Sitemap
Open in app

Sign in

Medium Logo
Write
Search

Sign in

HTB— Imagery Writeup

9 min readSep 30, 2025
Press enter or click to view image in full size

(XSS → LFI → RCE → PrivEsc)

Recon & service discovery

A quick nmap reconnaissance revealed the machine is running SSH and a Python-based web service:

nmap -T4 -A -v 10.10.11.88

Key results

  • 22/tcp — SSH (OpenSSH)
  • 8000/tcp — HTTP (Werkzeug/Python)

I visited http://imagery.htb:8000/ and found an image gallery application with Login / Register and an image upload feature.

Press enter or click to view image in full size

Initial web interaction

I registered a low-privilege user and verified image upload worked. The transform operations (crop/resize) were restricted to privileged users.

Press enter or click to view image in full size

XSS → Session cookie theft → Admin access

Create an account to read the full story.

The author made this story available to Medium members only.
If you’re new to Medium, create a new account to read this story on us.

Continue in app
Or, continue in mobile web
Already have an account? Sign in
Amish kumar

Written by Amish kumar

61 followers
0 following

Penetration tester & SOC analyst focused on threat detection, vulnerability research, and practical approaches to strengthening security.

Responses (1)

Write a response

What are your thoughts?

Oct 5

I knew the db.json path in the LFI-read sensitive files part and proceeded with LFI.
Did this path use wfuzz to proceed with directory traversol??
So the route exists and has been read through LFI??
I've read all your posts, and thank you so much.

1

More from Amish kumar

See all from Amish kumar

Recommended from Medium

See more recommendations

Help

Status

About

Careers

Press

Blog

Privacy

Rules

Terms

Text to speech