Home page logo
/

fulldisclosure logo Full Disclosure mailing list archives

Re: Php gif upload thumbnail creation remote exploit
From: "HI-TECH ." <isowarez.isowarez.isowarez () googlemail com>
Date: Sun, 19 Jun 2011 13:35:33 +0200

A good and working example for this technique is the "EQdkp-Plus" PHP Software,
the URL http://<hostname>/dkp/plugins/mediacenter/upload.php
allows to upload image files. There are two checks made by the software:
* Extensions check, where they forget to check for the php3 extension,
which might be parsed by the webserver as php code.
* Check if the upload is actually an image.

When the user uploads the image it´s thumbnail appears under
http://<host>/dkp/data/e6c2ee4aac968c19f61eeaab09401374/mediacenter/thumbs_b/229684607dfcae84b89ae669c9056268.php3
this link can be found by searching for the entry which was uploaded
using the search tool.

Normally the embedded php code will not appear in the php3 file
because of thumbnail creation which modifies the GIF file.
The GIF processing code in EQdkp-Plus is the following:

$size = GetImageSize($image);

if($size[2] != 0){

                        //CREATE THUMBNAILS
                        $thumb_path = $pcache->FolderPath($dest_folder, 'mediacenter');
                        $pic_width = $size[0];
                        $pic_height = $size[1];
                        
                        if ($pic_width >= $pic_height){
                                $thumb_width = $width;
                                $thumb_height = intval($pic_height*$thumb_width/$pic_width);

                        } else {
                                $thumb_height = $height;
                                $thumb_width = intval($pic_width*$thumb_height/$pic_height);

                        }
                        // GIF
                        if ($size[2] == 1){
                                $picture = ImageCreateFromGIF($image);
                                $thumbnail = ImageCreateTrueColor($thumb_width, $thumb_height);
                                $white = imageColorAllocate ($thumbnail, 0, 0, 0);
                                $trans = imagecolortransparent($thumbnail,$white);
                                ImageCopyResampled($thumbnail, $picture, 0, 0, 0, 0, $thumb_width,
$thumb_height, $pic_width, $pic_height);
                                ImageGIF($thumbnail, $thumb_path.$pic_name);
                                //chmod($thumb_path.$pic_name,0644);
                        }
...

As you can see this is a standart procedure to create a thumbnail out
of the image.

0000h: 47 49 46 38 39 61 << 00 00 00 00 00 00 00 >> 00 00 00  GIF89a..........
0010h: 00 00 33 00 00 66 00 00 99 00 00 CC 00 00 FF 00  ..3..f..™..Ì..ÿ.
...
...
...
0980h: 56 40 00 00 3B 3C 3F 20 70 68 70 69 6E 66 6F 28  V ()   ;<? phpinfo(
0990h: 29 3B 20 3F 3E                                   ); ?>

The bytes enclosed by "<<" and ">>" are zeroed out with a hex editor
so that after the processing of the GIF file
the php code (which is embedded at the very bottom of the GIF file)
stays inside the file.

-kc

2011/6/19 Владимир Воронцов <vladimir.vorontsov () onsec ru>:
http://ax330d.blogspot.com/2011/06/mosaic-of-attacks-from-image-upload.html?showComment=1308462489303#c952957474393688505

On Sun, 19 Jun 2011 02:58:16 +0200, "HI-TECH ."
<isowarez.isowarez.isowarez () googlemail com> wrote:
This technique describes how to exploit apps which encode pictures
during a
Php upload. Embedding Php code inside gif files which are uploaded is a
known technique to execute arbitrary code on a Apache Php installation.
Now
what can one do when the code which uploads the file processes and
encodes
the file to a thumbnail and only this thumbnail is accessible remotely
with
the correct extension? The gif file is crunshed and the embedded Php
code
disappears, bad situation you might think. The solution is to zero out
all
size fields of the gif file using a hex editor. The result after the
upload
is that the encoding routine processes the file without modifying it
because
of size checks. The Php code stays embedded in the file. -kc

--
Best regards,
Vladimir Vorontsov
ONsec security expert


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]