mike-williams / imagetragick-poc Goto Github PK

This github repo contains poc material for CVE 2016-3714. This project is for experimentation & reference purposes only. This project is unsupported.

This project contains a dockerfile and simple AngularJS/NodeJS app to build a vulnerable web app container to see how the vulnerability can be exploited.

To run, first you need to build the Docker image which will install Centos along with a vulnerable version of imagemagick:

docker build -t magick .

To start the container run the following command: docker run -it -p 3000:3000 magick. This will take you to a shell. To start the web app run node app.js.

Access the web app at http://localhost:3000

Try and upload the file touch.mvg. An error is expected but afterwards quit out of node with Ctrl+C and check the /tmp/ folder to see if the exploit has been successful.

Thats it, have fun!