Pilgrimage
Writeup Hack The Box Pilgrimage
![](https://htb.linuxsec.org/~gitbook/image?url=https%3A%2F%2F1891775682-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252F2YxxNVC63IWuD2WxadSC%252Fuploads%252F0EcphQHPgLhL6sDDAsT2%252FPilgrimage.png%3Falt%3Dmedia%26token%3D51589587-3634-44a6-a649-ca721b479983&width=768&dpr=4&quality=100&sign=f9739ff0&sv=1)
Port Scanning
First, we perform port scanning on the machine.
![](https://htb.linuxsec.org/~gitbook/image?url=https%3A%2F%2F1891775682-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252F2YxxNVC63IWuD2WxadSC%252Fuploads%252FHjhLUwDnHBUk8x8cFZ3h%252Fimage.png%3Falt%3Dmedia%26token%3Da01e20a3-a68a-430d-b09c-3a4e31202340&width=768&dpr=4&quality=100&sign=fd6697e&sv=1)
We found .git directory on the website.
Exploitation
After we found .git directory, we can dump the directory to get the source code using Git Dumper.
![](https://htb.linuxsec.org/~gitbook/image?url=https%3A%2F%2F1891775682-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252F2YxxNVC63IWuD2WxadSC%252Fuploads%252FdKYWriAwrd6KOfEMu1IW%252Fimage.png%3Falt%3Dmedia%26token%3D0cb7b9a6-24bf-4e4c-8caa-915807bfac9f&width=768&dpr=4&quality=100&sign=d9d522d6&sv=1)
Now, move to Pilgrimage.
![](https://htb.linuxsec.org/~gitbook/image?url=https%3A%2F%2F1891775682-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252F2YxxNVC63IWuD2WxadSC%252Fuploads%252FggVodjKZeluN3mfEenO9%252Fimage.png%3Falt%3Dmedia%26token%3Df9438e9e-3f5d-4041-bd49-e9b9628350f1&width=768&dpr=4&quality=100&sign=9407cec9&sv=1)
On index.php, we know that the application using the magick binary to process the image.
![](https://htb.linuxsec.org/~gitbook/image?url=https%3A%2F%2F1891775682-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252F2YxxNVC63IWuD2WxadSC%252Fuploads%252F6wyjH70ZW75Xh8mMSbkt%252Fimage.png%3Falt%3Dmedia%26token%3Da187e7ef-c255-405c-8d66-6bfb878de266&width=768&dpr=4&quality=100&sign=22bb988f&sv=1)
The "magick" binary itself is ImageMagick, open-source software suite, used for editing and manipulating digital images.
![](https://htb.linuxsec.org/~gitbook/image?url=https%3A%2F%2F1891775682-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252F2YxxNVC63IWuD2WxadSC%252Fuploads%252FRDbnw6pU1PMbRvwRnwjV%252Fimage.png%3Falt%3Dmedia%26token%3D0869076d-013f-41ca-93d7-154a75edb22c&width=768&dpr=4&quality=100&sign=234e90df&sv=1)
Search on Google, i found this exploit for ImageMagick 7.1.0-49.
https://www.exploit-db.com/exploits/51261
https://github.com/voidz0r/CVE-2022-44268
After download the exploit, run this command to generate image with payload.
![](https://htb.linuxsec.org/~gitbook/image?url=https%3A%2F%2F1891775682-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252F2YxxNVC63IWuD2WxadSC%252Fuploads%252FLc1dHPCC7Z5lfFQpKq9o%252Fimage.png%3Falt%3Dmedia%26token%3D943a3e1a-8e62-421c-8955-cb3b29c37d75&width=768&dpr=4&quality=100&sign=ee73f0f4&sv=1)
Now, upload the image.png to the target.
![](https://htb.linuxsec.org/~gitbook/image?url=https%3A%2F%2F1891775682-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252F2YxxNVC63IWuD2WxadSC%252Fuploads%252FPzTqvQgcMUELLL5L1uvm%252Fimage.png%3Falt%3Dmedia%26token%3D3b33dc91-6b4d-45fe-a252-1793320f0af3&width=768&dpr=4&quality=100&sign=9ed790ce&sv=1)
Next, download the converted image, and analyze the converted image using this command:
![](https://htb.linuxsec.org/~gitbook/image?url=https%3A%2F%2F1891775682-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252F2YxxNVC63IWuD2WxadSC%252Fuploads%252Fcqt1i8Wkoy2u3tPde9Bt%252Fimage.png%3Falt%3Dmedia%26token%3D60d3c29c-62e6-4b8e-8b34-95e59120bdab&width=768&dpr=4&quality=100&sign=b8592670&sv=1)
Convert the hex to text with xxd command.
![](https://htb.linuxsec.org/~gitbook/image?url=https%3A%2F%2F1891775682-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252F2YxxNVC63IWuD2WxadSC%252Fuploads%252Ffz8K55b5fc5ddW3lBkSd%252Fimage.png%3Falt%3Dmedia%26token%3D48c097be-bf56-47e7-be8f-50fdb068c253&width=768&dpr=4&quality=100&sign=87467b7b&sv=1)
Back to index.php again, we found that the website using sqlite database, stored at /var/db/pilgrimage. We can read the db content using above exploit.
