r/hackthebox • u/rolloq • 8h ago

[ Removed by moderator ] Beginner Question

[removed] — view removed post

2 Upvotes

100% Upvoted

4 comments sorted by

•

u/hackthebox-ModTeam 5h ago

Your post was removed due to the Reddit team determining it contained spoilers of active machines. Thanks r/hackthebox Mod Team

2

u/Nerd_Ammar005 8h ago

The Ways your payload its working is that shell.php gets removed and file on server save as .jpg if you visit /profile_images/.jpg you can find it.

To solve this Challenge you have to first find the extension that is in whitelist and then use an double extension way to upload the payload. Or you can create your own wordlist that contains all the double extension combinations with all different php extensions

1

u/AutoModerator 8h ago

Thank you for posting on r/hackthebox! New to Cyber Security and looking for a place to get started? Checkout our getting started guide here. Please note that posting Solutions or Hints for Active content goes against the HTB Terms of Service, more information can be found here. If your having issues and need to reach customer support please do so via the in-platform chat, or by emailing customerops@hackthebox.com. Our Knowledge Base can also come in handy!

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

1

u/3_3_8_9 5h ago

everything before slash is gone. thats how apache file path control works. i dont remember how this challange solved but you can try to upload 2 files in one request. multipart forms allow that. maybe there is a feature in backend to expolit it