The Walkthrough of HTB Nibbles

Hi there, fellow hackers This is my first write-up for the TJ Null List for the OSCP preparation.

To avoid having to type or remember the target IP, I export it to a variable.

export ip= <Nibbles IP>

echo $ip

Enumeration

incursore.sh -H $ip -t All

Two open TCP ports, 22 and 80, respectively, were discovered by the nmap scan.

Use curl to view the website's source code after visiting it.

Source code was used to locate the directory /nibbleblog/, and Gobuster was used to perform directory busting.

went to the admin page and used the standard login credentials, such as admin:admin, admin:servicename, and so forth.

We are able to access the website by using the correct credentials, admin:nibbles.

Searched searchsploit to find publicly disclosed CVEs in the Nibbleblog 4.0.3 CMS.

After examining the code of CVE-2015–6967, we found the My Image plugin has a file upload vulnerability.

Accessed the URL to access the reverse shell and got the reverse shell.

We got access to user.txt from /home/nibbler. I have used rlwrap to provide readline line editing.

Used sudo -l and got monitor.sh has permission to run without a password.

Unzip the personal.zip and found the zip file contains the monitor.sh file

Added the bash command in the script to get access in the shell as a root user.

Thanks for reading.

Any suggestions in the write-up are welcome. I may try to incorporate the suggestion in the next write-up.