How to upload file with curl when –data-binary is present in tampered data

curl

I try to upload files to a popular website, I tampered the http POST requests with Chrome developer tools' "copy as curl" feature. When the upload begins I get this curl command:

curl 'http://example.com/cgi-bin/upload.pl?upload_id=869ab8e228f7bd92bfaebc6d6bf31470' -H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8' -H 'Referer: http://example.com/upload.php?action=gallery&gid=0&title=My+precious+car' -H 'Origin: http://example.com' -H 'User-Agent: Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.114 Safari/537.36' -H 'Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryAh0xuOK8vajmXWbY' --data-binary $'------WebKitFormBoundaryAh0xuOK8vajmXWbY\r\nContent-Disposition: form-data; name="type"\r\n\r\n1\r\n------WebKitFormBoundaryAh0xuOK8vajmXWbY\r\nContent-Disposition: form-data; name="gid"\r\n\r\n0\r\n------WebKitFormBoundaryAh0xuOK8vajmXWbY\r\nContent-Disposition: form-data; name="title"\r\n\r\nMy precious car\r\n------WebKitFormBoundaryAh0xuOK8vajmXWbY\r\nContent-Disposition: form-data; name="resize"\r\n\r\n\r\n------WebKitFormBoundaryAh0xuOK8vajmXWbY\r\nContent-Disposition: form-data; name="private"\r\n\r\n\r\n------WebKitFormBoundaryAh0xuOK8vajmXWbY\r\nContent-Disposition: form-data; name="cat1"\r\n\r\n24\r\n------WebKitFormBoundaryAh0xuOK8vajmXWbY\r\nContent-Disposition: form-data; name="cat2"\r\n\r\n65\r\n------WebKitFormBoundaryAh0xuOK8vajmXWbY\r\nContent-Disposition: form-data; name="cat3"\r\n\r\n13\r\n------WebKitFormBoundaryAh0xuOK8vajmXWbY\r\nContent-Disposition: form-data; name="upfile_0"; filename="1.zip"\r\nContent-Type: application/zip\r\n\r\n\r\n------WebKitFormBoundaryAh0xuOK8vajmXWbY\r\nContent-Disposition: form-data; name="upfile_1"; filename=""\r\nContent-Type: application/octet-stream\r\n\r\n\r\n------WebKitFormBoundaryAh0xuOK8vajmXWbY--\r\n' --compressed

Or look at here: http://pastebin.com/3Jaj0mSs

When I try to use this from command line (after logging in and getting cookies, and upload_id, etc), file upload progress doesn't start. I have tried to add options to the curl command "-T 1.zip" or "–data-binary @1.zip" or making filename like "<1.zip" but no success, I always get error message: "Send failure: Broken pipe". Filename 1.zip is at the end part of the "–data-binary" section of the long command. What can I do to make curl work in this situation and make the file upload done correctly?

Best Answer

I looked at it in with Fiddler and the problem is that Chrome erases the file content from the curl request it generates. So you have to insert it back in.

I got it to work with http://www.zippyshare.com/.

Here was the curl request Chrome generated

curl "http://www72.zippyshare.com/upload" -H "Origin: http://www.zippyshare.com" -H "Accept-Encoding: gzip,deflate,sdch" -H "Accept-Language: en-US,en;q=0.8" -H "User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36" -H "Content-Type: multipart/form-data; boundary=----------KM7cH2GI3Ef1gL6GI3ei4Ef1Ij5KM7" -H "Accept: */*" -H "Referer: http://www.zippyshare.com/" -H "Cookie: __utma=46003887.80665104.1404275690.1404275690.1404275690.1; __utmb=46003887.1.10.1404275690; __utmc=46003887; __utmz=46003887.1404275690.1.1.utmcsr=google|utmccn=(organic)|utmcmd=organic|utmctr=(not"%"20provided); ziplocale=en" -H "Proxy-Connection: keep-alive" --data-binary '------------KM7cH2GI3Ef1gL6GI3ei4Ef1Ij5KM7
Content-Disposition: form-data; name="Filename"

Giant_Panda_Tai_Shan.jpg
------------KM7cH2GI3Ef1gL6GI3ei4Ef1Ij5KM7
Content-Disposition: form-data; name="uploadify"

true
------------KM7cH2GI3Ef1gL6GI3ei4Ef1Ij5KM7
Content-Disposition: form-data; name="embPlayerValues"

null
------------KM7cH2GI3Ef1gL6GI3ei4Ef1Ij5KM7
Content-Disposition: form-data; name="Filedata"; filename="Giant_Panda_Tai_Shan.jpg"
Content-Type: application/octet-stream


------------KM7cH2GI3Ef1gL6GI3ei4Ef1Ij5KM7
Content-Disposition: form-data; name="Upload"

Submit Query
------------KM7cH2GI3Ef1gL6GI3ei4Ef1Ij5KM7--' --compressed

I divided the data into two pieces where the file was.

Part 1:

------------KM7cH2GI3Ef1gL6GI3ei4Ef1Ij5KM7
Content-Disposition: form-data; name="Filename"

Giant_Panda_Tai_Shan.jpg
------------KM7cH2GI3Ef1gL6GI3ei4Ef1Ij5KM7
Content-Disposition: form-data; name="uploadify"

true
------------KM7cH2GI3Ef1gL6GI3ei4Ef1Ij5KM7
Content-Disposition: form-data; name="embPlayerValues"

null
------------KM7cH2GI3Ef1gL6GI3ei4Ef1Ij5KM7
Content-Disposition: form-data; name="Filedata"; filename="Giant_Panda_Tai_Shan.jpg"
Content-Type: application/octet-stream

.

(That . wasn't at the end, I added it just now to get the code block to recognize there are two blank lines at the end of the file.)

Part 2:

.
Submit Query
------------KM7cH2GI3Ef1gL6GI3ei4Ef1Ij5KM7--

(Again with the .)

Also you need to make sure the files are in CRLF format.

Now you can run 

cat part1.txt Giant_Panda_Tai_Shan.jpg part2.txt > complete

Then to run it

curl "http://www72.zippyshare.com/upload" -H "Referer: http://www.zippyshare.com/" -H "Origin: http://www.zippyshare.com" -H "User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36" -H "Content-Type: multipart/form-data; boundary=----------KM7cH2GI3Ef1gL6GI3ei4Ef1Ij5KM7" --data-binary @complete --compressed

It runs (takes a few seconds to upload) and returns html confirming the successful upload.

Related Question