Nibbles

Enumeration

As usual, we start with an nmap scan, in order to find open ports in the target machine.

The following nmap command will scan the target machine looking for open ports in a fast way and saving the output into a file:

nmap -sS --min-rate 5000 -p- -T5 -Pn -n 10.10.10.75 -oN allPorts

  • -sS use the TCP SYN scan option. This scan option is relatively unobtrusive and stealthy, since it never completes TCP connections.

  • --min-rate 5000 nmap will try to keep the sending rate at or above 5000 packets per second.

  • -p- scanning the entire port range, from 1 to 65535.

  • -T5 insane mode, it is the fastest mode of the nmap time template.

  • -Pn assume the host is online.

  • -n scan without reverse DNS resolution.

  • -oN save the scan result into a file, in this case the allports file.

As we see, only port 22 (SSH) and port 80 (HTTP) are open. Let's try to obtain more information about the service and version running on these ports.

nmap -sC -sV -p22,80 10.10.10.68 -oN targeted

  • -sC performs the scan using the default set of scripts.

  • -sV enables version detection.

  • -oN save the scan result into file, in this case the targeted file

Let's take a look at the website.

There's not much going on. But, if we take a look at the source code, we'll see that we can access the /nibbleblog/ directory.

If we take a look at the /nibbleblog/ directory, we'll see in the bottom right corner that it is using Nibbleblog.

Let's try to enumerate directories and .php files with gobuster.

gobuster dir -u http://10.10.10.75/nibbleblog -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 200 -x php

  • dir enumerates directories or files.

  • -u the target URL.

  • -w path to the wordlist.

  • -t number of current threads, in this case 200 threads.

  • -x file extensions to search for.

Exploitation

Let's search for common Nibbleblog exploits.

searchsploit nibbleblog

If we inspect the Arbitrary File Upload one, we can see that it is logging in to the admin.php page.

But we don't have any credentials. I found the admin user on the http://10.10.10.75/nibbleblog/content/private/users.xml inside the /content directory we found in the gobuster scan.

At this point I tried random credentials on the admin.php page, and I got in with the admin user and the nibbles password.

And we get in.

Once we have logged in, the script uploads a file to a plugin called My image.

If we go the the Plugins section, we'll see an installed plugin called My image.

If we hit Configure, we'll see that we can upload a file. I will upload the /usr/share/webshells/php/php-reverse-shell.php PHP reverse shell. But before uploading it, we have to modified it by changing the $ip variable and the $port variable.

Now, we can upload the PHP file to the My image plugin.

Finally, we can see in the Arbitrary File Upload exploit that the PHP file is stored in the /content/private/plugins/my_image folder under the image.php name.

But before executing it, let's set a netcat listener on port 4444.

nc -lvnp 4444

  • -l listen mode.

  • -v verbose mode.

  • -n numeric-only IP, no DNS resolution.

  • -p specify the port to listen on.

If now we access the http://10.10.10.75/nibbleblog/content/private/plugins/my_image/image.php file, we'll get a reverse shell as the nibbler user, and we'll be able to get the user flag.

Privilege Escalation

First of all, let's set an interactive TTY shell.

script /dev/null -c /bin/bash

Then I press Ctrl+Z and execute the following command on my local machine:

stty raw -echo; fg

Next, I export a few variables:

export TERM=xterm

export SHELL=bash

Finally, I run the following command in our local machine:

stty size

And set the proper dimensions in the victim machine:

stty rows 51 columns 236

Let's list the sudo privileges of the nibbler user.

sudo -l

  • -l list user privileges.

We can execute the /home/nibbler/personal/stuff/monitor.sh script as the root user. But if we try to list the script, we'll see that it doesn't exist.

ls -l /home/nibbler/personal/stuff/monitor.sh

But, if we see in the home directory of the nibbler user, we'll see that there is an .zip file.

ls -la /home/nibbler/

Let's unzip it.

unzip personal.zip

Inside was the monitor.sh script that we have sudo permissions on.

ls -l /home/nibbler/personal/stuff/monitor.sh

As we have the right permission to write on it, we could remove everything inside, and add a bash script which will spawn a shell as root, when we'll execute it with sudo privileges.

nano /home/nibbler/personal/stuff/monitor.sh

Now all we have to do is execute the script with sudo, and we'll be able to reap the harvest and take the root flag.

sudo /home/nibbler/personal/stuff/monitor.sh

Last updated

Was this helpful?