Upload Image to RCE — By CTRL

السلام عليكم ورحمة الله وبركاته

Scenario

Remote Code Execution

Remote code execution (RCE) refers to the ability of a cyber attacker to access and make changes to a computer owned by another, without authority and regardless of where the computer is geographically located. RCE allows an attacker to take over a computer or a server by running arbitrary malicious software (malware).

Proof of Concept

Step 1: you Can see I can upload image for my profile by extension .jpg.

upload image

Step 2 :Step 2 :By using burp suite intercept request and upload index php extension jpg and intercept request and change extension to .php .

Step 3: Now I have full control of the server.

mood

Step 4 :About twenty domains under my control.

Mood

Impact

RCE vulnerabilities can have severe impacts on a system or application, including:

• Penetration — attackers can use RCE vulnerabilities as their first entry into a network or environment.
• Privilege escalation — in many cases, servers have internal vulnerabilities which can only be seen by those with inside access. RCE allows an attacker to discover and exploit these vulnerabilities, escalating privileges and gaining access to connected systems.
• Sensitive data exposure — RCE can be used to exfiltrate data from vulnerable systems by installing data-stealing malware or directly executing commands. This can range from simple copying of unencrypted data to memory-scraping malware that looks for credentials in system memory.
• Denial of Service (DoS) — an RCE vulnerability allows attackers to execute code on a system. This code can be used to exhaust system resources and crash the system, or to leverage the system’s resources to conduct DoS against third parties.
• Cryptomining — a common next step after exploiting RCE is to run cryptomining or cryptojacking malware that uses the computing resources of an infected device to mine cryptocurrencies, to the financial benefit of the attacker.
• Ransomware — possibly the most dangerous consequence of RCE is that attackers can deploy ransomware on the affected application or server, and spread ransomware through the network, denying users access to their files until they pay a ransom.

Recommendations

you can see in list URL some Recommendations:

1. https://cheatsheetseries.owasp.org/cheatsheets/File_Upload_Cheat_Sheet.html
2. https://www.acunetix.com/vulnerabilities/web/unrestricted-file-upload/
3. https://www.invicti.com/web-vulnerability-scanner/vulnerabilities/unrestricted-file-upload/
4. https://knowledge-base.secureflag.com/vulnerabilities/unrestricted_file_upload/unrestricted_file_upload_vulnerability.html
5. https://thesecmaster.com/what-is-arbitrary-file-upload-vulnerability-how-to-protect-form-it/

Note: Educational explanation