[aka4tomix]

I am doing a penetration test on an internal system and have successfully bypassed file upload validation. Unfortunately, the system (written in php) will rename my file to "random_number.tff". However, I do have access to the file through the upload folder (which is a finding in itself). I have successfully uploaded an EICAR file that was processed and FTP'ed to an internal system so that is an additional finding.

I would like to find a way to execute arbitrary code in the image file though. Is it possible to execute code that is in an image? I have validated the code still exist in the file. I don't know if files in the upload system are executable.


Thanks in advance for any suggestions or advice.

[zomgwtfbbq]

There are two scenarios in which you can do this:
1- ability to edit or upload a htaccess file and add a rewrite rule
2- get access to the webserver and reconfigure it so that ttf files will be parsed by php, then restart the webserver

[hackoboy]

You must CHMOD rx the file...

If you still don't understand, maybe the hacking Scene Is NOT a good place for you...Beat It, kiddo !

[The Real Slim Shady]

You must CHMOD rx the file...

If you still don't understand, maybe the hacking Scene Is NOT a good place for you...Beat It, kiddo !

what a useless post. i can tell the hacking scene has no use for you thats for sure.

[aka4tomix]

Thanks for the help guys.... minus the idiot of course!

I wasn't able to exploit it due to .htaccess not allowing execution of .tiff.

[ch3rn0byl]

You must CHMOD rx the file...

If you still don't understand, maybe the hacking Scene Is NOT a good place for you...Beat It, kiddo !

what a useless post. i can tell the hacking scene has no use for you thats for sure.

Get'em Geoff! Haha!! I've seen you devour people like that :troll: