ImageTragick Command Injection in ImageMagick Coders

This repository contains a single Metasploit module: 'ImageMagick Delegate Arbitrary Command Execution' (modules/exploits/unix/fileformat/imagemagick_delegate.rb). The module exploits command injection vulnerabilities in the way ImageMagick processes 'delegate' commands for file conversions, affecting versions <= 7.0.1-0 and <= 6.9.3-9 (legacy). The exploit works by generating a malicious image file (SVG, MVG, or PS) that, when processed by a vulnerable ImageMagick installation, executes arbitrary shell commands supplied by the attacker. The module supports multiple file formats and vectors, including a popen() vector and a Ghostscript delegate bypass. The payload is customizable via the Metasploit framework and is encoded to avoid problematic characters. The only notable file path in the code is '/dev/tty', used as a placeholder in the template mechanism. The module references CVE-2016-3714 and CVE-2016-7976, and is weaponized for operational use within Metasploit. The repository is structured as a typical Metasploit exploit module, with all logic contained in a single Ruby file.

This repository provides a comprehensive exploit toolkit for CVE-2016-3714 (ImageMagick 'ImageTragick'). It contains two main exploit components: 1. 'imagick_builder.py' is a Python script that interactively generates malicious image files (MVG, SVG) designed to exploit vulnerable ImageMagick installations. It supports payloads for remote code execution, file read, file move, file delete, and SSRF. The script allows the user to specify commands, file paths, or URLs to embed in the payloads, and outputs the crafted images to an 'output/' directory. 2. 'imagick_bypass_shell.php' is a PHP web shell that leverages the Imagick extension to bypass PHP's disabled functions and execute system commands, read arbitrary files, or delete files on the server. It provides a web interface where attackers can supply parameters (cmd, read, del) to perform these actions. The shell works by generating and processing malicious image payloads on the fly using Imagick. The repository also includes a 'classes/colors.py' module for colored terminal output in the Python script, and a README.md with usage instructions and screenshots. The main attack vectors are network-based (uploading or processing malicious images via web applications) and local (abusing the Imagick extension on the server). Several fingerprintable endpoints are present, including example file paths and web shell URLs. The exploit is operational and provides both payload generation and a ready-to-use web shell for post-exploitation.

This repository provides a set of proof-of-concept (POC) exploits for CVE-2016-3714 (ImageTragick), targeting vulnerable ImageMagick installations. The exploit leverages the ability to embed shell commands within MVG and SVG image files, which are then executed by the server when processed by ImageMagick. The repository contains multiple payloads in different scripting languages (bash, nc, perl, php, python), each designed to establish a reverse shell or execute arbitrary commands on the target server. The structure is organized by payload type and includes both direct reverse shell payloads and command execution tests (e.g., using curl, wget, ping, telnet, nslookup). The README provides usage instructions, indicating that the attacker should set up a listener (e.g., with netcat) and upload the crafted image files to a vulnerable server. The endpoints used in the payloads are primarily localhost (127.0.0.1) for demonstration, but one payload targets an external IP (114.34.41.13). The repository is a comprehensive demonstration of the ImageTragick vulnerability and its exploitation via malicious image uploads.