We have modified the DocumentName header value to hold our script. Now let’s try to run the exploit remotely on the webserver by embedding the phpinfo() pop into the DocumentName header of a random JPEG image.Įxiftool is a great command-line tool for editing the EXIF tag metadata for image files. We see that the php code is parsed from the random data and executed by the interpreter. Then when we test accession the file (interpreting it as php): Here we insert the phpinfo() pop into the random data and upload it to the server. So by crafting a script, we can test our RCE by implanting it in a document with random data to emulate headers from a JPEG file. When the image is loaded by the page, the php tags located in the headers are interpreted as php code and run by the server. However, while researching bypass techniques I discovered a technique to hide php code in the EXIF data of the image file. Looking up the function, it doesn’t seem like there are any exploits to pass non-image files through it (barring a 0-day which I most certainly don’t have). This time it is more involved that just checking the file-extension, and the php function getimagesize is invoked.

If( ( strtolower( $uploaded_ext ) = 'jpg' || strtolower( $uploaded_ext ) = 'jpeg' || strtolower( $uploaded_ext ) = 'png' ) &Īha, so we have some server-side checking to ensure that the uploaded file is indeed an image. $uploaded_ext = substr( $uploaded_name, strrpos( $uploaded_name, '.' ) + 1)

Php exiftool exploit