Hack the Box Challenge: Nibble Walkthrough

Today we are going to solve another CTF challenge “Nibble” which is categories as retired lab presented by Hack the Box for making online penetration practices. 

Level: Easy

Task: find user.txt and root.txt file on the victim’s machine.

Penetration Methodology


  • Open ports and running services (Nmap)


  • Nibbleblog-CMS

Exploit NibbleBlog 4.0.3

  • Code Execution by uploading the PHP file (Metasploit)
  • Get User.txt

Privilege Escalation

  • Get root.txt 


Since these labs are online accessible therefore they have static IP. The IP of Nibble is so let’s initiate with nmap port enumeration.

As you can see in the given screenshot that we have two services running on our Target Machine, ssh and HTTP on ports 22 and 80 respectively.

The Port 80 is open so let’s open IP in out Browser to see that if a website is hosted on the IP. After opening the IP in the browser, we were greeted by the following page.

Then we use curl to send http request on and notice /nibbleblog/ which could be any web directory.

So we execute the directory put us on the main page of a blogging platform NibbleBlog Yum Yum. Without wasting time search for the exploit in the Google and Rapid 7 link for its exploitation.

So we load the Metasploit framework and executed following command to take a meterpreter session of victim’s VM.

According to this module, Nibbleblog contains a flaw that allows an authenticated remote attacker to execute arbitrary PHP code. This module was tested on version 4.0.3.

From given below image you can observe meterpreter session 1 opened for accessing victim tty shell.

Now let’s finish the task by grabbing user.txt and root.txt file. First I move into /home directory and check available files and directories inside it. I found the 1st flag “user.txt” from inside /home/nibbler.

For spawning proper tty shell of target’s system we need to import python file, therefore, I run following command inside the meterpreter shell.

Inside /nibbler there was a zip file so we try to unzip it with help of the following command and after extracting zip file we got a directory “personal”, so we get inside it, then with a little more efforts found a script monitor.sh.

Then I check sudo rights for user “nibbler” and notice nibbler has sudo permission for script monitor.sh which means he is authorized to modify this script.

So in a new terminal, we generated a payload for netcat shell with help of msfvenom command as shown and copied the highlighted code and start netcat listener too.

Then to it exploit it we move inside following Path: /home/nibbler/personal/stuff/ and paste the above-copied code inside monitor.sh as shown below

Since we knew monitor.sh has full permission, so we can run it to obtain reverse shell along root access.

On other, we have a netcat listener, which has provided root access to us. Let’s finish this task and grab the root.txt file………………………………..

Author: AArti Singh is a Researcher and Technical Writer at Hacking Articles an Information Security Consultant Social Media Lover and Gadgets. Contact here

3 Comments Hack the Box Challenge: Nibble Walkthrough

    1. Costantino Dario Vaccaro

      if you run dirbuster you will find a lot of files where the user “admin” is mentioned.
      btw you could try admin even withouth looking at these files.
      the password is often the name of the box


Leave a Reply

Your email address will not be published. Required fields are marked *