Nibbles
Last updated
Was this helpful?
Last updated
Was this helpful?
Initial Foothold : File Upload vulnerablilty in nibbleblog
Privilege Escalation : Misconfiguration of file access and execution
Start with port scanning
Few ports were open ssh version doesn't seems interesting
Lets start with web enumeration
visit the webpage
Looks like simple html site is running
lets look in source code
Hmm got an interesting directory called nibbleblog
lets see what's there
There was an admin.php page where we can login
But we don't have creds
This took me long time to figure out the username and password, as they cannot bruteforce. if we try then we will be blocked.
This was simple. The username was as usual admin and the password was nibbles
Lets try this creds and got admin session ( admin : nibbles )
Lets search for nibbleblog on google
Got a file upload exploit but it was using metasploit
Lets exploit it manually
Got a metasploit module for exploting this file upload vulnerbility but we will exploit it manually
After reading the metasploit module, got that the vulnerability was in my image plugin where we can upload any file with any extension
There was no check for the type of the file uploading
Lets configure this plugin by uploading our php reverse shellcode
Use pentestmonkey php-reverse-shell.php code for this task
Change the lhost and lport in this payload and upload it on the my image plugin also setup netcat listener
Now to execute the payload visit the page where the plugin is stored
Got the above path from the metasploit module you can also find it using dirbuster
now open image.php file and we got the reverse shell as nibbler user
Lets run sudo -l command
From the above result it was clear that user nibbler can run monitor.sh script as root user without any password
Lets visit the file
Haven't got the monitor.sh file but got personal.zip file
Unzip that folder
Here you can see it extracted the file and got the monitor.sh file in stuff folder of personal
Now see the permission of monitor.sh file
This file was writable by the everyone group
so we can edit this file and will add the malicious code in it and will execute it as root user
Simply echo /bin/bash in the file
and execute the script with its full path as sudo
And got the root shell
That's all for this box
Good Bye :)
