HTB - Nibbles
Getting Root
We notice that the application is running Nibble-blog version 4.0.3 which is vulnerable to file upload
We upload a webshell and get access to the box as user nibbler who has full sudo access to a bash script on his home directory
Tools Used:
nmap, dirsearch, searchploit,
Nmap
Enumeration
Dirsearch
The interesting stuff:
[21:56:31] 200 - 1KB - /nibbleblog/admin.php
[21:56:50] 301 - 323B - /nibbleblog/content http://10.10.10.75/nibbleblog/content/
[21:57:08] 200 - 5KB - /nibbleblog/README
Checking the admin page, we were able to guess the password.
Searchsploit
Exploit
We find an exploit for our version but using metasploit, however a simple google search takes use to the following POC
According to the POC we should be able to upload a php file under the My Image plugin and ignore all the warnings. In order to do to do this we must be able to login to the admin page.
We know the user admin, but we don't have a password. A few manual login tries and we can guess the password as nibbles. Now we can attempt to upload our php webshell.
Upload the webshell
We noticed the warnings and ignore them
Visiting the following page as described by the POC takes to the webshell
We execute the following to get a reverse shell on the box
Privilege Escalation
Last updated