+- Sinisterly (https://sinister.ly)
+-- Forum: Hacking (https://sinister.ly/Forum-Hacking)
+--- Forum: Website & Server Hacking (https://sinister.ly/Forum-Website-Server-Hacking)
+--- Thread: Execute code in image file. (/Thread-Execute-code-in-image-file)
Execute code in image file. - aka4tomix - 03-20-2013
I am doing a penetration test on an internal system and have successfully bypassed file upload validation. Unfortunately, the system (written in php) will rename my file to "random_number.tff". However, I do have access to the file through the upload folder (which is a finding in itself). I have successfully uploaded an EICAR file that was processed and FTP'ed to an internal system so that is an additional finding.
I would like to find a way to execute arbitrary code in the image file though. Is it possible to execute code that is in an image? I have validated the code still exist in the file. I don't know if files in the upload system are executable.
Thanks in advance for any suggestions or advice.
RE: Execute code in image file. - zomgwtfbbq - 03-20-2013
There are two scenarios in which you can do this:
1- ability to edit or upload a htaccess file and add a rewrite rule
2- get access to the webserver and reconfigure it so that ttf files will be parsed by php, then restart the webserver
RE: Execute code in image file. - hackoboy - 07-26-2013
You must CHMOD rx the file...
If you still don't understand, maybe the hacking Scene Is NOT a good place for you...Beat It, kiddo !
RE: Execute code in image file. - The Real Slim Shady - 07-26-2013
(07-26-2013, 04:08 PM)hackoboy Wrote: You must CHMOD rx the file...
If you still don't understand, maybe the hacking Scene Is NOT a good place for you...Beat It, kiddo !
what a useless post. i can tell the hacking scene has no use for you thats for sure.
RE: Execute code in image file. - aka4tomix - 08-05-2013
Thanks for the help guys.... minus the idiot of course!
I wasn't able to exploit it due to .htaccess not allowing execution of .tiff.
RE: Execute code in image file. - ch3rn0byl - 08-17-2013
(07-26-2013, 04:15 PM)Geoff Wrote:(07-26-2013, 04:08 PM)hackoboy Wrote: You must CHMOD rx the file...
If you still don't understand, maybe the hacking Scene Is NOT a good place for you...Beat It, kiddo !
what a useless post. i can tell the hacking scene has no use for you thats for sure.
Get'em Geoff! Haha!! I've seen you devour people like that :troll: