Remote code execution via web shell upload

What is a Web Shell?

A Web Shell is a small script (PHP, ASP, JSP, etc.) that an attacker uploads to a vulnerable website. After uploading it, the attacker can access the server through a web browser and execute commands on the server.

Exploiting the Unrestricted File Upload Vulnerability

In this lab, the goal is to exploit an unrestricted file upload vulnerability by uploading a basic PHP web shell.

The lab provides the following credentials:

• Username: wiener
• Password: peter

First, I searched for a basic PHP web shell on GitHub. After finding a simple PHP web shell, I copied the code and saved it as shell2.php using the Nano editor.

nano shell2.php

Next, I logged in to the application using the provided credentials and navigated to the My Account page. The application contains a profile image upload feature.

Instead of uploading a normal image, I selected the shell2.php file and clicked Upload. Since the application does not validate the uploaded file type, it accepted the PHP file and stored it on the server.

After the upload completed, I was redirected back to the My Account page.

To locate the uploaded file, I opened Burp Suite and checked the HTTP History tab. I found the request for the uploaded shell2.php file by looking at its file extension.

I then right-clicked the request and selected Request in Browser to obtain the URL of the uploaded PHP file. After copying the URL, I opened it in a new browser tab.

The uploaded PHP file acts as a web shell, allowing me to communicate with the web server. I sent the request to Burp Repeater, where I could modify the request and execute commands on the server through the web shell. This enabled me to interact with the server and retrieve the required file as instructed in the lab.

Why the Attack Was Successful

The attack succeeded because the developer did not validate the uploaded files. The application accepted a malicious PHP file instead of allowing only image files.

As a result, an attacker was able to upload a web shell, execute commands on the server, and gain remote access to the server's functionality.

Key Takeaway: Always validate uploaded files by checking their file type, extension, MIME type, and content. Allow only trusted image formats (such as JPG or PNG) and prevent executable files like PHP from being uploaded.