HTB: Pilgrimage

Easy HTB machine where a website is used to reduce the size of images. Then an Image Magick exploit is used for file read vulnerability. Though that the SQLite3 database can be enumerated.

Enumeration

nmap shots port 22 and port 80 open.

Next to this scan that checks the default ports, I also run a port scan on all ports using -p- to make sure I don’t miss anything. The results from this were the same.

I add the following line in my /etc/hosts file 10.10.11.219 pilgrimage.htb

And the following website shows

I can register for an account

I can upload a file and shrink it, after which I receive a long URL to the shrunken file.

Let’s test if I can upload a malicious php reverse shell or web shell.
No luck after testing if I can upload a malicious php web shell.

I turn back and enumerate the box again, maybe I missed something. And yes, did I miss something, after the initial enumeration, i added pilgrimage.htb to my /etc/hosts file, but nmap couldn’t run other scripts against the domain. So i re-ran the nmap scan on port 80 and this time it also showed http-git

Great, now I can use gitdump to see all the files.

GitDump

And I end up with all these files:

Shell as Emily

It uses ImageMagick to parse the files, it uses version 7.1.0-49

A quick google gets me to a github page with an exploit for CVE-2022-44268.

I first generate a malicous png file

I then upload that file via the webinterface, so it gets compressed using imagemagick and then download the result again.

I then use the imagemagick from the git repository (the same that is being used on the live server) to identify the result

From there I copy the Raw profile type, and paste it in the following snipped

It then dumps all the /etc/passwd data! great, I could ofcourse read the users flag this way, but I want to do it via a shell session.

Now the question, what files do I want to read…
After I looked through the git files again, especially the register.php I noticed the following code snippet that shows where our username and passwords are being saved. Lets try to read this via the vulnerability.

After doing the same process as before, but now with /var/db/pilgrimage i ended up witha gigantic hex file that I somehow need to parse to sqlite.

I found the following stackoverflow question where it explains how I can transform the hex to binary again, so I can read it via sqlite.
xxd -r -p db_raw_oneline.hx db.bin

I now run this file via sqlite3 db.bin, since I am unfamiliar with the syntax, I checkout this quick and easy guide. And there we have a password for emily, as you might remember, emily was also in the /etc/passwd dump.

And I successfully login!

Shell as root

Running ps aux shows a process malwarescan.sh that is not normal

Containing the following code

It uses binwalk in the code, I check the version in order to see if there is anything that can be exploited.

Google gave me the following exploit db post

Using the exploit, I had to put the generated file in /var/www/pilgrimage.htb/shrunk, since that is where the malwarescan.sh checks the files.

After that I listen via nc, and succesfully get a shell as root.