Hi Hackers Welcome Back, Today we are going to look at Hack The Box Nibbles Machine.
Info Table
Title
Nibbles
Category
Hack The Box
OS
Linux
Difficulty
Easy
Maker
Kill Chain Summery
While enumerating ports and services we can able to find the port 22,80 ware open. web service running on port 80, while digging into deep username and version of the theme found. guessed password, using file upload vulnerability we got initial foothold, escalated priviledge using sudo vulnerability. it is vulnerable to A06:2021-Vulnerable And Outdated Components which can be easily exploited via publicly available scripts and Metasploit.
┌─[_]─[atom@atom-vmwarevirtualplatform]─[~/htb/machines]└──_ $sudo nmap -sC -sV -O 10.10.10.75 -oN initial.txt
Starting Nmap 7.92 ( https://nmap.org ) at 2022-06-17 16:50 IST
Nmap scan report for 10.10.10.75
Host is up (0.29s latency).
Not shown: 998 closed tcp ports (reset)PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.2p2 Ubuntu 4ubuntu2.2 (Ubuntu Linux; protocol 2.0)| ssh-hostkey:
|2048 c4:f8:ad:e8:f8:04:77🇩🇪cf:15:0d:63:0a:18:7e:49 (RSA)|256 22:8f:b1:97:bf:0f:17:08:fc:7e:2c:8f:e9:77:3a:48 (ECDSA)|_ 256 e6:ac:27:a3:b5:a9:f1:12:3c:34:a5:5d:5b:eb:3d:e9 (ED25519)80/tcp open http Apache httpd 2.4.18 ((Ubuntu))|_http-title: Site doesn't have a title (text/html).
|_http-server-header: Apache/2.4.18 (Ubuntu)No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).
TCP/IP fingerprint:
OS:SCAN(V=7.92%E=4%D=6/17%OT=22%CT=1%CU=41142%PV=Y%DS=2%DC=I%G=Y%TM=62AC63A
OS:E%P=x86_64-pc-linux-gnu)SEQ(SP=101%GCD=1%ISR=10A%TI=Z%CI=I%II=I%TS=8)OPS
OS:(O1=M505ST11NW7%O2=M505ST11NW7%O3=M505NNT11NW7%O4=M505ST11NW7%O5=M505ST1
OS:1NW7%O6=M505ST11)WIN(W1=7120%W2=7120%W3=7120%W4=7120%W5=7120%W6=7120)ECN
OS:(R=Y%DF=Y%T=40%W=7210%O=M505NNSNW7%CC=Y%Q=)T1(R=Y%DF=Y%T=40%S=O%A=S+%F=A
OS:S%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T5(R
OS:=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F
OS:=R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R=Y%DF=N%
OS:T=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=40%CD
OS:=S)Network Distance: 2 hops
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 39.53 seconds
┌─[atom@atom-vmwarevirtualplatform]─[~/htb/machines]└──_ $sudo nmap -T4 -p- 10.10.10.75 -oN fs.nmap
Starting Nmap 7.92 ( https://nmap.org ) at 2022-06-17 16:56 IST
Stats: 0:00:22 elapsed;0 hosts completed (1 up), 1 undergoing SYN Stealth Scan
SYN Stealth Scan Timing: About 6.30% done; ETC: 17:02 (0:05:27 remaining)Stats: 0:02:34 elapsed;0 hosts completed (1 up), 1 undergoing SYN Stealth Scan
SYN Stealth Scan Timing: About 13.50% done; ETC: 17:15 (0:16:27 remaining)Stats: 0:04:35 elapsed;0 hosts completed (1 up), 1 undergoing SYN Stealth Scan
SYN Stealth Scan Timing: About 25.93% done; ETC: 17:13 (0:13:05 remaining)Stats: 0:11:56 elapsed;0 hosts completed (1 up), 1 undergoing SYN Stealth Scan
SYN Stealth Scan Timing: About 63.51% done; ETC: 17:15 (0:06:51 remaining)Stats: 0:15:20 elapsed;0 hosts completed (1 up), 1 undergoing SYN Stealth Scan
SYN Stealth Scan Timing: About 79.79% done; ETC: 17:15 (0:03:53 remaining)Nmap scan report for 10.10.10.75
Host is up (0.29s latency).
Not shown: 65533 closed tcp ports (reset)PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
Nmap done: 1 IP address (1 host up) scanned in 1209.69 seconds
From here we came to know that only port 22, 80 ware opened. port 22 is for SSH. we can able to do SSH if we know the user name and password or private key. port 80 is a web server, SSH creds may present hidden some ware inside Web server directory, lets we run Gobuster for directory busting.
if we inspect source code on home page we will get a clue to drive exploit http://10.10.10.75/
On the following directory http://10.10.10.75/nibbleblog/README we can able to see the version of nibbling theme.
while digging into google we can see that there is one public exploit available.
It is vulnerable to **CVE-2015-6967 for this exploit we need a username and password. the good thing is we already know the username admin yet to find the password.**
The exploit is code execution vulnerability via image file upload
Information gathered
It’s a code execution vulnerability.
The vulnerability is in the “My image” plugin that allows the upload of PHP files. So it would allow us to upload a PHP reverse shell.
it is an authenticated vulnerability we need username and password to exploit. we know the username
Alright, so the next steps would be:
Navigate to the admin login page and figure out the admin credentials
Navigate to the My Image plugin page and upload a PHP reverse shell
As mentioned in the Proof of Concept, the admin page can be found here.
Now we need admin credentials. When I’m presented with an enter credentials page, the first thing I try is common credentials (admin/admin, admin/nibbles, nibbles/nibbles, nibbles/admin). If that doesn’t work out, I look for default credentials online that are specific to the technology. Last, I use a password cracker if all else fails.
In this case, the common credentials admin/nibbles worked!. Next, we need to navigate to the My Image plugin. Click on Plugins > My image > Configure.
navigate to /usr/share/webshell/php/PHP-revershshell.php modify the code according to our needs.