![](https://htb.linuxsec.org/~gitbook/image?url=https%3A%2F%2F1891775682-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252F2YxxNVC63IWuD2WxadSC%252Fuploads%252FveJEFxNDoK6gojSICGQk%252Fimage.png%3Falt%3Dmedia%26token%3Db63f9c8d-ff0c-47aa-9c89-39da9bcb1f6a&width=768&dpr=4&quality=100&sign=e07c1a4d&sv=1)
![](https://htb.linuxsec.org/~gitbook/image?url=https%3A%2F%2F1891775682-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252F2YxxNVC63IWuD2WxadSC%252Fuploads%252FhsjOUeyukKh1Mjz93MjU%252Fimage.png%3Falt%3Dmedia%26token%3D38fe5044-d138-4c7b-8c6b-086176ff2863&width=768&dpr=4&quality=100&sign=2a24a8ad&sv=1)
Again, upload the image to the website, and download the converted image. Next, get the hex value using xxd command.
Since the hex value is too long, you can save the command into a script.
Inside db.sh, add this line:
Then execute this command.
Now, we can use sqlite database client to read the database content.
![](https://htb.linuxsec.org/~gitbook/image?url=https%3A%2F%2F1891775682-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252F2YxxNVC63IWuD2WxadSC%252Fuploads%252FgTgmz0tqYFmXQswxP8EV%252Fimage.png%3Falt%3Dmedia%26token%3D7520c54c-2971-4100-8089-83cf02d41706&width=768&dpr=4&quality=100&sign=5830a238&sv=1)
Now, we can use the credentials to login into SSH.
Get Low User
![](https://htb.linuxsec.org/~gitbook/image?url=https%3A%2F%2F1891775682-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252F2YxxNVC63IWuD2WxadSC%252Fuploads%252FGqEGT7LpYr9lPcZNW5Fu%252Fimage.png%3Falt%3Dmedia%26token%3D4353d58d-4c1e-4a68-8d61-d31fedb10fa3&width=768&dpr=4&quality=100&sign=9559b46e&sv=1)
Privilege Escalation
After obtaining low-level user access, we can now upload pspy to the target machine and monitor Linux processes.
![](https://htb.linuxsec.org/~gitbook/image?url=https%3A%2F%2F1891775682-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252F2YxxNVC63IWuD2WxadSC%252Fuploads%252Fk6xr5PMskEhQnkxUgGA4%252Fimage.png%3Falt%3Dmedia%26token%3D0b6a69ca-cdf8-428b-8a85-3534e427c08f&width=768&dpr=4&quality=100&sign=903666f&sv=1)
We found a suspicious process with UID 0 (root) that could potentially be our pathway to gaining root access.
This is the content of malwarescan.sh
In summary, this script provides a way to monitor the /var/www/pilgrimage.htb/shrunk/ directory for newly created files using binwalk and automatically deletes files that match specific criteria defined in the blacklist array.
After check the binwalk version, we know that this binwalk is vulnerable to CVE-2022-4510.
![](https://htb.linuxsec.org/~gitbook/image?url=https%3A%2F%2F1891775682-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252F2YxxNVC63IWuD2WxadSC%252Fuploads%252F8rahYEP8iYvetC8xfJQS%252Fimage.png%3Falt%3Dmedia%26token%3D637b3842-819b-40c9-836f-593e900e2ced&width=768&dpr=4&quality=100&sign=859c809f&sv=1)
We can use this script:
Before that, nn our local machine run nc to listen at port 1337.
Upload the script to target machine, and generate the reverse shell payload.
Next, copy the generated image to /var/www/pilgrimage.htb/shrunk/ directory.
![](https://htb.linuxsec.org/~gitbook/image?url=https%3A%2F%2F1891775682-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252F2YxxNVC63IWuD2WxadSC%252Fuploads%252FzvRYze2KeH7dTndWQf0U%252Fimage.png%3Falt%3Dmedia%26token%3D9b804d44-83c7-4106-a176-7d834f061b56&width=768&dpr=4&quality=100&sign=74ffa100&sv=1)
Using pspy, we can confirm that the binwalk execute our payload.
![](https://htb.linuxsec.org/~gitbook/image?url=https%3A%2F%2F1891775682-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252F2YxxNVC63IWuD2WxadSC%252Fuploads%252FqjvdTOtT2oNYgJctOpZr%252Fimage.png%3Falt%3Dmedia%26token%3D0a8b37c4-3617-4eeb-beeb-051bd6507e2e&width=768&dpr=4&quality=100&sign=b33ff008&sv=1)
Checking our netcat, we received a connection from the target with the root user.
![](https://htb.linuxsec.org/~gitbook/image?url=https%3A%2F%2F1891775682-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252F2YxxNVC63IWuD2WxadSC%252Fuploads%252FypxlfOQqpmnigrzYXj5b%252Fimage.png%3Falt%3Dmedia%26token%3Da70b2949-aa82-45d8-846e-383d442ecd10&width=768&dpr=4&quality=100&sign=870e44e0&sv=1)
Last updated