Imagery

Platform: HackTheBox | Category: Machines | Type: Machine | Difficulty: Medium | OS: Linux | Author: DonutMaster | Date: 2026-02-11 | Status: Solved Techniques: Stored XSS in Bug Report Admin Panel, Cookie Hijacking, LFI via System Logs, Python DB JSON Enumeration, ImageMagick Command Injection RCE, AES Crypt Backups Decryption

Summary

Walkthrough of the HackTheBox Medium machine Imagery (Linux). Foothold achieved by exploiting Stored XSS in the admin bug report feature to steal the admin session cookie, leveraging admin access for LFI via system log download, reading db.json and app.py, and executing command injection via ImageMagick wrapper (apply_visual_transform). Privilege escalation via AES-encrypted zip backup cracking and path/binary hijacking.

Recon

Port Scan

 bash read-only • copy allowed Copy
rustscan -a imagery.htb -- -A

Foothold

Exploitation Steps

1. Register user and submit a bug report containing Stored XSS payload targeting the un-sanitized details field.
2. Admin reviews bug report; attacker receives admin session cookie via callback HTTP server.
3. Access Admin panel and use Log Download feature vulnerable to LFI to read app.py, config.py, and db.json.
4. Log into the testuser account (credentials extracted from db.json) and exploit command injection in apply_visual_transform via ImageMagick (shell=True).

Privilege Escalation

Lateral Movement & Root

1. Locate AES-encrypted zip backup under /var/backup/.
2. Extract hash using aescrypt2hashcat.pl and crack with Hashcat to retrieve backup passphrase.
3. Unzip backup to inspect application source or credentials, and leverage system misconfigurations for root escalation.

Flags

Key Takeaways / Lessons

• DOMPurify.sanitize() must be applied across all user-supplied fields, not just subset properties like report names.
• Avoid shell=True in subprocess calls when handling image transformation parameters.