Challenge

A dashboard that converts uploaded images using ImageMagick on the server side.

Approach

  1. ImageMagick supports a text: pseudo-coder that reads a text file and renders it as an image.
  2. Craft an SVG that causes ImageMagick to include file contents:
1

<image href="text:/flag.txt" .../>

Or use the label: coder in a convert command:

1

convert 'text:/flag.txt' out.png
  1. Upload/trigger the conversion and retrieve the rendered image — it contains the flag text.

Flag

boroCTF{I'v3_n3v3r_been_T0_sch00l_3ithEr}