# Nibbles

Type: Linux

Difficuility: Easy

Link: https://app.hackthebox.com/machines/Nibbles

IP Address: 10.10.10.75



## Enumeration

* Run nmap: `sudo nmap -sC -sV -p- -Pn -oA Nibbles 10.10.10.75`

<figure><img src="https://2268123139-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEUwn05Skx1RrmpCLRbWS%2Fuploads%2Ff2DYGtJij6AtlSLAUYWW%2Fimage.png?alt=media&#x26;token=70190955-4fa0-4b20-871c-a5801cb146d5" alt="" width="349"><figcaption><p>Nmap Results</p></figcaption></figure>

* 22/tcp is SSH and is secure by default (not many CVEs) so skip it
* 80/tcp is HTTP, start running gobuster and enumerate the site manually



<figure><img src="https://2268123139-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEUwn05Skx1RrmpCLRbWS%2Fuploads%2FLU5U73qOCidPpY2BqH0n%2Fimage.png?alt=media&#x26;token=647200d4-7557-417f-bca6-dc3b2635645d" alt="" width="217"><figcaption><p>Website</p></figcaption></figure>

<figure><img src="https://2268123139-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEUwn05Skx1RrmpCLRbWS%2Fuploads%2FET7AL3F9yguVeKVPv3MF%2Fimage.png?alt=media&#x26;token=67b15e12-6521-42fe-bf70-b5fa67e56ebe" alt="" width="265"><figcaption><p>View the page source</p></figcaption></figure>

* In the page source we found a directory (\\/nibbleblog) (Started fuzzing this directory)

<figure><img src="https://2268123139-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEUwn05Skx1RrmpCLRbWS%2Fuploads%2Fei2WZx4r1iKKVozwAeP4%2Fimage.png?alt=media&#x26;token=d6b9c255-bafb-466f-8214-c85ca0975845" alt="" width="375"><figcaption><p>Gobuster Results</p></figcaption></figure>

* On the `README` page, we found multiple valuable information like the version of the system.

<figure><img src="https://2268123139-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEUwn05Skx1RrmpCLRbWS%2Fuploads%2F3Jmq1hJlIrXtTgKtqvFN%2Fimage.png?alt=media&#x26;token=f13acc4c-525e-4389-bd7b-95138793794c" alt="" width="309"><figcaption><p>README page</p></figcaption></figure>

## Exploitation

* I searched for a CVE for this version and found one but it needs credentials (2015-6967).&#x20;
* Check the admin page and try default credentials (I tried many different combinations admin/admin, root/root, etc.. but nothing worked, so I checked other writeups to make sure I was not down a rabbit hole and turned out it's just admin/nibbles)
* I used the reverse shell from pentest monkey (https://pentestmonkey.net/tools/web-shells/php-reverse-shell) and did the exploit manually by going to plugins and uploading it to My Image

<figure><img src="https://2268123139-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEUwn05Skx1RrmpCLRbWS%2Fuploads%2F5hTG7m8a4VruEkCbJnz0%2Fimage.png?alt=media&#x26;token=5d6cbf48-0cb4-422e-bf52-94b6486bfe7e" alt="" width="375"><figcaption><p>Plugins Page</p></figcaption></figure>

* It shows errors after uploading but it's meaningless (It says changes saved successfully)

<figure><img src="https://2268123139-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEUwn05Skx1RrmpCLRbWS%2Fuploads%2FiOgYwgl5v3rGigPj1Mbi%2Fimage.png?alt=media&#x26;token=93406259-c145-4a4b-9451-79a81b17266c" alt="" width="375"><figcaption><p>Uploading the shell</p></figcaption></figure>

## Privilege Esceleation

* I checked what commands we can run as sudo by using the command `sudo -l`

<figure><img src="https://2268123139-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEUwn05Skx1RrmpCLRbWS%2Fuploads%2FQybSY5e3LPXyXFUjLrYx%2Fimage.png?alt=media&#x26;token=1fa58203-b1b3-41a1-ac57-879da22b7cf5" alt="" width="347"><figcaption><p>sudo -l command output</p></figcaption></figure>

* There is a monitor.sh shell file that we can run as root without a password.
* When I tried to access the directory that contains the `monitor.sh` file I got the message that there is no such directory.

<figure><img src="https://2268123139-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEUwn05Skx1RrmpCLRbWS%2Fuploads%2FU8kAxUzW034W9HdtxCRT%2Fimage.png?alt=media&#x26;token=1aecde13-15bd-4959-abfa-b895aca21671" alt="" width="359"><figcaption><p>Personal.zip file</p></figcaption></figure>

* The directory is in the `personal.zip`, so I unzipped the file (`unzip personal.zip`) and then typed my code into the shell (`echo "/bin/sh/" > monitor.sh`) This is just a lazy way to spawn a shell as root instead of getting a reverse shell.

<figure><img src="https://2268123139-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEUwn05Skx1RrmpCLRbWS%2Fuploads%2FS2JEEZzs0s1czvguDDTY%2Fimage.png?alt=media&#x26;token=d976f336-a556-4dd1-a1c0-7322793d9d4c" alt="" width="193"><figcaption><p>Privilege Escalation</p></figcaption></figure>

## Flags:

<figure><img src="https://2268123139-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEUwn05Skx1RrmpCLRbWS%2Fuploads%2Fx8ZyTFRpqv76qXWAQTLh%2Fimage.png?alt=media&#x26;token=dccf897f-2102-4741-a924-398620b3784b" alt="" width="211"><figcaption><p>User Flag</p></figcaption></figure>

<figure><img src="https://2268123139-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEUwn05Skx1RrmpCLRbWS%2Fuploads%2FuXKASthbvxJNBG14L3QF%2Fimage.png?alt=media&#x26;token=2499aaa2-851a-413b-b4d0-52d38343cec0" alt="" width="217"><figcaption><p>Root Flag</p></figcaption></figure>
