# <![CDATA[How I could've taken over the production server of a Yahoo acquisition through command injection]]>

Command injection in SnackTV's getImg.php via unsanitized imageurl parameter passed to ImageMagick, allowing arbitrary command execution on production server.

- Payout: $3,000
- Severity: critical
- Program: SnackTV
- Credited: Sam Curry
- Disclosed: 2017-06-04
- Write-up quality: 7/10
- Original: https://samcurry.net/how-i-couldve-taken-over-the-production-server-of-a-yahoo-acquisition-through-command-injection
- Library page: https://bugbountylibrary.com/r/blog%3Asamcurry-net-how-i-couldve-taken-over-the-production-server-of-a-yahoo-acquisition-through-command-injection
- Tags: domain:web impact:internal-access impact:rce kind:research platform:research sev:critical technique:recon technique:source-review vuln:command-injection vuln:rce

**Target:** PHP web application (getImg.php) using ImageMagick
**Root cause:** The imageurl GET parameter is directly interpolated into an ImageMagick command without sanitization, allowing shell metacharacter injection.
**Steps:**
1. Discover getImg.php via dirsearch and Google dork `site:snacktv.de filetype:php`.
2. Identify parameters like `imageurl` from Google cache.
3. Send `GET /imged/getImg.php?imageurl="` to trigger ImageMagick error, confirming command execution context.
4. Send `GET /imged/getImg.php?imageurl=";ls` to execute `ls` and list directory contents.
**How found:** After failing ImageTragick payloads, noticed error messages when sending a double quote, hypothesized URL was injected into ImageMagick command, then tested semicolon to break out and execute commands.
**Exploitation:** Attacker sends crafted GET request with shell metacharacters in imageurl parameter, causing the server to execute arbitrary commands, leading to full server compromise.
**Insight:** When testing for command injection in image processing, try injecting quotes and semicolons directly into URL parameters to detect if the URL is concatenated into a shell command, rather than relying solely on known ImageTragick payloads.