Security checks on uploads

Support
15

Let’s see if we can exploit it first, following those instructions.

  1. Rename exe to gif
  2. Upload
  3. Get people to click on it and run it

I am on a Windows system so this won’t be much for people who aren’t…

  1. Renamed calc.exe to calc.gif. File size 912 KB (933,888 bytes)

  2. Upload it

  3. Provide link to the file (I guess adding the .exe back on at the end… somehow?) https://meta.discourse.org//assets-meta-cdck-prod-meta.s3.dualstack.us-west-1.amazonaws.com/original/3X/7/f/7ffebfee4b3c05a0a8731e859bf20ebb0b98b5fa.gif

In theory this would work for vulnerable PDFs as well, but PDF is a valid upload type, and vulnerable PDF viewers are the problem there, like if the browser’s GIF handling had some kind of buffer overflow.

Ok so I

  1. Download the file. Does seem about the right file size, 911 KB (933,632 bytes)

  2. Rename it to .exe

  3. Run it and get

    Windows SmartScreen has prevented an unrecognized app from running. Running this app might put your PC at risk.

  4. Ok so select file properties, Unblock

  5. Run it and get

1 Like