hacking contest

hacking exploits security forum
hacking
compliance articles
upgrade backup exec
information security consultant
Help - Search - Member List - Calendar
GovernmentSecurity.org > The Archives > General Network Security
Psychotec
May 5 2004, 08:36 AM
Below you see 3 ways of uploading files to a server. Note you have to have web based commandpromt to do this. I hope this is usefull for you guys.

Perl - upload.cgi

Using Perl and cgi-lib.pl, it is easy to create an uploader script. The following example shows how:

CODE

#!/usr/bin/perl

require "cgi-lib.pl";

print &PrintHeader;
print "<form method='POST' enctype='multipart/form-data' action='upload.cgi'>\n";
print "File path: <input type=file name=upfile>\n";
print "<input type=submit value=upload></form>\n";
&ReadParse;


------------------------------------------------------------------------------------------------

PHP - upload.php

Creating an uploader with PHP is just as simple.

CODE

<FORM ENCTYPE="multipart/form-data" ACTION="upload.php" METHOD=POST>
<INPUT TYPE="hidden" name="MAX_FILE_SIZE" value="10000000">
<input type="File" name="userfile" size="30">
<INPUT TYPE="submit" VALUE="upload">
</FORM>

<?php
  if($userfile_name != "") {
     copy("$userfile", "./$userfile_name") or die("Couldnt copy file");
     echo "File name: $userfile_name<br>\n";
     echo "File size: $userfile_size bytes<br>\n";
     echo "File type: $userfile_type<br>\n";
  }
?>


------------------------------------------------------------------------------------------------

ASP - upload.asp and upload.inc

CODE

<form method=post ENCTYPE="multipart/form-data">
<input type=file name="File1">
<input type="submit" Name="Action" value="Upload">
</form>
<hr>  
<!--#INCLUDE FILE="upload.inc"-->
<%
If Request.ServerVariables("REQUEST_METHOD") = "POST" Then
  Set Fields = GetUpload()
  If Fields("File1").FileName <> "" Then  
     Fields("File1").Value.SaveAs Server.MapPath(".") & "\" & Fields("File1").FileName
     Response.Write("<LI>Upload:  " & Fields("File1").FileName)  
  End If
End If
%>  


The source code of the associated file upload.inc, this one is required

Upload.inc

CODE

<script RUNAT=SERVER LANGUAGE=VBSCRIPT>
Function GetUpload()  
  Dim Result
  Set Result = Nothing  
  If Request.ServerVariables("REQUEST_METHOD") = "POST" Then  
     Dim CT,PosB,Boundary,Length,PosE
     CT=Request.ServerVariables("HTTP_Content_Type")  
     If LCase(Left(CT, 19)) = "multipart/form-data" Then  
        PosB = InStr(LCase(CT), "boundary=")  
        If PosB > 0 Then Boundary = Mid(CT, PosB + 9)  
        PosB = InStr(LCase(CT), "boundary=")  
        If PosB > 0 then  
           PosB = InStr(Boundary, ",")  
           If PosB > 0 Then Boundary = Left(Boundary, PosB - 1)  
        end if  
        Length = CLng(Request.ServerVariables("HTTP_Content_Length"))  
        If Length > 0 And Boundary <> "" Then  
           Boundary = "--" & Boundary  
           Dim Head,Binary
           Binary = Request.BinaryRead(Length)
           Set Result = SeparateFields(Binary, Boundary)
           Binary = Empty  
        Else  
           Err.Raise 10, "GetUpload", "Zero length request ."  
        End If
     Else  
        Err.Raise 11, "GetUpload", "No file sent."  
     End If
  Else  
     Err.Raise 1, "GetUpload", "Bad request method."  
  End If
  Set GetUpload = Result
End Function

