phpBB hack

I was reading a blog on the phpBB hack (http://hackedphpbb.blogspot.com/ - is is actually down now) and they stated that they uploaded an avatar which had some code in it (i think it was just listing a directory or something similar). Does anyone have anymore information regarding running code inside images? How would this be prevented? I would like to do some testing with this but cant really find much information on the topic.

There was a exploit with IE where you can run Machine code in the image when displayed to the end user.

Other then that was i have discovered myself is that if you ask your user to upload some image say "this-is-an-image.jpg"

and you are storing the image on your website some where with the same name.

so you some one upload a picture with file name "this-is.php?some-image.jpg"
this will be saved as this-is.php on your server, i think only works with linux web servers.

so best would be to use some number when saving file on the server side.

i am not sure the above link explains the same i have not checked but just wanted to make you aware.

Thanks & regards

Quote:

---

Originally Posted by Keith

I was reading a blog on the phpBB hack (http://hackedphpbb.blogspot.com/ - is is actually down now) and they stated that they uploaded an avatar which had some code in it (i think it was just listing a directory or something similar). Does anyone have anymore information regarding running code inside images? How would this be prevented? I would like to do some testing with this but cant really find much information on the topic.

---

check this link
http://www.google.com/search?q=cache...ient=firefox-a

Yeah i found an article that said pretty much the same thing.

I also remember reading that there was a vulnerability with MS OS and the way that they handled images. The hack was on a linux box so this wouldnt work.

The article didnt really say how he did it, so he might of used the php method.

Quote:

---

There was a exploit with IE where you can run Machine code in the image when displayed to the end user.

---

I wouldn't call a graphical API a problem with IE.

Quote:

---

this will be saved as this-is.php on your server, i think only works with linux web servers.

---

Um, you do realise PHP can be installed on pretty much anything right?

Quote:

---

so best would be to use some number when saving file on the server side.

---

The best thing to do would be to prevent people from uploading web based scripts altogether. Meh... you wouldn't beleave how quickly search engines pick up on junk like r57 and c99shell. Infact, ten seconds after some chump uploads scripts like that someone else will have already gained enought privileges to overwrite everything in the web directory.

Quote:

---

The article didnt really say how he did it, so he might of used the php method.

---

You may want to take another look at the link that was posted.

Quote:

---

Originally Posted by The-Spec

Quote:

---

Originally Posted by Keith;

I also remember reading that there was a vulnerability with MS OS and the way that they handled images.

---

That would be true if we where talking about a driver. Otherwise it's an application flaw and therefore isn't much of a component to the operating system itself.

---

What about this? http://www.microsoft.com/technet/sec.../MS04-028.mspx

Quote:

---

Originally Posted by The-Spec;

Quote:

---

Originally Posted by Keith;

The article didnt really say how he did it, so he might of used the php method.

---

You may want to take another look at the link you posted.

---

Looked over it again, so he didnt use the PHP method. Any thoughs on how he did it?