Arbitrary Code Execution in ImageMagick AppImage via Empty Search Path

This repository provides a fully automated exploit for the Hack The Box 'Titanic' machine, targeting a chain of vulnerabilities for initial access and privilege escalation. The main script, 'autopwn.py', is a two-phase Python tool: - **Phase 1** exploits a Local File Inclusion (LFI) vulnerability in the web application at 'titanic.htb' via the '/download?ticket=' endpoint. It retrieves the Gitea SQLite database, extracts user password hashes, and formats them for hashcat to facilitate offline password cracking. - **Phase 2** uses the cracked credentials to SSH into the target as the 'developer' user. It then compiles and uploads a malicious shared object (libxcb.so.1) and a dummy image to a directory monitored by a root-owned automation script. This triggers exploitation of ImageMagick (CVE-2024-41817), resulting in the SUID bit being set on /bin/bash, allowing the attacker to escalate privileges to root. The repository includes a detailed write-up (WriteUP.md) explaining each step, the vulnerabilities exploited, and mitigation advice. The only code file is 'autopwn.py', which automates the exploitation process. The exploit targets specific endpoints and file paths on the Titanic HTB machine, and the payload is a C shared object designed for privilege escalation. The attack vectors are both network-based (LFI, SSH) and local (privilege escalation via ImageMagick).

This repository is a proof-of-concept exploit for CVE-2024-41817, a vulnerability in ImageMagick (<= 7.1.1-35) that allows arbitrary code execution via malicious XML delegation. The main file, exploit.py, is a Python script that can: - Detect if a remote target is running a vulnerable version of ImageMagick via SSH (using paramiko). - Generate malicious payloads: either a crafted delegates.xml file or a C source for a shared library (libxcb.so) that executes an attacker-supplied command. - Compile the shared library using GCC and deploy the payload to the target system over SSH. The exploit supports several modes: detection only, payload build only, or full automation (detect, build, deploy, and execute). The attacker must provide SSH credentials for the target. The payloads are written to the 'out/' directory. The repository includes a requirements.txt (paramiko) and a README.md with detailed usage instructions. The exploit is a functional POC and does not include weaponized features such as automated post-exploitation or payload customization beyond the supplied command.