Function SeparateFields(Binary, Boundary)  
  Dim POB,PCB,PEOH,iLB,Fields
  Boundary=STB(Boundary)
  POB=InStrB(Binary,Boundary)
  PCB=InStrB(POB+LenB(Boundary),Binary,Boundary,0)
  Set Fields=CreateObject("Scripting.Dictionary")
  Do While (POB > 0 And PCB > 0 And Not iLB)  
     Dim HC,FC,bFC,C_D,FFN,SFN,C_T,Field,TCAEB
     PEOH=InStrB(POB+Len(Boundary),Binary,STB(vbCrLf + vbCrLf))
     HC=MidB(Binary,POB+LenB(Boundary)+2,PEOH-POB-LenB(Boundary)-2)  
     bFC=MidB(Binary,(PEOH+4),PCB-(PEOH+4)-2)
     GetHeadFields BTS(HC),C_D,FFN,SFN,C_T
     Set Field=CUF()
     Set FC=CBD()
     FC.ByteArray=bFC
     FC.Length=LenB(bFC)  
     Field.Name=FFN
     Field.ContentDisposition=C_D
     Field.FilePath=SFN
     Field.FileName=GFN(SFN)
     Field.ContentType=C_T
     Field.Length=FC.Length
     Set Field.Value=FC
     Fields.Add FFN,Field
     TCAEB=BTS(MidB(Binary,PCB+LenB(Boundary), 2))
     iLB=TCAEB="--"  
     If Not iLB Then  
        POB=PCB
        PCB=InStrB(POB + LenB(Boundary), Binary, Boundary)  
     End If
  Loop
  Set SeparateFields = Fields
End Function

Function GetHeadFields(ByVal Head, C_D, Name, FileName, C_T)  
  C_D=LTrim(SeparateField(Head,"content-disposition:",";"))
  Name=(SeparateField(Head, "name=", ";"))
  If Left(Name, 1) = """" Then Name = Mid(Name, 2, Len(Name) - 2)  
  FileName = (SeparateField(Head, "filename=", ";"))  
  If Left(FileName, 1) = """" Then
     FileName = Mid(FileName, 2, Len(FileName) - 2)
  End If
  C_T = LTrim(SeparateField(Head, "content-type:", ";"))
End Function

Function SeparateField(From, ByVal sStart, ByVal sEnd)  
  Dim PosB, PosE, sFrom
  sFrom = LCase(From)
  PosB = InStr(sFrom, sStart)  
  If PosB > 0 Then  
     PosB = PosB + Len(sStart)
     PosE = InStr(PosB, sFrom, sEnd)  
     If PosE = 0 Then PosE = InStr(PosB, sFrom, vbCrLf)  
     If PosE = 0 Then PosE = Len(sFrom) + 1  
     SeparateField = Mid(From, PosB, PosE - PosB)  
  Else  
     SeparateField = Empty  
  End If
End Function

Function GFN(FullPath)  
  Dim Pos, PosF
  PosF = 0  
  For Pos = Len(FullPath) To 1 Step -1  
     Select Case Mid(FullPath, Pos, 1)  
        Case "/", "\"
           PosF = Pos + 1
           Pos = 0  
     End Select  
  Next  
  If PosF = 0 Then PosF = 1
  GFN = Mid(FullPath, PosF)
End Function

Function BTS(Binary)  
  Dim cl1, cl2, cl3, pl1, pl2, pl3, L
  cl1=1
  cl2=1
  cl3=1
  L = LenB(Binary)  
  Do While cl1<=L  
     pl3 = pl3 & Chr(AscB(MidB(Binary,cl1,1)))
     cl1=cl1+1
     cl3=cl3+1  
     if cl3>300 then  
        pl2 = pl2 & pl3
        pl3 = ""
        cl3 = 1
        cl2 = cl2 + 1
        if cl2>200 then  
           pl1 = pl1 & pl2
           pl2 = ""
           cl2 = 1
        End If  
     End If  
  Loop  
  BTS = pl1 & pl2 & pl3
End Function

