Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

"Remote code execution via polyglot web shell upload "-- not able to read the uploaded file.

lokesh | Last updated: Mar 06, 2024 08:44AM UTC

I get the below error when i try to Request: GET /files/avatars/polyglot.php HTTP/2 Host: 0aa800930455a9d080976cf8008600a6.web-security-academy.net Cookie: session=29GgwnhPI6n0cQ5tSpupMs9GAHJ8uECa User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: none Sec-Fetch-User: ?1 Pragma: no-cache Cache-Control: no-cache Te: trailers Response: HTTP/2 500 Internal Server Error Date: Wed, 06 Mar 2024 08:40:45 GMT Server: Apache/2.4.41 (Ubuntu) Content-Type: text/html; charset=UTF-8 X-Frame-Options: SAMEORIGIN Content-Length: 0

Ben, PortSwigger Agent | Last updated: Mar 06, 2024 01:25PM UTC

Hi, To confirm, are you seeing this response when you upload the polyglot.php file within the browser?

lokesh | Last updated: Mar 07, 2024 01:34AM UTC

Hi Ben, Yes, I added the comment to the PNG file using exiftool and converted it into polyglot.php and uploaded successfully. I'm unable to read/get the file, getting 500 http status code. Can you check if anything else has to be performed to successfully read the uploaded polyglot file ? Thanks

Ben, PortSwigger Agent | Last updated: Mar 07, 2024 11:34AM UTC

Hi, When I ran through this particular lab I was able to view the response associated with the uploading of the polyglot.php file, within the HTTP history, and obtain the In your situation you are saying that you are able to upload the file that you have created but when viewing the corresponding request/response pair within the HTTP history you are observing the 500 response? It might be useful for you to email in at support@portswigger.net and include some screenshots so that we can see exactly what you are doing.

lokesh | Last updated: Mar 21, 2024 03:01AM UTC

yes, im able to upload the file successfully. POST request is successful. When i try to retrieve the PNG/polyglot file through a GET request, i get 500 response code. Response: HTTP/2 500 Internal Server Error

Ben, PortSwigger Agent | Last updated: Mar 21, 2024 10:58AM UTC

Hi lokesh, The GET request that you need to view should already be in your HTTP history as part of uploading the file and then navigating back to your account page - from what you have said it sounds like you are sending a separate GET request to try and interact with the uploaded file. Can you confirm whether this is the case?

lokesh | Last updated: Apr 02, 2024 11:25AM UTC

Yes, im sending a separate GET request as im not able to see appropriate request/response showing the executed payload in the HTTP history.

Ben, PortSwigger Agent | Last updated: Apr 02, 2024 12:41PM UTC

Hi, The following screenshot shows the sequence of requests that I am seeing when I upload the file and also the GET /files/avatars/polyglot.php request that gives the secret file within the response: https://snipboard.io/REnfVs.jpg To confirm, you do not see this sequence of requests within your proxy history? If not, it might be worth sending us an email and include screenshots of precisely the steps that you are carrying out so that we can see this more clearly. You can send us an email at support@portswigger.net.

Alex | Last updated: Aug 06, 2024 03:00AM UTC

Good Evening, I am getting the same error as the person above. When I upload the polyglot.php (i changed it to webshell2.php as I was following the video because I thought I had broken something). I get the initial POST response fine. Once I "Forward" that response with burpsuite i get the following response on the web browser: Burp Suite Community Edition [Banner] Error Stream failed to close correctly. In order for me to resolve this error, I turn off foxyproxy reload the webpage. Then I get asked if I am sure I want to resend the data. I hit yes and it reloads with the expected: "The file avatars/webshell2.php has been uploaded" back to My Account However, in the HTTP history i see the "GET" /file/avatars/webshell2.php but the MIME type is HTML and not png like it is in the video and the Extension is still php. When I send the following GET REQUEST: `GET /files/avatars/webshell2.php HTTP/2 Host: 0aff004e0315b83a80cadabd0090007d.web-security-academy.net Cookie: session=2Hc1AhW3qjZaX56lHdHmmHOwuxajwMAr User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:128.0) Gecko/20100101 Firefox/128.0 Accept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Dnt: 1 Referer: https://0aff004e0315b83a80cadabd0090007d.web-security-academy.net/my-account Sec-Fetch-Dest: image Sec-Fetch-Mode: no-cors Sec-Fetch-Site: same-origin Priority: u=5, i Te: trailers` I get the following RESPONSE: `HTTP/2 500 Internal Server Error Date: Tue, 06 Aug 2024 02:55:55 GMT Server: Apache/2.4.41 (Ubuntu) Content-Type: text/html; charset=UTF-8 X-Frame-Options: SAMEORIGIN Content-Length: 0` I am not sure if the polyglot is breaking something with instance that is stood up (I am guessing AWS?) The polyglot walkthrough video was made 2yrs ago at this point, so I am curious if something has changed since then. Browser: Firefox 128.0 (64-bit) OS : Windows 10 Pro Version : 22H2 OS Build : 19045.4651 Note: This also happens on a Kali VM running on VMWare Workstation Pro 17.5, best guess is it is an issue on how something is being handled by the polyglot and the lab instance?

