I'm doing some testing on executing remote PHP via PHP hidden inside a PNG file. I've got a PNG file on my server with the following PHP code stored inside the PNG file.


The idea being is that I pass a GET request with shell_exec OR exec function, followed by POST data 1 = the command to run.

I have been trying to use curl without success. I keep getting HTTP/1.1 404 not found.

curl' -i -d "1=id"

Any ideas what can I use to send the GET request and include the POST data?

  • The PHP handler won't launch if the file extension is .png.
    – Polynomial
    May 11, 2016 at 8:55
  • There is a legacy nginx misconfiguration which resulted in some non-PHP files being passed through the interpreter, although this has not applied to new installs for several years now.
    – Matthew
    May 11, 2016 at 8:59

2 Answers 2


First of all, make sure that your webserver knows that it has to interpret PNG file as PHP. You need to add this to your .htaccess file.

AddHandler application/x-httpd-php .png


AddHandler application/x-httpd-php5 .png

Otherwise, it won't execute the PHP code.

Second, there's a syntax error in your curl request. You're missing a quote.

Try this:

curl -i -X POST "" -d "1=id"

Files ending in .png will not execute php code even if they contain php code. You can however execute this code either through a LFI or by uploading a .htaccess file which will add a php handler for .png or in the case of Apache you could use a double file extansion, ie: phppng.php.phppng.

  • And if you can upload a .htaccess file you can just do this instead: github.com/wireghoul/htshells
    – wireghoul
    May 11, 2016 at 8:58
  • Can you give more info on the the double file extension thing?
    – symcbean
    May 11, 2016 at 11:37
  • There isn't really any good reference docummentation apart from mod_mime itself, which can be found here; httpd.apache.org/docs/2.4/mod/mod_mime.html#multipleext
    – wireghoul
    May 13, 2016 at 11:12
  • I must admit I was a bit skeptical - but this looks viable / interesting / scary.
    – symcbean
    May 13, 2016 at 11:59
  • Just tested it and it works (i.e. is exploitable).
    – symcbean
    May 13, 2016 at 14:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.