Skip to content
Proof-of-concept to exploit the flaw in the PHP-GD built-in function, imagecreatefromgif()
PHP
Branch: master
Clone or download

Latest commit

Fakhri Zulkifli
Fakhri Zulkifli Update README.md
Latest commit c9a8b6f Jun 22, 2015

Files

Permalink
Type Name Latest commit message Commit time
Failed to load latest commit information.
README.md Update README.md Jun 22, 2015
payload.php

README.md

Exploiting PHP-GD imagecreatefromgif() function

Developer uses GD (or Imagemagick) library in order to prevent image header script execution by recreating the image with the new one. This will wipe the image headers, and any embedded code present.

This is the script to generate the payload

<?php
$gif = imagecreatefromgif('poc.gif');
imagegif($gif, 'exploit.gif');
imagedestroy($gif);
?>

So this is the hexadecimal dump before the new image recreation. As you can see at the 4th and 5th lines, there are nothing and please notice that there are still EXIF data.

before

After the recreation, the new image file hexadecimal dump also have that "sweet spot" where nothing is appended there. Also the EXIF data is already removed after the recreation process. So let's try injecting our backdoor there.

after

Now, the PHP backdoor is appended at that blank space because this is the only space that stay the same before and after the recreation process.

before

Voila !, as you can see the code is still there even after the recreation of new image file.

after

So what next? the attacker just need to append .php extension and upload the exploit.

You can’t perform that action at this time.