HTB Imagery Pentest Report

Sun, 25 Jan 2026 00:00:00 +0000

PENETRATION TESTING

Target: Imagery (10.129.21.11)
Date: February 07, 2026
Auditor: Jose Maria Micoli Classification: CONFIDENTIAL / RESTRICTED
Audit ID: IMG-2026-02-07-001

1. Executive Summary

A rigorous forensic audit and penetration test was conducted against the Imagery infrastructure (10.129.21.11). The assessment successfully identified and exploited a chain of critical vulnerabilities resulting in full System Administrator (Root) compromise.

The attack vector began with Stored Cross-Site Scripting (XSS) in the administrative ticketing system, leading to Session Hijacking. Administrative access facilitated Local File Inclusion (LFI), exposing the application’s entire source code and sensitive configuration files. Source code analysis revealed an Authenticated Remote Code Execution (RCE) vulnerability in the image processing logic (ImageMagick), which was exploited to gain a foothold as the web user.

HTB Imagery Walkthrough

Sun, 25 Jan 2026 00:00:00 +0000

HackTheBox Walkthrough: Imagery

Welcome to the walkthrough for Imagery, a machine that tests our ability to chain web vulnerabilities, analyze source code for secure coding errors, and perform forensic-style enumeration to move laterally.

Difficulty: Medium/Hard
Target IP: 10.129.21.11
OS: Linux

1. Executive Summary (TL;DR)