In file upload attack, sometimes overwriting existing sensitive files such as web.config, .htaccess, or crossdomain.xml is needed in order to bypass protections around the uploaded files.
I found out that PHP on IIS (I used FastCGI) converts the following characters when it is going to save a file in Windows:
Greater-than symbol (closing angle bracket “>”) TO a question mark (“?”)
Less-than symbol (opening angle bracket “<”) TO an asterisk symbol (“*”)
Double quotation mark (“””) TO a dot character (“.”)
This feature can be abused to bypass file extension protections in which a file uploader accepts a file name without any extension or uses a blacklist method to check the file name and extension.
Now as an example, in order to overwrite a web.config file in the upload directory when the .config extension is blocked, it is possible to use “filename=”web<<“” in the file upload request. If “web**” replaces another file in the same directory (for example web.aspx), another combination can be used such as “filename=”web<<>fig”” or “filename=’web”config’”.
Note 1: Windows 8.3 feature could also be used but it would rename the web.config file to web~1.con in the end.
Note 2: Asterisk and question mark symbols cannot be used directly as the file system rejects them.
Note 3: Sometimes WordPress replaces double and single quotation marks with visually similar symbols. Therefore, it is recommended to type the vectors yourself in Burp Suite or other proxies that you use instead of copy/paste them directly from here.
You can also see the first version of my “File in The Hole” slides located at the following URL: https://soroush.secproject.com/blog/2012/11/file-in-the-hole/
I have found this technique myself so please send me a link if you had seen it somewhere else before, and I will add its link here as well.
Updates – similar efforts on this topic (this method was known before as expected!):
https://github.com/ironbee/ironbee-rules/blob/master/support/php/test_fs_evasion.php
http://gynvael.coldwind.pl/download.php?f=PHP_LFI_rfc1867_temporary_files.pdf
http://www.ush.it/2009/07/26/php-filesystem-attack-vectors-take-two/