Exf at 13:43, 13 October 2022

2022-10-13T13:43:30Z

← Older revision		Revision as of 13:43, 13 October 2022
Line 1:		Line 1:
			[[File:Exiftool-task.PNG\|thumb\|Exiftool-task]]
			[[File:Metasploit1.PNG\|thumb\|Metasploit search with exiftool]]
			[[File:Metasploit2.PNG\|thumb\|Metasploit setting up exiftools payload]]
			[[File:Netcat.PNG\|thumb\|nc -lpv 4444]]
			[[File:Exiftool-flag.PNG\|thumb\|Home directory and flag.txt]]

	===Description===		===Description===
	Test the security of this online Exiftool service.		Test the security of this online Exiftool service.

Exf at 13:40, 13 October 2022

2022-10-13T13:40:32Z

← Older revision		Revision as of 13:40, 13 October 2022
Line 1:		Line 1:
	===Description===		===Description===
	Test the security of this online Exiftool service.		Test the security of this online Exiftool service.

			100pts
	===Question===		===Question===
	Can you find the vulnerability and exploit it?		Can you find the vulnerability and exploit it?

Exf at 13:40, 13 October 2022

2022-10-13T13:40:19Z

← Older revision		Revision as of 13:40, 13 October 2022
Line 28:		Line 28:
	* Netcat		* Netcat
	===Flag===		===Flag===
	<code>ctftech{ff379755-33f}</~~flag~~>		<code>ctftech{ff379755-33f}</code>
	===Links===		===Links===
	*[[CTF Challenges \| Back to CTF Challenges page]]		*[[CTF Challenges \| Back to CTF Challenges page]]

Exf: Created page with "===Description=== Test the security of this online Exiftool service. ===Question=== Can you find the vulnerability and exploit it? Can you find the flag from the home folder. ===Solution=== Since the mission description talks about vulnerability and exploits. It is thereforce worth looking to see if there are ready exploits in Metasploit. I started the Metasploit and searched for exiftools as a keyword and immediately found an interesting exploit. `ExifTool DjVu..."`


2022-10-13T13:40:07Z
Created page with "===Description=== Test the security of this online Exiftool service. ===Question=== Can you find the vulnerability and exploit it?  Can you find the flag from the home folder. ===Solution=== Since the mission description talks about vulnerability and exploits. It is thereforce worth looking to see if there are ready exploits in Metasploit.  I started the Metasploit and searched for exiftools as a keyword and immediately found an interesting exploit.  <code>ExifTool DjVu..."
New page
===Description===

Test the security of this online Exiftool service.

===Question===

Can you find the vulnerability and exploit it?



Can you find the flag from the home folder.

===Solution===

Since the mission description talks about vulnerability and exploits. It is thereforce worth looking to see if there are ready exploits in Metasploit.



I started the Metasploit and searched for exiftools as a keyword and immediately found an interesting exploit.



<code>ExifTool DjVu ANT Perl injection</code>

I looked online to see how the exploit works. In practice, it's a very simple exploit where you just enter the port and ip address that the vulnerable computer is trying to connect to. 



I sent the target machine this malicious "image" and at the same time listened to the port with the netcat command: <code>nc -lvp 4444</code>.



The target machine did connect to my computer, but unfortunately I couldn't use the target machine's shell. 



Next, I looked to see which reverse shell the payload was sending and found that it was an unknown to me. I modified a parameter in the metasploit to send a bash reverse shell command with the payload.

<code>set payload cmd/unix/reverse_bash</code>



I then restarted netcat to listen on port 4444 and resent the malicious image file to the server. 



I was then able to connect to the server and had a bash shell enabled. Next I scanned the files and found the target file in the home folder /home/user1337. The file name was flag.txt

===Tools===

* Metasploit

* ExifTool DjVu ANT Perl injection [[https://www.infosecmatter.com/metasploit-module-library/?mm=exploit/unix/fileformat/exiftool_djvu_ant_perl_injection]]

* Netcat

===Flag===

<code>ctftech{ff379755-33f}</flag>

===Links===

*[[CTF Challenges | Back to CTF Challenges page]]

Nexif - Revision history

Exf at 13:43, 13 October 2022

Exf at 13:40, 13 October 2022

Exf at 13:40, 13 October 2022