I have an arbitrary file upload vulnerability and I can put my file in any directory. Unfortunately, the serverside script appends ".jpg" ALWAYS to the end and I'm having trouble bypassing it. %00 (NULL), \, nothing seems to work. Does anyone have any ideas?

  • Why is the jpg extension a problem for you? – schroeder May 7 '19 at 22:41
  • 1
    @schroeder Well if I visit the file, it is loaded as an image and the server does not process it as a .php (example). – Bill Richard May 7 '19 at 23:33

In situations like these where you have full control over where the files get output, it might be best to turn your attention towards potential LFI vulnerabilities. It's unlikely you'll bypass the extension suffix, but if you're able to get PHP code into the JPG EXIF data, you can use LFI to include that PHP.

The next suggestion I would make is to check and see if Javascript is adding the .jpg extension. If it is, just disable it and try uploading again.

Lastly, double check the request in burp and make sure that your NULL byte payload is actually getting through to server and that the filename is correctly stated in the request before you send it. It may be that when you select the file that there is an intermediary process in between that you may be able to also intercept that's adding the .jpg extension.

  • He does say "serverside script" – schroeder May 7 '19 at 22:54
  • I don't think that I know everything at all. If you meant to say "... is to check and see if the serverside script is adding the .jpg extension or if it is, in fact, Javascript..." then your answer needs a clarifying edit. As written, it sounds like you did not pick up on the fact that the OP said it was server side. – schroeder Jun 7 '19 at 7:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.