the browser I just have to tamper with the returned Content-type
header:
GET /something/profile/avatar/2 HTTP/1.1
Host: HOST
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:50.0) Gecko/20100101 Firefox/50.0
Accept: */*
Accept-Language: en-GB,en;q=0.5
Referer: REFERER
Cookie: JSESSIONID=COOKIE
Connection: keep-alive
HTTP/1.1 200 OK
Date: Tue, 17 Jan 2017 09:18:34 GMT
Content-Type: image/jpeg
Content-Length: 11
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Hello world