PNG-Sec

spbctf

Task: Flask PNG compressor runs a backdoored ImageMagick 7.0.10-16 convert on uploads. Solution: analyze source diff (injected tEXt backdoor in ReadOnePNGImage) plus CVE-2022-44268 PNG arbitrary file read; craft a PNG whose tEXt chunk is `profile\\x00flag.txt` so convert embeds the hex-encoded flag into the served output image's `Raw profile type txt` chunk.