0

I am pentesting my institute website.

Research

  • Website is using ASP.Net

  • Website lets you upload a profile picture for your account. Profile picture is sent to http://domain/api/fileManagement/PictureUpload

  • http://domain/api/fileManagement/FileExist checks if file exist or not

  • If file exist, http://domain/api/fileManagement/FileDownload returns a picture in base64, which is then used by img tag of HTML

Exploitation

  • During testing I found that I can upload any kind of file. So, I uploaded a webshell from https://github.com/tennc/webshell/blob/master/fuzzdb-webshell/asp/cmd.aspx

  • http://domain/api/fileManagement/FileExist confirms that file exist.

  • But http://domain/api/fileManagement/FileDownload return webshell file in base64 encoding.

Problem

My problem is that I can't figure out where this uploaded file is stored (the URL). I want to check if I can execute this webshell. I can upload webshell but to execute it I need its URL.

Is there any way to execute webshell?

Additional Info

  • During testing I also found this error Name.Server.Controllers.fileManegmentController.PictureUploaded() in D:\Projects\VUE_PROJECTS\Name\Name\src\server\Controllers\FileManegment\fileManegmentController.cs:line 75
New contributor
Abu Bakar is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.
3
  • 1
    What makes you think that the uploaded file is accessible by URL in the first place? Also what makes you think that it will actually execute? Nothing in your question suggests an existing vulnerability you can use and nothing suggests that your attempt to run a webshell could be successful or how exactly you should try to run it. Just because you can upload it does not mean you can execute it. Aug 4 at 20:37
  • sounds like some very unsafe practices here... never use a user-supplied filename or file extension. You should create your own name when receiving the file and case/switch to write specific file extensions. If you like you can store the user-submitted name... just don't use it for the actual file. Since the site returns a Base64 image, the site should only allow image files to be uploaded with a limited set of file extensions. It should also only store that file as long as it takes to convert it to Base64 and store in DB. (Not sure of the purpose of the Base64 part though...)
    – pcalkins
    Aug 4 at 21:59
  • My comment on your previous question about this still stands. How are we supposed to know how the files are stored internally?
    – schroeder
    Aug 5 at 8:02

0

Browse other questions tagged or ask your own question.