Skip to content
attack.paths
Anmelden
← RegistryDossier · 6 steps · 5 edges

File upload bypass → webshell → RCE

Upload filter checks extension or MIME but not magic bytes / final path. Bypass via double extension, content-type spoof, or polyglot, then call the dropped script.

Filed by AD Knowledge Base
§ Kill-chainDrag · zoom · scroll

§ Context

Assumed environment: app accepts user uploads (avatars, attachments, document import). Uploaded files are stored in a web-served directory.

§ Steps

  1. 01
    Execute shell commands via webshellExecution
    W-CMDI— OS Command Injection
  2. 02
    Bypass with double-ext / polyglot / null-byteInitial Access
    W-UPLOAD-BYPASS— File Upload Filter Bypass

    shell.php.jpg / shell.phtml / .htaccess + .jpg combo.

  3. 03
    Probe filter (ext / MIME / magic / path)Initial Access
    W-UPLOAD-BYPASS— File Upload Filter Bypass
  4. 04
    Find upload endpointReconnaissance
    W-RECON-API-DISCO— API Endpoint Discovery
  5. 05
    Plant secondary backdoorPersistence
    W-WEBSHELL— Webshell Deployment
  6. 06
    Drop webshellPersistence
    W-WEBSHELL— Webshell Deployment

§ Frequently asked

What is the "File upload bypass → webshell → RCE" attack path?
Upload filter checks extension or MIME but not magic bytes / final path. Bypass via double extension, content-type spoof, or polyglot, then call the dropped script. It chains 6 steps drawn from real-world offensive-security techniques.
What starting position does this attack require?
The first step is Execute shell commands via webshell (W-CMDI) — a execution primitive. Assumed environment: app accepts user uploads (avatars, attachments, document import).
What is the final impact of this kill-chain?
The final step lands on Drop webshell (W-WEBSHELL), which falls under Persistence. From here, an operator typically pivots into post-exploitation or maintains persistence.
How can defenders detect or prevent this attack?
Detection and prevention vary per step. Refer to each linked MITRE ATT&CK entry under "References" — every technique on that page lists defensive controls, detection telemetry, and known threat-actor usage.

§ Related dossiers