byp4ss3d (Medium)

  • Challenge Link: https://play.picoctf.org/practice/challenge/518?category=1&difficulty=2&page=1
  • Challenge Description: A university's online registration portal asks students to upload their ID cards for verification. The developer put some filters in place to ensure only image files are uploaded but are they enough? Take a look at how the upload is implemented. Maybe there's a way to slip past the checks and interact with the server in ways you shouldn't.
  • Hints:
    1. Apache can be tricked into executing non-PHP files as PHP with a .htaccess file.
    2. Try uploading more than just one file.

Solution

This is a simple website that lets you upload images to verify student ID. First thing I did was upload a image to see what happens.

test

Now, let's try a simple webshell php bypass to see if it allows us to remotely execute code. Similar to the Trickster PicoCTF, we make a file with the simple webshell php code and rename the file as a png so the server is tricked into in thinking that it is an image. As a reminder, this script turns a web page into a remote command console. If placed on a server and accessed through a browser, it allows anyone who can reach it to run system commands on that server with the same permissions as the web application. Because of this, it’s commonly used as a post-compromise tool by attackers and is widely recognized as a classic example of a PHP web shell.

php

We upload an .htaccess file to modify how the server handles files. By adding the following line, we instruct Apache to interpret .png files as PHP scripts. As a result, a file that appears to be an image (e.g., shell.png) will be executed as PHP when accessed, allowing us to bypass file upload restrictions that block .php files.

AddType application/x-httpd-php .png

At this point, visiting the URL below causes the server to execute the embedded PHP code instead of serving the file as an image:

http://amiable-citadel.picoctf.net:52747/images/shell.php.png
htaccess

If we type ls we can see all the files we have uploaded and we have confirmed that we can remotely execute code.

ls

We want to find the flag so, we need to see all the files that end in an .txt format because that's most likely where the flag is:

find / -name "*.txt"

Majority of this is irrelevant but if we scroll down a bit we can see a path that leads us to our flag:

/var/www/flag.txt
find

So if we try to read this file using the full path we can get our flag:

cat /var/www/flag.txt
flag: picoCTF{s3rv3r_byp4ss_0c257942}
flag

Sources