Pilgrimage

Platform: HackTheBox | Difficulty: Easy | OS: Debian Author: D3v0o0Nu11 | Date: 2026-02-10 | Status: Solved

Summary

Walkthrough of the HackTheBox machine Pilgrimage (Debian, attack surface: OpenSSH 8.4p1 Debian 5+deb11u1 (protocol 2.0) (22), nginx 1.18.0 (80)). Foothold via CVE-2022-44268, lfi, ssti; privilege escalation to root. Both flags captured and redacted.

Recon

Port scan

 bash read-only • copy allowed Copy
nmap -p- -sVC 10.10.11.219 --min-rate 1000

Enumeration highlights

• Detected OS: Debian.
• Open services: http (80), ssh (22).
• Scan used: nmap -p- -sVC 10.10.11.219 --min-rate 1000.

Foothold

Vulnerability / Misconfiguration

┌──(D3v0o0Nu11㉿htb)-[~]
└─$ nmap -p- -sVC 10.10.11.219 --min-rate 1000
Starting Nmap 7.93 ( https://nmap.org ) at 2023-09-27 23:37 PDT
Nmap scan report for pilgrimage.htb (10.10.11.219)
Host is up (0.051s latency).
Not shown: 65533 closed tcp ports (conn-refused)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.4p1 Debian 5+deb11u1 (protocol 2.0)
| ssh-hostkey: 
|   3072 20be60d295f628c1b7e9e81706f168f3 (RSA)
|   256 0eb6a6a8c99b4173746e70180d5fe0af (ECDSA)
|_  256 d14e293c708669b4d72cc80b486e9804 (ED25519)
80/tcp open  http    nginx 1.18.0
| http-git: 
|   10.10.11.219:80/.git/
|     Git repository found!
|     Repository description: Unnamed repository; edit this file 'description' to name the...
|_    Last commit message: Pilgrimage image shrinking service initial commit. # Please ...
| http-cookie-flags: 
|   /: 
|     PHPSESSID: 
|_      httponly flag not set
|_http-title: Pilgrimage - Shrink Your Images
|_http-server-header: nginx/1.18.0
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 19.57 seconds

1. Based from the nmap results, the machine runs a web application and opens ssh login.

2. Noticed based from the nmap result, /.git/ is found. We can dump that using git-dumper later.

3. Using git-dumper.

┌──(D3v0o0Nu11㉿htb)-[~/Downloads/machine/machine_pilgrimage]
└─$ ls                  
assets  dashboard.php  index.php  login.php  logout.php  magick  register.php  vendor

1. After uploaded an image file, it shows us where it stores our image file.

2. Well, analyzing index.php source code, shall found an interesting tool used by the webapp (ImageMagick).

3. Searching in metasploit for Image Magick shall resuulting to these:

4. Got bunch of results, searching on the internet shall found these:

CVE's POC --> https://github.com/voidz0r/CVE-2022-44268

1. Quite promising, let's try use that CVE in metasploit --> CVE-2022-44268

2. It seems we need to exploit this manually.

3. I did not want to use the CVE's POC we found before because it runs cargo.

4. Searching for another POC, found this POC where it uses python script --> https://github.com/Sybil-Scan/imagemagick-lfi-poc.

5. Let's just follow the steps listed there.

6. Running identify -verbose 651533fa137a0.png and scrolling down, shall found this hexes:

7. Great we found the foothold. Anyway we leaked a username --> emily.

8. However because we're not in a webshell or a shell, we can't read .txt file, so there must be a creds somewhere we can use to login as emily.

9. But how come?? Here's the situation. We can read /home/emily/user.txt, and we just found out that the vuln is LFI not SSTI. That's why the approach must be hardcoded creds somewhere or reuse password scenario.

10. Remembering it's a webapp and we got the source code by dumping the .git vulnerability. Hence it's much easier for us to found where database might be located.

11. Reviewing login.php source code, found our potential interest.

12. Running the same method as before by grabbing the hexes and decode them in Cyberchef, found this:

13. Great! After tried ssh login with emily:abigchonkyboi123, we logged in!

Proof

User flag: REDACTED

Privilege Escalation

User -> Root/Admin

NOTES: Remembering there's a blacklist char, naming "gambar.png" shall safe.

1. Nice!

Root flag: REDACTED

Flags

Lessons Learned

1. ImageMagick LFI.
2. git-dumper.
3. binwalk RCE.