Quantcast
Channel: @ONsec_Lab
Viewing all articles
Browse latest Browse all 24

PHP all getimage() bypass

$
0
0
Many PHP projects have image validation, based on getimagesize() function:
http://php.net/manual/ru/function.getimagesize.php

That function has an error, provides attacker to read Berkley DB format and another files, started at 0x00 (null-byte).

<?php
if(getimagesize("/etc/aliases.db")){
   echo "OK";
}
?>
#php -f gis-test.php
OK

In *BSD systems and MacOS Berkley DB files used as configs.
It may be used by attacker to bypass image reading functions based on getimagesize().

We used that trick on PHD pre-hackquest's (Blow Up the Town) task called Tretyakovskaya.
It was sucessfull find by participants listed below:
rdot.org
shr
AVictor
Antichat
MERRON
letm
sc2tv
DarkByte
ei-grad
vos
korvin
grixa
n0ne
Endragor
tiger
Greetz, guys!

Viewing all articles
Browse latest Browse all 24

Trending Articles