Level 21

Platform: kslweb1 | Category: Web | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2026-03-08 | Status: Solved Techniques: mime_type_manipulation, multipart_header_control

Summary

Task: File upload form requiring .php extension with image/png MIME type. Solution: Use curl -F with filename and type parameters to control both values independently in multipart/form-data request.

Level 21 — KSL Web 1

Description

A page with a file upload form. The task requires uploading a file with .php extension but image/png MIME type. The hint asks "how do i upload file in raw http?".

Stack: PHP/5.5.9-1ubuntu4.21, Apache/2.4.7 (Ubuntu), nginx/1.18.0.

Analysis

In a multipart/form-data request, the file extension and MIME type are independent parameters:

• filename — in the Content-Disposition header of the request part
• Content-Type — a separate header for each part

The client fully controls both values. The server checks $_FILES['myfile']['name'] (extension) and $_FILES['myfile']['type'] (MIME), but both come from the client. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Solution

 bash read-only • copy allowed Copy
curl -s -X POST http://kslweb1.spb.ctf.su/second/level21/ \
  -F "myfile=@/dev/null;filename=shell.php;type=image/png"

curl -F parameters:

• @/dev/null — file content (empty)
• filename=shell.php — filename with .php extension
• type=image/png — MIME type image/png

Result:

Done! Flag: KSL{REDACTED}

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