Learning Objective 9
Last updated
Was this helpful?
Last updated
Was this helpful?
Task
In the Attack Lab:
Find and exploit the File Upload vulnerability and execute OS Level command on the contact application (https://contactpharmacorp.azurewebsites.net/)
Extract the information from the Application settings
Applies to: Attack Lab
Topic Covered: Insecure File Upload Vulnerability Exploitation and Information Extraction
After investiganting the source code is possible to verify the folder were all uploads are sended.
Open BurpSuite and bypass the Upload filter using a / in the extension.
We can now use our webshell and execute cmd commands. testing with the command whoami is possible to verigy that our webshell is running has:
Since we can execute commands let's extract the best friends - Environ variables.
URL encoded:
After extracting the evironment variables we have found a new resource on the sub-domain: https://analytics.pharmacorphq.com/
Extract Environment Variables and get a OS Command injection.
