✅Nibbles (Easy)
Lesson Learn
Report-Penetration
Vulnerable Exploit: Weak password policy and Nibble Blog version is out of dated.
System Vulnerable: 10.10.10.75
Vulnerability Explanation: The machine use weak password policy which allow us to login as admin and exploit vulnerable of Nibble blog version contain Code Execution which allow us to get foothold on the machine.
Privilege Escalation Vulnerability: Misconfigure of File Permission
Vulnerability Fix: Implement Strong Password policy and upgrade version of Nibble Blog.
Severity: High
Step to Compromise the Host:
Reconnaissance
Enumeration
Port 80/tcp Apache/2.4.18 (Ubuntu)
By start browsing on port 80, we just see "Hello world!". But checking on source code, we can see interesting comment at the end.
Going through the directory, we can see the webpage. By checking each function of the webpage, it doesn't anything interesting. Let start discover hidden directory.
On the webpage, one function redirect to feed.php. Let start enumerate with extension txt and php
By checking on /README, we can see the Nibble blog version is 4.0.3.
Searching on google to find public exploit. We can see Arbitrary File Upload. Checking on exploit descript, it requires admin credentials for this.
Exploitation
Going to enumerate on /admin, we can not see any interesting on this.
Let start on /admin.php. We can see login webpage, but we don't any credentials. I have tried with
and the last one is working.
Next step follow the exploit description Plugins > My Image > Configure. Copy PHP reverse shell from webshells directory. Then, replacing IP address with our kali IP address and save it as image.php and start netcat listener on port 1234. Let upload our payload and ignore the error.
Going through the link to execute the reverse shell script.
Privilege Escalation
Auto script bash
First the first, run sudo -l whether there is any misconfiguration. We can run monitor.sh with NOPASSWD require. Let start enumerate on that file.
After extract personal.zip file, it contains monitor.sh. As we have writable permission on monitor.sh file and we can run it as root permission too.
Let start modify monitor.sh script with for privilege escalation script.
Other Method, we can use Netcat for reverse shell.
Last updated