Function STB(String)  
  Dim I, B  
  For I=1 to len(String)
     B = B & ChrB(Asc(Mid(String,I,1)))
  Next  
  STB = B
End Function

Function vbsSaveAs(FileName, ByteArray)  
  Dim FS,TextStream
  Set FS = CreateObject("Scripting.FileSystemObject")
  Set TextStream = FS.CreateTextFile(FileName)
  TextStream.Write BTS(ByteArray)
  TextStream.Close
End Function
</SCRIPT>

<script RUNAT=SERVER LANGUAGE=JSCRIPT>
function CUF() {
  return new uf_Init()
}

function uf_Init() {
  this.Name=null;
  this.ContentDisposition=null;
  this.FileName=null;
  this.FilePath=null;
  this.ContentType=null;
  this.Value=null;
  this.Length=null
}

function CBD() {
  return new bin_Init()
}

function bin_Init() {
  this.ByteArray=null
  this.Length=null
  this.String=jsBTS
  this.SaveAs=jsSaveAs
}  

function jsBTS() {
  return BTS(this.ByteArray)
}

function jsSaveAs(FileName) {
  return vbsSaveAs(FileName, this.ByteArray)
}
</SCRIPT>  


i hope you guys enjoy

Regards,
Psycho
NW_DJW
May 5 2004, 09:53 AM
Awsome dude, gonna check these codes out. Thnx for these m8 biggrin.gif
realloader
May 5 2004, 03:06 PM
It is not clear, i dont understand that:
Please tell me , how to do?
My Adresse:
http://lycos.realloead.com/trojaner.exe
I wanna upload to remote server in:
C:\windows\trojaner.exe
Please some clearly!
Psychotec
May 5 2004, 03:43 PM
how to do what m8?? i posted 3 ways of uploading, please be more specific

anyway i think its kinda stupid question, if you just look good enough and open your eyes you will see how to do this
realloader
May 5 2004, 04:14 PM
Why do u post ur code in here?
I think, u post this code for newbies such like me and when i can code by my self, i dont need ur code!
I can not code and i dont understand ur code.
Ex.:
#!/usr/bin/perl

require "cgi-lib.pl";

print &PrintHeader;
print "<form method='POST' enctype='multipart/form-data' action='upload.cgi'>\n";
print "File path: <input type=file name=upfile>\n";
print "<input type=submit value=upload></form>\n";
&ReadParse;

Where shall i change?
http://www.xxxxx.com/nc.exe
6066up9r
May 5 2004, 08:23 PM
thanks for the great information m8!
6066up9r
May 5 2004, 08:44 PM
these are great commands to use, thanks!
Psychotec
May 6 2004, 07:57 AM
QUOTE (realloader @ May 5 2004, 04:14 PM)
Why do u post ur code in here?
I think, u post this code for newbies such like me and when i can code by my self, i dont need ur code!
I can not code and i dont understand ur code.
Ex.:
#!/usr/bin/perl

require "cgi-lib.pl";

print &PrintHeader;
print "<form method='POST' enctype='multipart/form-data' action='upload.cgi'>\n";
print "File path: <input type=file name=upfile>\n";
print "<input type=submit value=upload></form>\n";
&ReadParse;

Where shall i change?
http://www.xxxxx.com/nc.exe

well...did you ever worked with perl? Becuz then i recommend you to read this site:
-->"Web Programming Using Perl"<--

and here is an example of the script:
-->Demonstration of using CGI_LIB.pl for HTTP File Upload<--

and here you can find everything about how to do it:
-->Using CGI_LIB.pl<--

I hope this will help you.

l0n9ker
May 8 2004, 01:16 PM
Thx!
But i can't access php_upload on the web run:xp Home,PHP 4.3.3RC1 Apache2.
ZakOpath
May 9 2004, 09:58 AM
Got this error whit ASP


GetUpload error '800a000b'

No file sent.

upload.inc, line 27
This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.
 
Invision Power Board © 2001-2005 Invision Power Services, Inc.