File Upload Vulnerabilities

Basic Concept

A file upload vulnerability occurs when a user uploads an executable script file and then uses that script to gain the ability to execute server-side commands. This attack path is one of the most direct and effective ones. "File upload" itself is not the problem; the problem is how the server processes and interprets the file after upload. If the server-side handling logic is not secure enough, the consequences can be serious.

If the server is misconfigured or does not apply sufficient filtering, web users may upload arbitrary files, including malicious scripts, executable programs, and so on. This creates a file upload vulnerability.

Causes

1. The server is misconfigured.

2. The web application exposes an upload feature but does not apply sufficient restrictions and filtering to uploaded files.

3. During development and deployment, the system's characteristics or component vulnerabilities were not considered, allowing restrictions to be bypassed. The most direct impact of an upload vulnerability is arbitrary file upload, including malicious scripts and programs. Attackers can upload a backdoor file directly and compromise the website. They can also use a malicious file together with other vulnerabilities to obtain administrator privileges and compromise the server.

A website backdoor obtained through a file upload vulnerability is called a WebShell.

WebShell is a website backdoor and command interpreter. It communicates through the web (HTTP protocol), passes command messages, and inherits the permissions of the web user.

In essence, a WebShell is a server-side script file that can run on the server. Common suffixes include:

.php
.asp
.aspx
.jsp
...

A WebShell receives commands from a web user and executes them on the server.

WebShell Trojans

Small WebShell

A one-line webshell, usually used together with AntSword.

Common one-liners:

<?=@eval($_REQUEST['ccc'])?>
<?php @eval($_REQUEST['ccc'])?>

Three main functions: file management, virtual terminal, and database management.

Full WebShell

A larger webshell with more code, corresponding to the smaller one-liner type.

WebShell Collections

https://github.com/backlion/webshell

Common WebShell Managers

AntSword

https://www.yuque.com/antswordproject/antsword

Behinder

https://github.com/rebeyond/Behinder

Godzilla

https://github.com/BeichenDream/Godzilla

Common Parsing Vulnerabilities

iis 6.0 xx.asp/xx.jpg xx.jsp;.jpg iis 7.5 php.ipg/.php 7.5NET source code disclosure and authentication vulnerability, classic ASP authentication bypass apache1.x 2.x parses suffixes from right to left: xx.php.xxx nginx<0.8.37 0.x 1.x xx.jpg/.php xx.jpg/%00.php

Hands-On Practice

The upload-labs range is recommended because it covers the common bypass techniques for file upload vulnerabilities.

Project address:

https://github.com/c0ny1/upload-labs

Recommended write-up:

https://wiki.ckcsec.cn/en/web/range/upload-labs通关笔记.html

Another good project developed by Master Guoguang is also recommended:

https://github.com/sqlsec/upload-labs-docker

Explore the fun of file upload vulnerabilities in real practice.