Nibbles
This box is very straight forward and teaches hackers a way of enumerating and researching exploits that are available online.
Reconnaissance
# Nmap 7.91 scan initiated Sun Mar 14 00:25:31 2021 as: nmap -sC -sV -p22,80 -oN nibbles.nmap 10.10.10.75
Nmap scan report for 10.10.10.75
Host is up (0.10s latency).
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.2p2 Ubuntu 4ubuntu2.2 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 2048 c4:f8:ad:e8:f8:04:77:de:cf:15:0d:63:0a:18:7e:49 (RSA)
| 256 22:8f:b1:97:bf:0f:17:08:fc:7e:2c:8f:e9:77:3a:48 (ECDSA)
|_ 256 e6:ac:27:a3:b5:a9:f1:12:3c:34:a5:5d:5b:eb:3d:e9 (ED25519)
80/tcp open http Apache httpd 2.4.18 ((Ubuntu))
|_http-server-header: Apache/2.4.18 (Ubuntu)
|_http-title: Site doesn't have a title (text/html).
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Sun Mar 14 00:25:42 2021 -- 1 IP address (1 host up) scanned in 11.03 secondsAfter running the nmap scan, go to the web browser and visit the server and review the page source.
Next step would be to visit the webpage directory as specified.
Found Login
After trying default credentials it did not work, it also has a lockout mechanism, which means you can get banned. Nothing much here, the password is nibbles and must go based on what you think a system administrator with poor practice would use. We'll proceed to finding a username with GoBuster.
Running GoBuster Scan
Found Username and Version
These were found while searching the GoBuster directories
Found Exploit
More information on this exploit can be found here.
The exploit is straight forward, gain credentials, upload php reverse shell and execute.
Uploading Shell
Login to through the admin panel, the passowrd is nibbles as guessed and upload one of the following shells with your kali IP
They should all suffice, so pick your poison.
Set up your listener and visit the following link.
Once your connection is established, check if you can create any files that you can run as another user.
Create the following folders and file, along with python reverse code.
Set up your listener and execute the create script as sudo.
Getting ROOT
Last updated
Was this helpful?