Script to create polyglot files. It combines the content of a PHP file with an existing JPG image.
More details on how this is used:
https://organicdarius.com/blog/an-intro-to-polyglot-files/
Usage:
ruby phppoly.rb <destination_jpg_file> <source_php_file> [--outname=name]
Here, --outname is optional and will default to avatar.
ruby phppoly.rb dest.jpg my_php_exploit.php
This will not affect the input files. It creates two new files in both JPG and PHP format.
There's a Proof of Concept created, more info on the POC directory.
Copy the two new files to the POC folder.
cp avatar.jpg avatar.php proof_of_concept
Inspired by https://github.com/Wuelle/js_jpeg_polyglot