CVE-2018-16323 is a memory leakage in processing XBM images. After XBM image was converted to another image type you can extract leaked memory bytes from image data.
Discovered by d4d.
A pretty simple tool for generating CVE-2018-16323 PoC. Directory
samples contains some pregenerated PoCs easy for use.
For using this tool you should install imagemagick:
apt-get -y install imagemagick
And check it:
Any version is suitable.
Usage poc generator: ./XBadManners.sh gen WIDTHxHEIGHT NAME.xbm [minimal] Example gen: ./XBadManners.sh gen 512x512 poc.xbm Example gen: ./XBadManners.sh gen 1024x1024 poc_minimal.xbm minimal Usage result recovery: ./XBadManners.sh recover SAVED_PREVIEW.png|jpeg|gif|etc Example recovery: ./XBadManners.sh recover avatar.png
minimal allows you to generate smallest possible XBM's body for pasting in BurpSuite or whatever you want. Minimal mode was tested and it works just fine. You can set any width and height in this mode.
Notice that you can extract a lot of memory using single image. The only restriction is a limitation for maximum size of the produced image by backend.
You can try to recover
preview.png. If you get readable words in output then this means that everything works just fine.
Step by step
./XBadManners.sh gen 512x512 poc.xbm
- Upload PoC to the server.
- Download preview and run
./XBadManners.sh recover result.png
Nice call if preview changes significantly from one upload to another.
Recovery mode is created for a quick check and should work fine for any ImageMagick supported image formats but it was tested only for png, jpeg and gif. You can tune logic of memory extraction from image by modifying the script (it's simple but ugly)
How does it look like?
XBM is a black and white format. So, any result will look like kind of a zebra (if you have good imagination). Basicly, more black == more data extracted.