search

neex / gifoeb

exploit for ImageMagick's uninitialized memory disclosure in gif coder
279 stars 60 forks source link

Need some help to get more valid info #5

Open riramar opened 5 years ago

riramar commented 5 years ago

First, thanks for the exploit! 🥇 I have a web application that you can upload gifs but I'm only able to download converted jpgs in 200x200 and 100x100. In order to find the best --colors value I did this:

for i in `seq 1 255`; do echo $i; /root/gifoeb/gifoeb recover_test 100x100 --format jpg --colors $i; done
for i in `seq 1 255`; do echo $i; /root/gifoeb/gifoeb recover_test 200x200 --format jpg --colors $i; done

And found the best values are for 100x100.

--colors 2
test completed, 6 bytes total, 1 recovered wrong (16.00%)

--colors 188
test completed, 564 bytes total, 447 recovered wrong (79.00%)

From the output seems the lowest % (--colors 2) should be the best but I was unsure so I tried both. But in both cases I can get only small fragments like "y!whth!ImageNagidk- z0.1.0- {|B2". The preview image has the following specifications:

# file preview.ext 
preview.ext: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 100x100, frames 3

Is there anything else that I can do to get more valid info from this web application?

Thanks! Ricardo Iramar

riramar commented 5 years ago

BTW the "--colors" option should be used in the steps 1, 4 and 6 from your "How to use"? What about the parameter "--format jpg"?