-3

I have found an endpoint on a website that allow me to upload files. This endpoint didn't have any kind of protection against malicious file upload. So, I uploaded a PHP shell, but the problem is when I visit the uploaded file link, I get download box!

I tried to upload files with .html, .php and .svg but I can't make those files executed on the server. I just get a box asking me to download the file. Just the images extensions are executed like .png and .jpeg.

Is there any way to execute the PHP shell on this server? Because they didn't have any kind of protection on this endpoint, I can upload any malicious file.

closed as off-topic by Conor Mancone, symcbean, David, schroeder Jan 17 '18 at 23:00

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions asking us to break the security of a specific system for you are off-topic unless they demonstrate an understanding of the concepts involved and clearly identify a specific problem." – Conor Mancone, symcbean, David, schroeder
If this question can be reworded to fit the rules in the help center, please edit the question.

3

Is there any way to execute the PHP shell on this server?

Probably not. For that to happend, the server has to have a PHP engine installed and be configured to respond to request for PHP files by executing them. That doesn't seem to be the case here.

So my guess it that either PHP isn't installed, or it's configured not to run in the upload folder.

Not the answer you're looking for? Browse other questions tagged or ask your own question.