CHALLENGE INFORMATION
Platform: TryHackMe
Path: Complete Beginner
Module: Web Hacking Fundamentals
Room: Upload Vulnerabilities
Description: Tutorial room exploring some basic file-upload vulnerabilities in websites.
Getting Started
Question 1: I solemly swear that I have read (and fully understood) the above information. I have configured my machine as instructed.
No answer needed
Introduction
Question 1: Read and understand the above information.
No answer needed
General Methodology
Question 1: Read the General Methodology.
No answer needed
Overwriting Existing Files
Question 1: What is the name of the image file which can be overwritten?
mountains.jpg
Question 2: Overwrite the image. What is the flag you receive?
<redacted-flag>
Remote Code Execution
Question 1: Run a Gobuster scan on the website using the syntax from the screenshot above. What directory looks like it might be used for uploads?
(N.B. This is a good habit to get into, and will serve you well in the upcoming tasks…)
/resources
Question 2: Get either a web shell or a reverse shell on the machine. What’s the flag in the /var/www/ directory of the server?
<redacted-flag>
Filtering
Question 1: What is the traditionally predominant server-side scripting language?
php
Question 2: When validating by file extension, what would you call a list of accepted extensions (whereby the server rejects any extension not in the list)?
whitelist
Question 3: What MIME type would you expect to see when uploading a CSV file?
text/csv
Bypassing Client-Side Filtering
Question 1: What is the flag in /var/www/?
<redacted-flag>
Bypassing Server-Side Filtering
File Extensions
Question 1: What is the flag in /var/www/?
<redacted-flag>
Magic Numbers
Question 1: Grab the flag from /var/www/.
<redacted-flag>
Example Methodology
Question 1: Read the example methodology.
No answer needed
Challenge
Question 1: Hack the machine and grab the flag from /var/www/.
<redacted-flag>
Conclusion
Question 1: Room completed, and hosts file reverted!
No answer needed