m0leCon CTF 2025

Web challenge writeups from m0leCon CTF 2025 - ImageMagick argument injection, arbitrary write with -write, MIFF metadata survival past exiftool, and PHP webshell RCE.

0 categories 1 note

Notes

1 total

magik - ImageMagick -write arbitrary PHP drop via MIFF comment metadata

Abuse an unquoted ImageMagick output argument in convert.sh to split a controlled filename into extra convert arguments. Use -write for an arbitrary web-root write, upload a MIFF image whose comment contains PHP, bypass exiftool's metadata cleanup, then execute /readflag through the dropped PHP webshell.

web php imagemagick convert file-upload image-processing +8