Finding an arbitrary file upload vulnerability in a filesharing script
1–10 of 20 posts
Re: Finding an arbitrary file upload vulnerability in a filesharing script
#2Nice find, I commented on your blog a method you can use to extend this vulnerability into RCE without admin interactivity.
Re: Finding an arbitrary file upload vulnerability in a filesharing script
#3Nice find, I commented on your blog a method you can use to extend this vulnerability into RCE without admin interactivity.
>Upload a .py file to the untrusted directory that has the same name of one of the imports used in the Python script. It will be executed the next time Python is called by the script, so you don't need to wait for interactivity on the admins part
I have a feeling that only works on python2 because of absolute imports on python3.
Re: Finding an arbitrary file upload vulnerability in a filesharing script
#4Nice find, I commented on your blog a method you can use to extend this vulnerability into RCE without admin interactivity.
Hi,
thanks for commenting!
I had cronjobs in mind, but as you said, they are not writeable.
I also thought about uploading a .py file with an import's name, but wouldn't that require a __init__.py (in a subdirectory?) to be regarded as a valid module/import by python?
Re: Finding an arbitrary file upload vulnerability in a filesharing script
#5> I thought about a possible fix for a while, but in the end decided that the quickest and easiest fix would be to adjust the regular expressio
..... WHAT?
Python has a suite of facilities exactly for this very kind of problem.
Literally, the solution is "os.path.abspath(filename).startswith(os.path.abspath(dlfolder))"
This should, in all cases, return true if the filename is within the download folder directory, and false for any other case.
Re: Finding an arbitrary file upload vulnerability in a filesharing script
#6it doesn't matter how long barney fife fucks around. God is perfectly just.
God says... likableness dawdling immature vizier innovator toffee's hanker deployment's Rubin cusp's Mitty's frescoes phonologist cornstarch pacesetter curt pterodactyl's mason undoubtedly worked doc misfeasance's prudish engravers frocks debentures Sean's sleighing overslept chicory's comparability's warmest
Re: Finding an arbitrary file upload vulnerability in a filesharing script
#7Re: Finding an arbitrary file upload vulnerability in a filesharing script
#8Nice find, I commented on your blog a method you can use to extend this vulnerability into RCE without admin interactivity.
>Upload a .py file to the untrusted directory that has the same name of one of the imports used in the Python script. It will be executed the next time Python is called by the script, so you don't need to wait for interactivity on the admins part I have a feeling that only works on python2 because of absolute imports on python3.
[deleted]
Re: Finding an arbitrary file upload vulnerability in a filesharing script
#9Earlier quoted context omitted.
>Upload a .py file to the untrusted directory that has the same name of one of the imports used in the Python script. It will be executed the next time Python is called by the script, so you don't need to wait for interactivity on the admins part I have a feeling that only works on python2 because of absolute imports on python3.
[deleted]
[deleted]
Re: Finding an arbitrary file upload vulnerability in a filesharing script
#10[deleted]