I Hacked Another File Upload Website
Source: YouTube · John Hammond · published Dec 12, 2023 · 32:52
This video demonstrates a command injection vulnerability in a CRLF (Carriage Return Line Feed) converter web application 0:00.
Key Takeaways:
• The application fails to properly sanitize user-provided filenames in the upload functionality, allowing command injection through the dos2unix utility 7:00-7:44
• The vulnerability occurs because the code retrieves filename directly from the uploaded object rather than using the sanitized basename 8:50-8:56
• Using dos2unix's -f and -n parameters, attackers can achieve arbitrary file read and write capabilities 10:00-10:33
• The presenter demonstrates reading /etc/passord to verify file read access 15:30-15:42
• By locating the application path via /proc filesystem, the attacker backdoors the Flask app with a reverse shell endpoint 22:30-23:20
• Finally, privilege escalation using sudo with dosbox allows reading the flag from root's home directory 30:50-31:03
The video showcases a real CTF challenge exploitation path from initial command injection to full system compromise.
Sources:
- 0:00 Introduction to the CRLF converter vulnerability
- 7:00-7:44 Vulnerability in file upload processing
- 8:50-8:56 The os.path.basename security flaw
- 10:00-10:33 Using dos2unix parameters for file operations
- 15:30-15:42 Testing arbitrary file read with /etc/passord
- 22:30-23:20(https://www.yo
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
This is a simple file upload service, but of course it can be hacked. All that this web application is is a carriage return line feed converter or CRLF. If you aren't familiar, there are different kinds of line endings for plain text on your computer. There's a carriage return line feed, which is most commonly found on Windows operating systems, and just a new line, which you typically see on Linux or Macbased operating systems. Let me show you. Say I were on Windows and I just created a new simple text file. We can call that file from Windows and I'll double click to open it in notepad and I can enter anything I want. Hello world. Maybe uh please subscribe. Right. I'll go ahead and save this file. Ctrl S on my keyboard. And now I'll hop over to my Kali Linux virtual machine where I'll go …