‫Now, another problem that you will probably see while you are testing unrestricted file upload forms.
‫And sometimes you can bypass restrictions if they're not properly coated.
‫So in this lesson, we are going to be dealing with an unrestricted file upload challenge, you'll see
‫why in a minute.
‫So go to Cali and log in to be web and open unrestricted file upload page from the menu.
‫Now to see how it works, browse and then choose a picture on your computer.
‫And then upload the file.
‫And you will see a link below, so click it to the image yeah, I uploaded said.
‫So, OK, enable Foxy Knoxy and I'm going to arrange the view for you here, so.
‫We can look at the code.
‫Now, there's no check for a low level.
‫But for medium file, upload, check one is called.
‫And for high level check two is called.
‫OK, exit now, I created a folder for this example before, so I'm going to go to that folder.
‫And I'm going to prepare a shell with MSF venom tool.
‫So type MSF venom does p p p slash interpreters slash reverse Tsipi for the payload?
‫And almost equals one nine two one six eight two zero four one to eight for the localhost dress and
‫Bellport equals four four for three for the local port and Cali and the file name.
‫And now we can provide some other parameters to MSF venom.
‫But we don't need this for this example.
‫So.
‫OK, the payload is created.
‫So here it is, my folder, and this is the content.
‫All right, so we're done here, so then go back to Firefox's.
‫Well, browser images, but choose shelled out and uploaded.
‫Offload request is in berp on the right.
‫And you can see the content of the file.
‫And the content type is Application XP, HP.
‫OK, so let it go.
‫And the link appears on the page.
‫But now, before clicking, let's go back to terminal.
‫Now, I forgot to create a handler to capture the reverse connection, so open Métis Boyte.
‫OK, so use exploit slash multigrain handler.
‫And then set payload to reverse TCP.
‫And you can set localhost the IP address of Carly.
‫And so the local board to four, four, four, three.
‫So one more time, we'll show the options.
‫And then type exploit RSJ to run a background job.
‫OK, so go to Firefox and click here to see the show.
‫And the session is open in terminal.
‫So type sessions to list sessions.
‫And interact with the session one.
‫Type get Eweida for the user of the open show.
‫And then info, you see the basic info about the open shell, exit the shell.
‫And go back to Firefox's, so now I will increase a level.
‫So choose minium.
‫And try to upload the shell again.
‫And there's a year because these extensions are not allowed.
‫OK, so it's a naval interception.
‫And then upload the shell file again.
‫That request is here in berp.
‫OK, so change the extension in the file name and just add three to the end, that's all.
‫And send the request.
‫And a link for viewing the uploaded image is right here on the page, but before we do that, let's
‫let's grab a listener.
‫So start the handler and metastable by typing, exploit J.
‫Now click the link.
‫Perfect sessions open.
‫So interact with session to.
‫And we'll run get your ID, the user is w w w data.
‫And this info for the basic information about the shell.
‫And then you can exit.
‫Now, go back to Firefox again.
‫And I'm going to increase a level one more.
‫So select high and now try to upload the shale file again.
‫And there's our friend, the error.
‫But this time it allows only these extensions.
‫OK, so enable interception and upload the file.
‫And this time, the problem can be solved by adding a suitable extension to the file name.
‫And let it go.
‫And there's the upload, problem solved.
‫Here's a link.
‫So open the terminal and start the handler.
‫OK, it is done.
‫Now click the link.
‫Hey, nothing happened.
‫There's no session.
‫It doesn't work.
‫Because the application tries to open an image file, but remember, it's a file, so it gets confused,
‫throws an error without executing it.
‫So we cannot directly execute this show.
‫But remember, we discovered Elfy on the Web so we can use Elfy to include our shell into the application.
‫But that's for you to do.
‫I know you know how, because we did Elfy several times.
‫Have fun with that.