webPromedium
Lab 307 — CrewHub — File Upload RCE via Polyglot JPG/PHP
hackadvisor
Task: PHP project management app with avatar upload validated by GD library, but preserving original file extension and not stripping EXIF data. Solution: craft a polyglot JPG/PHP with a webshell in EXIF ImageDescription, upload with .php extension to bypass GD validation, then execute commands to read /root/flag.txt.
$ ls tags/ techniques/
php_webshell_uploaddecoy_flag_identificationjpeg_php_polyglot_via_exiffile_extension_bypassgd_library_content_validation_bypass
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Sign in with GitHub to continue. No email required.
$sign in$ grep --similar
Similar writeups
- [web][Pro]Lab 163 — PostFlow — Unrestricted File Upload via Avatar Feature— hackadvisor
- [web][Pro]Lab 314 — PixVault — ExifTool DjVu RCE via Image Upload— hackadvisor
- [web][Pro]Lab 205 — DockForge — SSRF in Webhook Test Endpoint— hackadvisor
- [web][Pro]Lab 162 — VaultDrop — File Upload Race Condition (TOCTOU)— hackadvisor
- [web][Pro]Revenge Upload— hackerlab