https://app.hackthebox.com/machines/Nibbles
Review
- Directory enumeration revels hidden information
- Login page credentials are simple
- RCE can be done from plugins
- Privilege execution can be achieved by editing a monitor script
Enumeration
Run nmap scan to find for open ports.
Port 80
View source gives a clue.
Run a gobuster scan to find for hidden directories.
Main site does not bring in much directories, tried it with the nibbleblog sub directory.
/contents/
/content/private/users.xml
Readme indicates the version of the interface.
After sometime bruteforcing the login page , I tried the name of the box and access is gained.
Foothold
Found an exploit without the use of metasploit
Head to the plugins My image page and upload a php reverse shell.
Start a nc listener and activate the reverse shell script.
User access gained.
User flag found.
Privilege escalation
Check for sudo permisions.
Let’s echo a shell in monitor.sh and root access is gained.
Root flag is found
Persecure : my learning archive 