I've found an application that allows arbitrary file upload (client side validation on file extensions), however those files are not stored in a folder which is accessible by the webserver, so a web shell is not possible.
However, due to detailed debug output provided by the webserver the file upload function simply passes the file's path (with a new randomized name, but the same file extension) directly to a command argument. This gave me the idea of command injection. The command fails usually to a file not found error (because my command payload is in the file extension, as they rename the file randomly and keep the extension and file content).
Because the command is being run via cmd.exe in the backend, I wanted to use || in the file extension to tell the shell to run the next command after the file not found error.
The only issue is windows doesn't allow storage of || in a file name, and also when I try to include || in the file name/extension,the website does not allow you to proceed any further (guessing server side blacklist or error due to unsupported characters).
The character & works fine, except since the file is never found, there is never a success and the shell exits because && only runs the next command if the previous command ran successfully.
Due to the way the application parses the supplied filename, the payload must be in the file extension, and cannot contain any . characters.
Is there any other way I can get my command to run without using ||? I've tried using URL encoding but it stores the encoded text in the file name.
