Exploit for Code Injection in Exiftool Project Exiftool

## https://sploitus.com/exploit?id=819D8E03-36B4-5710-9315-BD393F247181
# CVE-2021-22204

About the vulnerability
---
Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image. 
Fixed starting with version 10.40-1+deb9u1.


Python3 RCE exploit
---
This script installs all the required software and generates all the required files for creating an RCE image file to exploit [CVE-2021-22204](https://nvd.nist.gov/vuln/detail/CVE-2021-22204).
### Usage

Change the IP and Port in the python file. When your run the file as user, it will ask you for your sudo password to install the prerequisites djvulibre-bin and exiftool. If you know you already have that installed, you can comment out line 56 in the script.

![image](https://user-images.githubusercontent.com/80063008/150674558-e34023bd-1e8f-47fb-8c19-b796bf0ba599.png)


Original research made by [@wcbowling](https://twitter.com/wcbowling) here: https://devcraft.io/2021/05/04/exiftool-arbitrary-code-execution-cve-2021-22204.html.

Parts of the script were inspired by: https://github.com/convisolabs/CVE-2021-22204-exiftool made by [@dutraguss](https://twitter.com/dutraguss) and [@htrgouvea](https://twitter.com/htrgouvea)