Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I uploaded a PHP web shell to a site, and to bypass the file upload restriction, I used a .php.jpg extension.
When I open my shell with a web browser, it doesn't execute (confirmed with a packet capture) but when I open it with curl, it returns my php web shell source code!
Where is the problem?
You get the file contents in curl because you are accessing the file directly without the server executing the contents.
You are not getting the shell in the browser because the PHP server is trying to show you a jpeg file that isn't a jpeg file.
It's not working because the server is not vulnerable to this problem...
Just because you can upload a file does not mean that the server will do what you want with it. It will handle the file based on its own rules.
Any reasonably configured server will not execute .jpg files as PHP when accessed directly*.
This includes default configurations for common servers like Apache or nginx. A server would need to be specifically configured to parse non-PHP file extensions as PHP. From your description, this isn't the case here (the file is correctly handled as image file).
I'm not saying that the application isn't vulnerable, but allowing .php.jpg files to be uploaded is a valid practice. To bypass a file upload restriction, you'd want your file to for example end in .php (or related extensions which will be executed as PHP).
* they will be executed regardless of extension if they are for example included via include, but in that case it doesn't matter if the file ends in .php.jpg or just .jpg - or if the content (type) is validated for that matter.
