Exploiting file upload vulnerabilities in Web Applications

Some web applications with a medium security level configuration will allow you to upload files that have certain types of extensions like .jpeg, .png, .pdf, .txt, etc. In other words, applications will not accept any files other than the defined file extentions. To bypass this, we need to deceive the web server by inserting a file with multiple extensions.

In this example, we will try to upload a malicious file with double extentions ".jpeg" & ".php". It will seem as if it is of the “.jpeg” format having some data, but in reality, it will execute the “.php” file leading to an application.

To upload a malicious PHP file to the web server first, we need to create one, and for this, we are going to use “Msf Framework".

Save the above code with two extentions as ".jpeg" & ".php" format.

Once the payload is ready we will jump over to Burp Suite. In the firefox browser under the “Network Proxy” settings, select the “Manual proxy configuration” option and type the localhost. Now our “Burp Suite” is ready to intercept all online communications.

Let’s upload our malicious file with a double extension onto the web server. We will be using DVWA as our target web application.

Once you click on “Upload,” go to the “Burp Suite” to analyze the intercepted traffic. Form the Burp tool, click on the “Proxy” tab and go to the “Intercept” tab. Under the “Headers” tab, locate the filename “secret.jpeg.php” and rename it to “secret.php,” make sure that the filename is within the quotation marks. Then click on the “Forward” button to perform the upload action.

As you can see in the image below, we have successfully uploaded our PHP file to a web server with a medium security level.

To exploit it further, copy the path of the uploaded file and use it in the URL search box. Before doing that, we need to start the multi-handler and listen for an incoming connection in our attacking machine using msfconsole.

Once the listener is ready paste the path and run the backdoor.

Once our malicious file is executed, the attacker computer will receive a reverse shell connection with a full root control.

If the file upload vulnerability is successfully compromised, a hacker can completely takeover the target server.