Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Labs - File Upload Vulnerabilities - versatile webshell

Stephan | Last updated: Nov 14, 2022 10:15AM UTC

Hi @burp_fans I stumbled upon an "issue" with the file upload vulnerability labs (e.g. [1], but it is the same for all file upload labs I have tried so far): I manage to upload a webshell with `file_get_contents('explicit_path')` but I cannot manage to run a shell that gets the file path from a get parameter or run more general commands like `ls` or `pwd`. The code supplied in the documentation ``` <?php echo system($_GET['command']); ?> ``` as well as a few other simple webshells I have tried also do not work for me. Is this a general issue for others, too, or did I miss a detail? Is this intentional to protect the Lab machine? Might this be a bug and it should work, but is filtered at some point? While this is not a huge issue to solve the labs, it might be interesting to see, how a webshell interacts, e.g., with the active scan or other features of Burp [1]: https://portswigger.net/web-security/file-upload/lab-file-upload-remote-code-execution-via-web-shell-upload

Ben, PortSwigger Agent | Last updated: Nov 15, 2022 09:10AM UTC

Hi Stephan, If you upload a webshell similar to the following then that should allow you to run specific commands: <?php echo system('ls'); ?>

Stephan | Last updated: Nov 22, 2022 01:51PM UTC

This I understand, but is there a way to upload a shell that lets me submit all commands I want through URL parameters of a simple get request? (a lot easier to automate, etc.)

Ben, PortSwigger Agent | Last updated: Nov 23, 2022 02:25PM UTC

Hi Stephan, We actually think this might be a bug - it looks like the query parameter is not being passed along when it should be. I have raised a bug report so that the Web Academy developers can investigate this - I will update this forum thread when I have some further news to share.

Ben, PortSwigger Agent | Last updated: Dec 02, 2022 09:28AM UTC