0

I have an arbitrary file upload vulnerability and I can put my file in any directory. Unfortunately, the serverside script appends ".jpg" ALWAYS to the end and I'm having trouble bypassing it. %00 (NULL), \, nothing seems to work. Does anyone have any ideas?

2
  • Why is the jpg extension a problem for you?
    – schroeder
    May 7, 2019 at 22:41
  • 1
    @schroeder Well if I visit the file, it is loaded as an image and the server does not process it as a .php (example).
    – user159055
    May 7, 2019 at 23:33

1 Answer 1

1

In situations like these where you have full control over where the files get output, it might be best to turn your attention towards potential LFI vulnerabilities. It's unlikely you'll bypass the extension suffix, but if you're able to get PHP code into the JPG EXIF data, you can use LFI to include that PHP.

The next suggestion I would make is to check and see if Javascript is adding the .jpg extension. If it is, just disable it and try uploading again.

Lastly, double check the request in burp and make sure that your NULL byte payload is actually getting through to server and that the filename is correctly stated in the request before you send it. It may be that when you select the file that there is an intermediary process in between that you may be able to also intercept that's adding the .jpg extension.

2
  • He does say "serverside script"
    – schroeder
    May 7, 2019 at 22:54
  • I don't think that I know everything at all. If you meant to say "... is to check and see if the serverside script is adding the .jpg extension or if it is, in fact, Javascript..." then your answer needs a clarifying edit. As written, it sounds like you did not pick up on the fact that the OP said it was server side.
    – schroeder
    Jun 7, 2019 at 7:00

You must log in to answer this question.