HackTheBox - Imagery

Why It Matters

The exploit chain shows how a single XSS and missing HttpOnly flag can lead to complete server takeover, highlighting essential hardening steps for Flask applications.

Key Takeaways

• Discover XSS vulnerability in unsanitized bug report description field
• Steal Flask session cookie because HttpOnly flag is disabled
• Use Flask‑unsign tool to decode cookie and impersonate admin
• Leverage file disclosure to retrieve source code and achieve RCE
• Enumerate JavaScript endpoints for hidden API routes and further exploits

Summary

The video walks through the Hack The Box "Imagery" machine, a Flask‑based web application exposing a gallery, login, and bug‑report functionality. The presenter begins with standard port scanning, identifies HTTP on port 8000, and confirms the service runs WorkZug on Python, hinting at a Flask stack. Key insights include a cross‑site scripting flaw in the bug‑report description field, an HttpOnly‑disabled session cookie, and the ability to decode that cookie with the Flask‑unsign utility to assume the admin identity. Once admin, the analyst exploits a file‑disclosure endpoint to download the application source, locates a vulnerable endpoint that permits remote code execution, and ultimately escalates to root. Notable examples feature a crafted XSS payload that exfiltrates document.cookie via a fetch request, the use of curl with "--path-as-is" to traverse directory structures, and the extraction of "app.py" revealing the secret key generation method. The presenter also demonstrates how client‑side JavaScript reveals hidden API routes such as /admin/delete_user and /api/upload, which become further attack vectors. The walkthrough underscores the criticality of proper cookie flags, thorough sanitization of user‑generated content, and the value of inspecting client‑side scripts for hidden endpoints. For defenders, it illustrates how seemingly minor misconfigurations in Flask apps can cascade into full system compromise, reinforcing the need for secure defaults and regular code audits.

Original Description

00:00 - Introduction

00:45 - Start of nmap

04:00 - Viewing the Flask Cookie with Flask-Unsign

07:30 - Discovering the Report Bug endpoint which is vulnerable to XSS and HTTP Only is false allowing us to steal cookies

08:15 - Another way to discover XSS, look at JavaScript in PageSource which leaks a lot of information

12:40 - Stealing the session cookie with img src xss payload

15:55 - Finding a File Disclosure then leaking the application source code

18:40 - Using Curl to download all the source code, making it easier to do source code analysis

24:00 - Using OpenGrep to locally run a basic static code analysis on the app

28:20 - Abusing the Command Injection to get a shell

32:50 - Discovering an AES Encrypted zip, copying it to our box then cracking with aescrypt2hashcat

37:30 - Using pyAesCrypt to decrypt the file

40:20 - Exploiting the custom binary Charcol