webmedium

Магическая камера 3000 (MagCam 3000) — HackerLab

hackerlab

Task: Web app processes PNG uploads with ImageMagick. Solution: Exploited CVE-2022-44268 by injecting tEXt chunk with profile path to read /etc/passwd, extracted hex-encoded flag from output image metadata.

$ ls tags/ techniques/
imagemagicklfipngcve-2022-44268file-readarbitrary-file-read
cve_exploitationpng_chunk_injectionmetadata_exfiltration
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Create a free account with GitHub, then upgrade to Pro.

$ssh [email protected]