Is it possible to bypass protection for loading php in this section of code?

Question

PHP

raw day.
In the process of completing one of the tasks on hackthebox, I encountered a difficulty.
There is a file upload form. I plan to pour a shell through it.
A directory with the source code of the script was also found.
In fact, the check is carried out in 2 places.

function file_mime_type($file) {
  $regexp = '/^([a-z\-]+\/[a-z0-9\-\.\+]+)(;\s.+)?$/';
  if (function_exists('finfo_file')) {
    $finfo = finfo_open(FILEINFO_MIME);
    if (is_resource($finfo)) // It is possible that a FALSE value is returned, if there is no magic MIME database file found on the system
    {
      $mime = @finfo_file($finfo, $file['tmp_name']);
      finfo_close($finfo);
      if (is_string($mime) && preg_match($regexp, $mime, $matches)) {
        $file_type = $matches[1];
        return $file_type;
      }
    }
  }
  if (function_exists('mime_content_type'))
  {
    $file_type = @mime_content_type($file['tmp_name']);
    if (strlen($file_type) > 0) // It's possible that mime_content_type() returns FALSE or an empty string
    {
      return $file_type;
    }
  }
  return $file['type'];
}

I bypassed this protection by simply adding the php code to the end of the content of the jpg image
. But there is a second function that checks the file name and checks it

list ($foo,$ext) = getnameUpload($myFile["name"]);
    $validext = array('.jpg', '.png', '.gif', '.jpeg');
    $valid = false;
    foreach ($validext as $vext) {
      if (substr_compare($myFile["name"], $vext, -strlen($vext)) === 0) {
        $valid = true;
      }
    }

I don't know what to do with this.
I tried so file.php%00.jpg file.php?dd=.jpg - the file is loaded, but when accessed by the file name, the server writes that the file was not found
Hence 2 questions.
1. Have I bypassed protection 1 correctly, will the code in the graphic file be executed but with the php extension?
And if not, what would be the best way to do it?
2. How can I bypass check 2?
Thank you in advance

Answer 1

1. Right. There are a bunch of articles on the Internet (as well as answers on the toaster) that present this garbage as a panacea.
2. I wouldn't mind seeing how to get around this myself. Perhaps she does not do it on the forehead. for some reason, there is a line list ($foo,$ext) = getnameUpload($myFile["name"]);despite the fact that the result is not used anywhere. Perhaps it is $ext that is checked next, and you need to look at the getnameUpload code

Answer 2

I bypassed this protection by simply adding the php code to the end of the content of the jpg image

- all your code is killed by easy image resizing by 1 pixel. In general, here is a good article: https://habr.com/en/post/44610/