I see it all the time in pentest reports: Stored XSS gets rated as Medium or even Low because it requires user interaction. But my recent run through HackTheBox's Imagery machine reminded me why that mindset is dangerous.
The box is a perfect example of a Daisy Chain attack where a seemingly minor client-side bug becomes the skeleton key for the entire backend.
Here is the TL;DR of the kill chain:
Stored XSS
It started with a standard "Bug Report" feature. Most would check for SQLi and move on. I found I could inject a payload that stored XSS.
Cookie Theft
It wasn't about popping an alert box. I used the XSS to blindly exfiltrate the Administrator's session cookie when they (the bot/admin) reviewed the report.
The RCE
With admin access, I reached the image management panel. Code review (leaked via a directory traversal bug) revealed a Command Injection flaw in the crop feature—but it was only accessible to authenticated admins. Without that "low prio" XSS, the RCE was unreachable.
The PrivEsc
Leaked the database credentials to crack the test user's hash.
Found an encrypted backup (pyAesCrypt), brute-forced it to find another user's hash.
Finally rooted the box by abusing a custom backup utility running with sudo privileges.
The Takeaway
If you are ignoring XSS to hunt for "cooler" binary exploits, you are missing the forest for the trees. In modern web apps, XSS is often the only way to bridge the gap between "Public User" and "Internal Admin" where the RCEs actually live.
If you want to see the exact payloads, the Python scripts I used for the crypto-cracking, and the full step-by-step breakdown, check out my writeup here
0 comments