Michelle, PortSwigger Agent | Last updated: Aug 06, 2024 02:57PM UTC

Thanks for getting in touch. So that we can look into this can we check a few more details with you, please? - What command did you use to create your webshell2.php file? - Do you only see the stream failed to close correctly message if you are intercepting the requests? If intercept is turned off, are there any errors or des the file just upload successfully?

Hannah, PortSwigger Agent | Last updated: Aug 07, 2024 02:29PM UTC

We've done some more testing with this lab, and it is possible to solve the lab. Once you receive the "Stream failed to close correctly" message, refresh the page. You'll be prompted to confirm whether you want to resubmit the form - just hit continue (no need to disable proxies). Once you've refreshed the page, you should get a message that your avatar has been updated, and you can return to your account page and complete the lab by finding and submitting the secret value.

Alex | Last updated: Aug 07, 2024 08:37PM UTC

Since I was still getting the error after attempting the remedy mention with proxy. I made sure to do a complete clear of my HTTP history, shutdown burp suite and restart it. I have listed below a step by step walk-through on how to get the information without having the intercept mode on, and it will not cause a 500 Internal server error. The Burp Suite team was extremely helpful in getting back to my emails with questions and responses, but I was still unable to get it to work wit the suggestions. It is possible I was missing some implied steps, so I made a very detailed list to remedy the situation. This solution has you looking into the solution tab for the command (it is the same as the one below). INSTRUCTIONS BELOW. Burp Suite Solution to 500 Error on – Lab : Remote code execution via polyglot web shell upload. Step 1 : Start Burp Suite Step 2 : On the “Proxy ” Tab in Burp Suite ensure you are on the “Intercept” tab. ###WARNING: DO NOT TURN INTERCEPT ON.### Step 3 : Then click “Open Browser” button. Either at the top 2 buttons to the right of the “Intercept” button, or in the middle of the screen where the orange button is. This will open a Chromium window that is linked to Burp Suite. You do not need to have Foxy Proxy or any other proxy tool running to collect data when you use the built in browser with Burp Suite. Step 4 : navigate to portswigger.net Step 5 : Login to your account to access the academy Step 6 : Go to the “File Upload Vulnerabilities” path and number 26 of 35 is the lab. Step 7 : Create the polyglot.php file using the command from the solution: [Note: This is the command to make it in Kali (or any linux distro {I believe} with exiftool installed.) The steps after will work on Windows or inside a VM. If you are making the file on Kali like I did inside a VM you can drag that file to your host desktop and continue the steps from there if you wish. I do not know the command structure to get the exiftool to work on windows exiftool.exe because you need to have it as part of the filename and it keeps erroring out.] exiftool -Comment="<?php echo 'START ' . file_get_contents('/home/carlos/secret') . ' END'; ?>" <YOUR-INPUT-IMAGE>.jpg -o polyglot.php Step 8 : Click Access Lab. Step 9 : Login to “My Account” in the lab. Username and password were given where you clicked launch lab. Step 10: Once logged in click “Choose File” select the polyglot.php you made from the command above. [If you chose to name it something different, select that file] Step 11 : Click “Upload” Step 11: Click “Back to My Account” in purple letters to the upper left of the screen. Step 12: Go back to the Burp Suite window. The “Intercept” window should still be empty. *** If it is not and you had intercept on, you probably got the 500 internal server error, or the stream failed error with a Burp Suite banner. If this happened, do the following steps: -- Turn Off Intercept -- Click “HTTP History” -- Right click in the list of stuff that is showing. -- Click “Clear History” -- Go back to step 10 while leaving “Intercept” off Step 13 : Click “HTTP History” tab, this is to the right of the “Intercept” tab within the “Proxy” window. Step 14 : Look for a funnel at the top of the page under “HTTP History” it should have the words “Filter Settings : Hiding CSS, image and general binary content” next to it if you have not applied any other filters. If you did it will have addition wording. Step 15 : Click the filter button and in the “Filter by search term” put the following line “/files/avatars/<FILE NAME>” where <FILE NAME> is the name of the file you uploaded. Mine looked like this [/files/avatars/test.php] since I wanted to show that the file did not need to be polyglot.php for this to work. Step 16 : Click “Apply & Close”. The “HTTP History” should now only show 2 GET requests. Click on the one that says “/files/avatars/<FILE NAME>”. Step 17 : Once you do this at the bottom of the screen it will show the Request on the left and the Response on the right. Within the Response you are looking for the phrase “MSTART” and “END”. Mine showed on like 19 in the “Pretty” visual. If you click the “Render” option you should see it in the top 15 lines or so, mine was on the 6th line. This will vary depending on which image you used. You should see something that looks like this: MSTART N9JbPXhVcp5YHhzCU8SakJeUrv5BAf0q END The information in the center is the secret. Copy that and complete the lab. NOTE: If you are having trouble locating the start string do the following: -- Right Click inside the Response -- Click “Save Item” -- UNCHECK the box at the bottom of the save window that says “Base64-encode requests and responses”. -- Give it a name, click save. -- Go open the file in a text editor, I used Notepad, word works too. -- CTRL+F the phrase “MSTART” without the quotes. If this is not in the file then the command did not execute so you will probably need to redo to polyglot file and retry. If it is there you should see the line from above, but the part inside “MSTART” and “END” will be different.

Hannah, PortSwigger Agent | Last updated: Aug 08, 2024 08:36AM UTC