1

I was trying to reproduce this vulnerability:
https://www.exploit-db.com/exploits/49294

According to the explanation, it is possible to bypass a check in a Wordpress plugin by appending a special char after php extension.

I was trying the attack, and the file is uploaded with the name shell.php<special_char> containing a simple php code <?php echo "poc"; ?>.

Then I should navigate the shell in <target>/..../shell.php<special_char> and the source code should be executed.

But how can I exploit this? PHP interpreter observes that the extension is different from php (it is php+special_char), so it does not execute the code, it just prints the source text.

In which cases is it possible to exploit a vulnerability that allows uploading files with php extension containing a special character in the end?

Improve this question
2
  • 1
    I'm puzzled too. It doesn't even look like a vulnerability. Also, take a look at this: wordfence.com/blog/2020/12/… – reed Dec 22 '20 at 23:48
  • @reed it all depends on the intent of the filter in the first place. – schroeder♦ Dec 23 '20 at 8:03
0

Uploading the file is like loading a gun. You have the conditions for harm, but nothing is harmed yet.

If there was another vulnerability or some other access that would allow you to strip that extra character, then you can trigger the code in the file.

Not all vulnerabilities mean that you instantly have access to everything. Just as technology is a stack, so are vulnerabilities. Weaknesses and vulnerabilities in each layer of the stack must exist for harm to occur.

This vulnerability appears limited to just one small part: being able to upload a "loaded gun". Now you need to figure out how to pull the trigger.

Improve this answer
6
  • Are you agree with me that the provided exploit does not contain all the information to exploit the vulnerability? According to it, I should be able to exploit it by just uploading the file containing the special char at the end. – gx1 Dec 22 '20 at 15:59
  • You have misunderstood. The vulnerability is the ability to upload. That's it. Not all vulnerabilities mean that you instantly have access to everything. – schroeder♦ Dec 22 '20 at 16:32
  • The explanation never said that you could run the PHP file without needing to do some other thing, too. – schroeder♦ Dec 22 '20 at 16:34
  • I don't understand. What's the vulnerability? PHP code could be included anywhere, even inside an image, but that doesn't mean you can execute it. Look at this: "rm -rf ~/Desktop/". I have included a bash script in my comment, yet this is not a "loaded gun". The point is, it looks like you can upload a .php<weird-char> file, not a .php file, and I don't think you can ever execute the former. – reed Dec 22 '20 at 23:46
  • Ok, let's check a few things: can you execute shell.php after uploading shell.php<special_char>? And what is wordfence only supposed to allow for uploads? – schroeder♦ Dec 23 '20 at 8:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.