###############################################################################
# [+]Title: [Bypassing UPLOAD Variable] #
###############################################################################
# [+] About : #
###############################################################################
# Written by : GlaDiaT0R #
# Contact: the_gl4di4t0r[AT]hotmail[DOT]com / berrahal.ryadh[AT]gmail[DOT]com #
# Team : Tunisian Power Team ( DarkGh0st.Net ) #
###############################################################################
# [+] Summary: #
# [1]-Introduction #
# [2]-Detection #
# [3]-Exploiting.. #
# [4]-Vulnerable Source code #
###############################################################################
[1]-Introduction
The bypass of a vulnerable PHP Upload works the same way that the bypass connection vulnerable.
Indeed we find in both cases a variable so the value given will be used to authenticate the request and passed to accept.
It is therefore possible to reconstruct a post that contains the variable value + authentication and ensure that the file
be accepted some restrictions so the preset.
=======================================================
[2]-Detection
To know this vulnerability you must therefore be in possession of source code used (vulnerable code used in a site template in distribution or other method to access the vulnerable source code used)
And it's essential to know the variable and its value used to authenticate the request.
=======================================================
[3]-Exploiting..
In our example the upload verify a number of specific information to the file upload (pixel size - maximum and minimum) and attribute value "1" to the variable $ admin authentication to be used to upload the image.
it will suffice to reforme post containing a field named admin whose value is "1" to bypass the restriction of the upload v vulnerable.
----------
vuln :
if(($infos_img[0] <= $width_max) && ($infos_img[1] <= $height_max) && ($_FILES['fupload']['size'] <= $max_size) && ($infos_img[0] > $height_min) && ($infos_img[1] > $width_min))
{
$admin = 1;
}
if ($admin == 1 ){
// UPLOAD
---
exploit.html :
/null