Nibbles HTB

Make sure we are connected to the host with a ping scan, then begin the nmap scan.
We see port 80 is open so we go to the 10.10.10.75 website.
We get a hello world empty page. So from here you can check the source code and/or do dirbuster to find hidden directories
By looking at the source code we see a new directory /nibbleblog/ so lets go there.
This brings us to a new blog type web-page. Lets use dirbuster to further enumerate this website.
Once satisfied with the dirbuster configurations lets run it
we instantly get hits , lets try the admin.php
Admin.php is a login page. Somehow we need to find the login credentials. These won’t have default credentials because this is someone personal blog
Lets load up this nibble on msfconsole
Now we really need the password and username for this module
We will use hydra plus seclists to try a bruteforce on the admin username.
We were able to generate credentials through hydra
hydra -l admin -P /usr/share/seclists/Passwords/Leaked-Databases/rockyou-15.txt -vV -f -t 2 10.10.10.75 http-post-form “/nibbleblog/admin.php:username=^USER^&password=^PASS^:login_error”
Now that I have the credentials I wanted to see if I can get the meterpreter shell but I don’t remember how to see if the payload is compatible
Okay so I changed the payload back to what it was and chanfed the targeturi to just /nibbleblog and then ran the exploit to get a shell
Attempted to do a suggester for post exploitation but no success here.
user flag inside the user nibbler
Because we can run the sudo -l command this lets us know that we can create files
we simply created the directories leading up to monitor.sh now lets create the file
Bash -i means bash interactive with the sudo command we can execute and it will give us an interactiuver shell as root because we sudo the command
We see that the script is now executable
Execute the command and it will timeout for a couple seconds but then type whoami or id to confirm you are root and locate the root.txt shell

in this box we learned how to find hidden directories with dirbuster, used searchsploit to find the vulnerability in nibble, also learned some linux privilege escalation and when its usable with sudo -l