Phoenix Computing Solutions Security engineering, research, and resilient infrastructure

Nibbles

Hack The Box · Easy Linux Box · Retired

Release Date13 Jan 2018
Retire Date30 Jun 2018
DifficultyEasy - Retired [0]
Creatormrb3n
CherryTree FileNibbles.ctb.txt

Enumeration

Nmap exposed SSH and Apache. The root page contained a source-code reference to /nibbleblog. Gobuster found the README, admin panel, content directories, plugins, and themes.

Nibbleblog path in page source

Initial Access

The private content directory exposed users.xml, identifying the username admin. The credentials admin:nibbles opened the Nibbleblog 4.0.3 administration panel.

The installed My Image plugin permitted an arbitrary PHP upload. Uploading a PHP reverse shell and requesting the resulting file returned a shell.

Nibbleblog My Image plugin

Privilege Escalation

Sudo permissions allowed the user to run a script in the personal monitor directory as root. Replacing or modifying that writable script and executing it with sudo yielded a root shell.