Image - Proving Grounds Practice
Enumeration
Nmap
Initial Nmap scan revealed SSH, HTTP ports were open.
Web Enumeration
Visiting the website revealed ImageMagick application.
And I uploaded a random image file, which revealed the version of ImageMagick, 6.9.6-4
Exploitation
CVE-2023-34152 (Up to ImageMagick 7.1.1.11)
A vulnerability was found in ImageMagick. This security flaw cause a remote code execution vulnerability in OpenBlob with –enable-pipes configured.
Searching this version revealed this CVE number. Further searching showed that there was an exploit available.
I simply run the exploit. It created a malicious PNG file.
And uploading it gave us www-data shell.
And I simply got the local flag in /var/www
Privilege Escalation
Strace SUID
Running SUID checks with the below command revealed strace had SUID privileges.
find / -user root -perm -4000 -exec ls -ldb {} \; 2>/dev/null
So I simply followed the steps given in gtfobins and got the root.