> For the complete documentation index, see [llms.txt](https://dev-angelist.gitbook.io/writeups-and-walkthroughs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://dev-angelist.gitbook.io/writeups-and-walkthroughs/portswigger-web-security-academy/server-side-vulnerabilities/file-upload-vulnerabilities/web-shell-upload-via-content-type-restriction-bypass.md).

# Web shell upload via Content-Type restriction bypass

https\://portswigger.net/web-security/learning-paths/server-side-vulnerabilities-apprentice/file-upload-apprentice/file-upload/lab-file-upload-remote-code-execution-via-web-shell-upload

## Description

This lab contains a vulnerable image upload function. It attempts to prevent users from uploading unexpected file types, but relies on checking user-controllable input to verify this.

To solve the lab, upload a basic PHP web shell and use it to exfiltrate the contents of the file `/home/carlos/secret`. Submit this secret using the button provided in the lab banner.

You can log in to your own account using the following credentials: `wiener:peter`

## Solution

<figure><img src="https://677614291-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrRWtuMw6xkkeDjZfkcWC%2Fuploads%2FY5dRP5jiulZPWbOoHT9R%2Fimage.png?alt=media&amp;token=45699956-2c1b-4079-9a5c-7f930902ea6b" alt=""><figcaption></figcaption></figure>

After login as Wiener user there's an upload option to upload avatar image:

<figure><img src="https://677614291-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrRWtuMw6xkkeDjZfkcWC%2Fuploads%2FcImBGyc4yBNlDp69OK6A%2Fimage.png?alt=media&amp;token=0a887e18-de42-4ae3-887d-d7e269073597" alt=""><figcaption></figcaption></figure>

with the avatar image at this path/location:

[https://0a890067048524a181330c1d0073004e.web-security-academy.net](https://0a890067048524a181330c1d0073004e.web-security-academy.net/my-account?id=wiener)[/resources/images/avatarDefault.svg](https://0ab300990381641d80b5b7de005e0030.web-security-academy.net/resources/images/avatarDefault.svg)

We need to obtain Carlos's secret, we can do it upload a php shell (`php_web_shell.php`) that get secret file content

```php
<?php echo file_get_contents('/home/carlos/secret'); ?>
```

<figure><img src="https://677614291-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrRWtuMw6xkkeDjZfkcWC%2Fuploads%2FJhWvdswGo2A0So8JbV9J%2Fimage.png?alt=media&amp;token=8bdabfc3-ce86-4051-bee3-d2b46a6dab40" alt=""><figcaption></figcaption></figure>

there's a filtering and we can't upload php shell, seeing the output message file types allowed are: image/jpeg and image/png, so we can use the Burp Repeater to modify request updating Content-Type

<figure><img src="https://677614291-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrRWtuMw6xkkeDjZfkcWC%2Fuploads%2F1Ei72FrrgkGmNngiUMjf%2Fimage.png?alt=media&amp;token=b8e7e6de-8939-4e88-b783-a645d5c54abe" alt=""><figcaption></figcaption></figure>

Infact, inserting: image/jpeg we're able to upload our php web shell bypassing controls:

<figure><img src="https://677614291-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrRWtuMw6xkkeDjZfkcWC%2Fuploads%2F6kXLb0LypGBzVMAqWSal%2Fimage.png?alt=media&amp;token=96777da0-ffc1-4c60-a02b-78558bcb1530" alt=""><figcaption></figcaption></figure>

We know the file location and we can open it going to: [https://0a890067048524a181330c1d0073004e.web-security-academy.net](https://0a890067048524a181330c1d0073004e.web-security-academy.net/my-account?id=wiener)[/files/avatars/php\_web\_shell.php](https://0ab300990381641d80b5b7de005e0030.web-security-academy.net/files/avatars/php_web_shell.php)

<figure><img src="https://677614291-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrRWtuMw6xkkeDjZfkcWC%2Fuploads%2FRVFuHTOplTPtZekVmYAm%2Fimage.png?alt=media&amp;token=b991a809-e508-4a6a-8554-d361bc54e78c" alt=""><figcaption></figcaption></figure>

<details>

<summary>Carlos's Secret</summary>

FYw9wjdc53Z6eePuSDiWMPkmrVT6kzvF

</details>

Obtaining Carlos's secret and solving the lab.

<figure><img src="https://677614291-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrRWtuMw6xkkeDjZfkcWC%2Fuploads%2FvkOYGQxE92pEZSyknBLq%2Fimage.png?alt=media&amp;token=fb33d717-b4a5-47ae-a619-053fb4f12df1" alt=""><figcaption></figcaption></figure>