Exploitation

We know we have access to admin login, we know we can upload a php file and access at a particular location.

Login Credentials

For the login page, chances are that the page has default credentials. nibbles/nibbles, admin/nibbles,admin/password, admin/admin...etc

Successful login with admin/nibbles

Exploitation: PHP file upload

Based on our earlier enumeration, we are able to upload files that ARE NOT Images on nibblesblog 4.0.3. This is located on the plugins/images settings.

Image upload settings.

Uploading Reverse PHP shell and Information Disclosure

After uploading a php shell, a user is displayed with information that should not be visible.

After the shell is uploaded and our listener is set up on the proper port, we get a reverse connection when we access /content/private/plugins/my_image/image.php

Successful shell access as user nibbles

Note:

• Page could have a lockout mechanism, be careful with brute force as this can lock you out.