> For the complete documentation index, see [llms.txt](https://ps.leunam.xyz/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ps.leunam.xyz/22-file-upload-vulnerabilities/03-lab-web-shell-upload-via-path-traversal-13afab5460ec81d2a701e16e4c87765c.md).

# 03 Lab: Web shell upload via path traversal

## Objetivo

> This lab contains a vulnerable image upload function. The server is configured to prevent execution of user-supplied files, but this restriction can be bypassed by exploiting a [secondary vulnerability](https://portswigger.net/web-security/file-path-traversal).
>
> To solve the lab, upload a basic PHP web shell and use it to exfiltrate the contents of the file `/home/carlos/secret`. Submit this secret using the button provided in the lab banner.
>
> You can log in to your own account using the following credentials: `wiener:peter`

## Solución

1. Exploramos el inicio de sesión y nos permite subir imagen

![image.png](https://1216248185-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdwRvuHbGnKvUioATlOOa%2Fuploads%2Fgit-blob-2644bcea78d71d98e5903cff604d5c9f5b578c09%2Fimage.png?alt=media)

![image.png](https://1216248185-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdwRvuHbGnKvUioATlOOa%2Fuploads%2Fgit-blob-3ab291d4e140a7fb0d6ea169067ab397e4a5d676%2Fimage%201.png?alt=media)

<https://0a9f00a50375fb3782ee154f00be0000.web-security-academy.net/files/avatars/04.png>

<https://0a9f00a50375fb3782ee154f00be0000.web-security-academy.net/files/avatars/04.png>

![image.png](https://1216248185-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdwRvuHbGnKvUioATlOOa%2Fuploads%2Fgit-blob-9d1c6970b5d7e30dd2643f2945b735e2a6c85c80%2Fimage%202.png?alt=media)

1. `<?php echo file_get_contents('/home/carlos/secret'); ?>`

![image.png](https://1216248185-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdwRvuHbGnKvUioATlOOa%2Fuploads%2Fgit-blob-b7318069f23206216810170d3767d7d17fd8d64c%2Fimage%203.png?alt=media)

![image.png](https://1216248185-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdwRvuHbGnKvUioATlOOa%2Fuploads%2Fgit-blob-e8f817bbdc335d7bee1fc76ddf975eacaed60290%2Fimage%204.png?alt=media)

**The server is configured to prevent execution of user-supplied files**

![image.png](https://1216248185-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdwRvuHbGnKvUioATlOOa%2Fuploads%2Fgit-blob-0e4c29017665ac3c638bb35915dd3ebf92f9d588%2Fimage%205.png?alt=media)

![image.png](https://1216248185-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdwRvuHbGnKvUioATlOOa%2Fuploads%2Fgit-blob-ca9f15a7b4332e69df5a98381c7bb69cbc64d511%2Fimage%206.png?alt=media)

Esto era el secrets:

![image.png](https://1216248185-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdwRvuHbGnKvUioATlOOa%2Fuploads%2Fgit-blob-acda5d39c1a4024e56624b752e92ef4b55fa3820%2Fimage%207.png?alt=media)

Observamos el Admin=False

![image.png](https://1216248185-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdwRvuHbGnKvUioATlOOa%2Fuploads%2Fgit-blob-d70e9dc5cca26ff9b82ef687546e05f0dbfe26e0%2Fimage%208.png?alt=media)