1 reply to this topic

[grayhats]

This module exploits a shell command injection in the way "delegates"

        (commands for converting files) are processed in ImageMagick versions

        <= 7.0.1-0 and <= 6.9.3-9 (legacy).

 

        Since ImageMagick uses file magic to detect file format, you can create

        a .png (for example) which is actually a crafted SVG (for example) that

        triggers the command injection.

 

        Tested on Linux, BSD, and OS X. You'll want to choose your payload

        carefully due to portability concerns. Use cmd/unix/generic if need be.

 

Tutorial:

 

Edited by grayhats, 18 May 2016 - 07:07 Uhr.

[0*ptr]

convert 'https://"|echo "vuln' 1337.0ptr

PoC for local testing.

Edited by 0*ptr, 17 May 2016 - 20:53 Uhr.