1

I've found an application that allows arbitrary file upload (client side validation on file extensions), however those files are not stored in a folder which is accessible by the webserver, so a web shell is not possible.

However, due to detailed debug output provided by the webserver the file upload function simply passes the file's path (with a new randomized name, but the same file extension) directly to a command argument. This gave me the idea of command injection. The command fails usually to a file not found error (because my command payload is in the file extension, as they rename the file randomly and keep the extension and file content).

Because the command is being run via cmd.exe in the backend, I wanted to use || in the file extension to tell the shell to run the next command after the file not found error.

The only issue is windows doesn't allow storage of || in a file name, and also when I try to include || in the file name/extension,the website does not allow you to proceed any further (guessing server side blacklist or error due to unsupported characters).

The character & works fine, except since the file is never found, there is never a success and the shell exits because && only runs the next command if the previous command ran successfully.

Due to the way the application parses the supplied filename, the payload must be in the file extension, and cannot contain any . characters.

Is there any other way I can get my command to run without using ||? I've tried using URL encoding but it stores the encoded text in the file name.

1 Answer 1

1

Just use a single & so the commands aren't conditionally stacked.

Lets imagine the command is copy sourcefile destination.txt where you control sourcefile.

if you named your file hax && whoami &&.txt then as you say it's conditional and will not execute:

copy hax && whoami &&.txt destination.txt
The system cannot find the file specified.

Whereas using hax & whoami &.txt will execute:

copy hax & whoami &.txt destination.txt
The system cannot find the file specified.
domain\user
'.txt' is not recognized as an internal or external command,
operable program or batch file. 

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.