Now, another problem that you will probably see while you are testing unrestricted file upload forms.
And sometimes you can bypass restrictions if they're not properly coated.
So in this lesson, we are going to be dealing with an unrestricted file upload challenge, you'll see
why in a minute.
So go to Cali and log in to be web and open unrestricted file upload page from the menu.
Now to see how it works, browse and then choose a picture on your computer.
And then upload the file.
And you will see a link below, so click it to the image yeah, I uploaded said.
So, OK, enable Foxy Knoxy and I'm going to arrange the view for you here, so.
We can look at the code.
Now, there's no check for a low level.
But for medium file, upload, check one is called.
And for high level check two is called.
OK, exit now, I created a folder for this example before, so I'm going to go to that folder.
And I'm going to prepare a shell with MSF venom tool.
So type MSF venom does p p p slash interpreters slash reverse Tsipi for the payload?
And almost equals one nine two one six eight two zero four one to eight for the localhost dress and
Bellport equals four four for three for the local port and Cali and the file name.
And now we can provide some other parameters to MSF venom.
But we don't need this for this example.
So.
OK, the payload is created.
So here it is, my folder, and this is the content.
All right, so we're done here, so then go back to Firefox's.
Well, browser images, but choose shelled out and uploaded.
Offload request is in berp on the right.
And you can see the content of the file.
And the content type is Application XP, HP.
OK, so let it go.
And the link appears on the page.
But now, before clicking, let's go back to terminal.
Now, I forgot to create a handler to capture the reverse connection, so open Métis Boyte.
OK, so use exploit slash multigrain handler.
And then set payload to reverse TCP.
And you can set localhost the IP address of Carly.
And so the local board to four, four, four, three.
So one more time, we'll show the options.
And then type exploit RSJ to run a background job.
OK, so go to Firefox and click here to see the show.
And the session is open in terminal.
So type sessions to list sessions.
And interact with the session one.
Type get Eweida for the user of the open show.
And then info, you see the basic info about the open shell, exit the shell.
And go back to Firefox's, so now I will increase a level.
So choose minium.
And try to upload the shell again.
And there's a year because these extensions are not allowed.
OK, so it's a naval interception.
And then upload the shell file again.
That request is here in berp.
OK, so change the extension in the file name and just add three to the end, that's all.
And send the request.
And a link for viewing the uploaded image is right here on the page, but before we do that, let's
let's grab a listener.
So start the handler and metastable by typing, exploit J.
Now click the link.
Perfect sessions open.
So interact with session to.
And we'll run get your ID, the user is w w w data.
And this info for the basic information about the shell.
And then you can exit.
Now, go back to Firefox again.
And I'm going to increase a level one more.
So select high and now try to upload the shale file again.
And there's our friend, the error.
But this time it allows only these extensions.
OK, so enable interception and upload the file.
And this time, the problem can be solved by adding a suitable extension to the file name.
And let it go.
And there's the upload, problem solved.
Here's a link.
So open the terminal and start the handler.
OK, it is done.
Now click the link.
Hey, nothing happened.
There's no session.
It doesn't work.
Because the application tries to open an image file, but remember, it's a file, so it gets confused,
throws an error without executing it.
So we cannot directly execute this show.
But remember, we discovered Elfy on the Web so we can use Elfy to include our shell into the application.
But that's for you to do.
I know you know how, because we did Elfy several times.
Have fun with that.