search
Page cover

Magician (ImageTragick, Port Forwarding)

First, we need to enumerate using nmap.

╭─hnl@hnl ~/Desktop/ctf/tryhackme/magician  
╰─➤  nmap -A 10.10.208.142 | tee nmap.log
Starting Nmap 7.80 ( https://nmap.org ) at 2022-04-27 08:02 +0630
Nmap scan report for magician (10.10.208.142)
Host is up (0.28s latency).
Not shown: 998 closed ports
PORT     STATE SERVICE VERSION
21/tcp   open  ftp     vsftpd 2.0.8 or later
8081/tcp open  http    nginx 1.14.0 (Ubuntu)
|_http-server-header: nginx/1.14.0 (Ubuntu)
|_http-title: magician
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 77.90 seconds

hashtag
Port 21

When I connect to ftp with anonymous user, I got error.

╭─hnl@hnl ~/Desktop/ctf/tryhackme/magician  
╰─➤  ftp magician 
Connected to magician.
220 THE MAGIC DOOR
Name (magician:hnl): anonymous
331 Please specify the password.
Password:

230-Huh? The door just opens after some time? You're quite the patient one, aren't ya, it's a thing called 'delay_successful_login' in /etc/vsftpd.conf ;) Since you're a rookie, this might help you to get started: https://imagetragick.com. You might need to do some little tweaks though...
230 Login successful.
ftp> 
ftp> ls
550 Permission denied.
ftp: bind: Address already in use

hashtag
Port 8081

When you browse to http://magician:8081/, you will see this interface.

With burp, I can intercept the data when I upload custom png file.

The response said, I got successfully uploaded.

How about exploit.php?? Wow! I successfully uploaded.

Call back this url to get reverse shell. But I got error.

This vulnerability come with CVE-2016-3714. You can read the full article at https://mukarramkhalid.com/imagemagick-imagetragick-exploit/. Here is exploit.png from https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Upload%20Insecure%20Files/Picture%20Image%20Magik/imagetragik1_payload_url_curl.png.

In this screenshot, we can see the exploit.png is working.

Let's upload a reverse shell. Here is a rce from https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Upload%20Insecure%20Files/Picture%20Image%20Magik/imagetragik1_payload_imageover_reverse_shell_devtcp.jpg

In netcat session, we got a revere shell.

hashtag
User

Let's spawn a TTY shell.

Read the user flag.

hashtag
Root

You can see some opened port using netstat command.

Download chisel to forward port.

Let's forward port.

When you browse http://127.0.0.1:9999, you file see "Enter filename" input field. I put /etc/shadow.

Cracking root password is tricky. Reading root flag directly.

PreviousCat Pictures (phpBB, Knockd, Docker)NextJason (Node.js Deserialization, npm)

Last updated