Members Online
Total Online: 36 Web Spiders: 13
Guests Online: 32
Members Online: 4
Registered Members: 70189 Newest Member: CrownClown
|
View Thread
| Author |
image overflow |
pwnmstr
Member
Posts: 31
Location:
Joined: 07.05.05
Rank: Moderate |
|
I know .tif pictures can contain scblockedripts that allow for overflows etc. But how do you add scblockedript to a tif iimage? Or get it to run code? THanks
 |
|
| Author |
RE: image overflow |
fagitz
Member
Posts: 142
Location: That one place
Joined: 23.09.05
Rank: Mad User |
|
|
I know of ways to contain php in the meta data of any image, but not specifically tifs. |
|
|
| Author |
RE: image overflow |
wolfmankurd
Member
Posts: 1519
Location: UK
Joined: 30.05.05
Rank: God |
|
try using a hex editor and typing the code in, may need to ad dbytes to the end.
BY READING MY POST, YOU ACCEPT IT AS IS AND AGREE TO MY DISCLAIMER OF ALL WARRANTIES, EXPRESS OR IMPLIED, AS WELL AS DISCLAIMERS OF ALL LIABILITY, DIRECT, INDIRECT, CONSEQUENTIAL OR INCIDENTAL, THAT MAY ARISE FROM THE USE OF THIS (MIS)INFORMATION.
|
 
|
| Author |
RE: image overflow |
pwnmstr
Member
Posts: 31
Location:
Joined: 07.05.05
Rank: Moderate |
|
|
fagitz wrote:
I know of ways to contain php in the meta data of any image, but not specifically tifs.
how do you do that?
wolfmankurd wrote:
try using a hex editor and typing the code in, may need to ad dbytes to the end.
what do you mean dbytes?
|
|
|
| Author |
RE: image overflow |
fagitz
Member
Posts: 142
Location: That one place
Joined: 23.09.05
Rank: Mad User |
|
Well, this isn't a great way to do it, and if the other method works, I'd do that. First, you'll have to read up on php and then you'll be inserting this code into an actual image.
Have the image and open it up in something like notepad, it's then just a case of adding the php to the end of the image and then naming it fdfsdfsd.php.
This may not work for a lot of situations, since most things will disallow any .php extensions. This is only useful because it's still actually an image, and because of this, hotornot.com was exploited due to the fact it only checked if it was an image (didn't check extensions). When the server came to it, it saw it as fsjfslsdf.php and ran it. |
|
|
|
|
|
Main:
