Trickster (Medium)
- Challenge Link: https://play.picoctf.org/practice/challenge/445?category=1&difficulty=2&page=1
- Challenge Description: I found a web app that can help process images: PNG images only!
Solution
This is a simple website that lets you upload images. Now, let's try a simple webshell php bypass. We make a file with the simple webshell php code and rename the file as a png so the server is tricked into in thinking that it is an image. This script turns a web page into a remote command console. If placed on a server and accessed through a browser, it allows anyone who can reach it to run system commands on that server with the same permissions as the web application. The php webshell code can be viewed here.
Now we know to know where our image that we uploaded ended up, we can look at the robots.txt and we can see that there's an /upload directory which is where our image most likely ended up.
Now we know where our image is located, let's try to access it.
http://atlas.picoctf.net:63806/uploads/Untitled.png.php
Lists all files and directories at the filesystem root:
Not much here, and we can't access the /root directory so let's try to lists all files in the web server directory (common Apache web root), with details:
We see a interesting file so let's read it:
