Author: Tom Marsland

This is the 2nd box of TJ Null’s OSCP Preparation list, and the first one I’m publishing my writeup for. I recorded the video for YouTube earlier this evening, and I’ll get that posted as soon as my awesome new branding, courtesy of Nathan Cavitt at Mad Standards, comes in!

Once this box is launched, run your standard autorecon scan against it, and wait while it finishes. I tend to add the IP address of the box to my /etc/hosts so I can track the folders easier. As you can see by the screenshot below, port 22 (SSH) and port 80 (HTTP) are open, and the subsequent scans are kicking off.

With CTF-like one-off boxes to hack, chances of port 22 having anything are pretty slim to none here. SSH is not a very oft-hacked protocol, and bruteforcing isn’t normally the goal here. Let’s take a look at port 80’s nmap-http scan.

When autorecon kicks off the subsequent scans, it runs with the appropriate scripts for the port. Great! Here you can see there is a comment on the index of the page that refers you to the nibbleblog directory. Let’s do some enumeration with gobuster on the nibbleblog directory and see what we can find.

Seems pretty standard so far. A login page exists at admin.php, and pulling up the README, you can see that we are running nibbleblog version 4.0.3. A quick jaunt to Exploit-DB (https://www.exploit-db.com/exploits/38489) will show there is an exploit, but you need to know the username and password for it! Time to do some more looking around.

If you try brute-forcing the password with hydra, you will quickly get an error of blacklist protection, causing you to have to reboot the VM. Luckily, taking a look at config.xml and just trying some simple ones shows that we have a lazy admin here!

At this point you can run metasploit and you will get a shell, enabling you to grab the user flag. However, when I went that route, I had issues with privilege escalation that I did not have when I ran this exploit manually, and as I’m prepping for the OSCP, that’s the path we will take here. Let’s keep at it! Login to the website with the above credentials, and let’s keep at it!

The exploit, reading Exploit-DB and the CVE (https://nvd.nist.gov/vuln/detail/CVE-2015-6967) says it utilizes an unrestricted file upload vulnerability in the My Image plugin to upload an executable file and access it at “content/private/plugins/my_image/image.php” so that’s exactly what we will do. I grabbed a PHP reverse shell courtesy of pentestmonkey (https://raw.githubusercontent.com/pentestmonkey/php-reverse-shell/master/php-reverse-shell.php), updated it with my IP address and port, and renamed it to image.php, finally uploading it via the Plugins page. All that’s left to do is browse to the page and get the reverse shell!

From here it’s trivial to browse to /home/nibbler and read user.txt. But what is our path to root from this point? The first, and easiest thing to do is check permissions by running sudo -l. As you can see, there’s something of interest here!

Well, you know we have to check that out! Going to the folder though all we see is a zip file. Unzipping it, we get the monitor.sh discussed. At this point, there’s a few things we can do. You could edit monitor.sh to run netcat back to another listener you set up, or you can go about it the quick way, like this:

As you can see, we echo’d “bash -i” and overwrote monitor.sh with the command to give us an interactive bash shell. We then ran it using sudo, which ran it with no password as ROOT. Once done, we have a root shell! From here it’s trivial to go to /root/root.txt and get the flag for your submission!

I hope you’ve enjoyed the second machine in the TJ Null OSCP Prep list! Stay tuned for more!