webPromedium
Lab 324 — ImageMagick RCE (PixelForge)
hackadvisor
Task: Digital art gallery platform (PixelForge) processes EPS uploads via ImageMagick 7.x + GhostScript with -dNOSAFER. Solution: Exploited CVE-2023-36664 by uploading a malicious EPS file with PostScript %pipe% operator to execute shell commands, writing the flag to a web-accessible path.
$ ls tags/ techniques/
command_injectionflaskimagemagickrcefile_uploadnginxdecoy_flagghostscriptpostscriptepspipe_operatornosafetythumbnail_generationcve_2023_36664
honeypot_flag_detectionghostscript_pipe_command_executionnosafety_misconfiguration_exploitpostscript_rce_via_thumbnailblind_file_write_to_webroot
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Sign in with GitHub to continue. No email required.
$sign in$ grep --similar
Similar writeups
- [web][Pro]Lab 126 — AssetForge — RCE via Ghostscript Pipe Device Bypass (CVE-2023-36664)— hackadvisor
- [web][Pro]Lab 94 — MediaForge — ImageMagick Command Injection via File Upload (ImageTragick)— hackadvisor
- [web][Pro]Lab 343 — FrameCast — RCE via Ghostscript EPS Processing in Thumbnail Import— hackadvisor
- [web][Pro]InkDrop— hackadvisor
- [web][Pro]Lab 345 — PrintForge — RCE via Ghostscript Command Injection— hackadvisor