Sploitus

Exploit for Improper Input Validation in Imagemagick

githubexploit · 2016-05-07

Exploit Code

README20 lines
## https://sploitus.com/exploit?id=D2B66F73-6413-5B31-BD8E-D8D1CDBB88E0
# CVE-2016-3714
ImageMagick Code Execution (CVE-2016-3714)

imagick_builder.py = Simple Payload Builder to Exploit CVE-2016-3714
imagick_bypass_shell.php = PHP based web shell leveraging the PHP imagick extension wrapper to bypass disabled functions

Few Images of things working:
Payload Builder:

imagick payload vs vBulletin 4.x w/ImageMagick Enabled:

server side after payload triggers:



Web Shell:
Command Execution:

File Read: