php-jpeg-injector

php-jpeg-injector Injects php payloads into jpeg images. Related to this post. Use Case You have a web application that runs a jpeg image through PHP's GD graphics library. Description This script injects PHP code into a specified jpeg image. The web application will execute the payload if it...

CVE-2025-50165-x64-Exploit

CVE-2025-50165 Windows Graphics Component RCE x64 Critical Remote Code Execution via malicious JPEG – Windows 11 24H2 unpatched CVSS 9.8 – No privileges, no interaction required CVE-2025-50165 - windowscodecs.dll untrusted pointer dereference Discovered by Zscaler ThreatLabz Patched: November 202...

CVE-2021-22204-exiftool

CVE-2021-22204-exiftool Python exploit for the CVE-2021-22204 vulnerability in Exiftool. About the vulnerability The CVE-2021-22204 was discovered and reported by William Bowling. @wcbowling This exploit was made by studying the exiftool patch after the CVE was already reported. Pre-requisites...

ScreenshotBOF

ScreenshotBOF An alternative screenshot capability for Cobalt Strike that uses WinAPI and does not perform a fork & run. Screenshot downloaded in memory. Features JPEG compression In memory download as screenshot or as file Supports capturing of minimized windows Grayscale, JPEG quality and...

powerglot

Powerglot Powerglot encodes several kind of scripts using polyglots, for example, offensive powershell scripts. It is not needed a loader to run the payload. In red-team exercises or offensive tasks, masking of payloads is usually done by using steganography, especially to avoid network level...

CVE-2025

CVE-2025-43300: iOS/macOS DNG 이미지 처리 메모리 손상 개요 CVE-2025-43300은 Apple 이미지 처리 프레임워크의 치명적인 메모리 손상 취약점으로 iOS 18.6.1 및 macOS 시스템에 영향을 미칩니다. 이 취약점은 RawCamera.bundle 내의 JPEG Lossless 압축 해제 코드에 존재하며, DNG 파일의 TIFF 메타데이터와 JPEG 스트림 매개 변수 간의 불일치로 인해 트리거됩니다. 취약점 세부 정보 근본 원인 이 취약점은 DNG디지털 네거티브 파일의 메타데이터/스트림...

CVE-2026-5201

CVE-2026-5201 gdk-pixbuf JPEGローダーにおけるヒープベースのバッファオーバーフロー こんにちは、Kağan Çapar です。私は、実質的にすべてのLinuxデスクトップ環境に影響するgdk-pixbufのJPEG画像ローダーにおけるヒープベースのバッファオーバーフロー脆弱性を発見しました。この脆弱性には CVE-2026-5201 が割り当てられ、Red Hat によって CVSS スコア 7.5 重要 として確認されました。 このリポジトリには、私の完全な分析、ゼロから作成した再現コード、および実際の Ubuntu 24.04 LTS...

jsteg

jsteg go get lukechampine.com/jsteg jsteg는 JPEG 파일 내부에 데이터를 숨기는 패키지로, 이 기법을 스테가노그래피라고 합니다. 데이터의 각 비트를 이미지의 최하위 비트에 복사하여 숨깁니다. 숨길 수 있는 데이터의 양은 JPEG 파일 크기에 따라 달라지며, 숨겨진 데이터 1바이트당 약 1014바이트의 JPEG 저장 공간이 필요합니다. 예제 // 기존 JPEG 열기 f, := os.Openfilename img, := jpeg.Decodef // 숨겨진 데이터 추가 out, :=...

CVE-2025-43300

CVE-2025-43300: iOS/macOS DNG Image Processing Memory Corruption Overview CVE-2025-43300 is a critical memory corruption vulnerability in Apple's image processing framework that affects iOS 18.6.1 and macOS systems. The vulnerability exists in the JPEG Lossless decompression code within...

ssrf-sheriff

SSRF Sheriff This is an SSRF testing sheriff written in Go. It was originally created for the Uber H1-4420 2019 London Live Hacking Event, but it is now being open-sourced for other organizations to implement and contribute back to. Features Respond to any HTTP method GET, POST, PUT, DELETE, etc...

php-jpeg-injector

php-jpeg-injector PHP 페이로드를 JPEG 이미지에 주입합니다. 이 게시물과 관련이 있습니다. 사용 사례 JPEG 이미지를 PHP의 GD 그래픽 라이브러리를 통해 처리하는 웹 애플리케이션이 있습니다. 설명 이 스크립트는 지정된 JPEG 이미지에 PHP 코드를 주입합니다. 웹 애플리케이션이 이미지를 해석할 경우 페이로드를 실행합니다. 입력 JPEG이 압축되지 않았는지 확인하세요! 사용법 python3 gd-jpeg.py JPEG PAYLOAD OUTPUTJPEG 예: python3 gd-jpeg.py cat.jp...

RLSA-2026:74457 Moderate: ghostscript security update

The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed. Security Fixes: ghostscript: ghostscript: Heap buffer overflow via JPEG 2000 output adapter...

CVE-2019-20326

CVE-2019-20326 GNOME gThumb과 Linux Mint Pix는 Cairo 그래픽 라이브러리로 여러 이미지 형식을 표시하기 위해 cairoio 모듈을 사용합니다. gThumb 3.8.3 미만 및 Pix 2.4.5 미만 버전에서 cairoio는 너비 또는 높이가 32767픽셀을 초과하는 JPEG 이미지를 통해 힙 버퍼 오버플로에 취약합니다. 이 취약점은 extensions/cairoio/cairo-image-surface-jpeg.c의 cairoimagesurfacecreatefromjpeg 함수에 존재합니다...

Dropper

ステルスドロッパー JPEG/PNG このプロジェクトは、JPG/PNG形式の画像にペイロードを埋め込み、開いたときに特定のアクションを実行できるようにするツールです。 🚫 免責事項 このリポジトリは教育目的のみ で提供されており、許可されたセキュリティ研究 を目的としています。 これらの資料を無断または違法な活動に使用することは固く禁じられています 。 プロジェクトの作業と exploit3r.py の使用ガイド このプロジェクトはCMake を使用して、Python...

Moderate: Red Hat Security Advisory: ghostscript security update

An update for ghostscript is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fro...

ghostscript: ghostscript: Heap buffer overflow via JPEG 2000 output adapter

A flaw was found in Ghostscript. This heap-based buffer overflow vulnerability in the JPEG 2000 output adapter allows an attacker to cause memory corruption by supplying a specially crafted PDF file. The crafted PDF contains a JPEG 2000 image with mismatched component subsampling factors...

RHEL 9 : ghostscript (RHSA-2026:74457)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:74457 advisory. The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats...

ghostscript security update

9.54.0-19.1 - RHEL-264921 CVE-2026-39919 ghostscript: Heap buffer overflow in JPEG 2000 JPXDecode output adapter...

Inject-PHP-to-JPG-Using-Jhead

Jhead를 사용하여 JPG에 PHP 주입하기 $ pkg install vim or apt-get install vim $ pkg install jhead or apt-get install jhead $ jhead -h 도움말 보기 $ jhead -purejpg yourfiles.jpg $ jhead -ce yourfiles.jpg ESC를 누른 후 :x를 입력하여 저장하세요 $ jhead yourfiles.jpg 예시 : site.com/youfiles.php?cmd=Command Here...

Moderate: Red Hat Security Advisory: ghostscript security update

An update for ghostscript is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fr...